Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2023 16:59
Static task
static1
Behavioral task
behavioral1
Sample
fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe
Resource
win10v2004-20220901-en
General
-
Target
fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe
-
Size
248KB
-
MD5
45bd830cddcaaa086370c486ee506812
-
SHA1
2b84f19ded87a4f01a40a1fab2d73de308626b72
-
SHA256
fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342
-
SHA512
1ab6c283fe312ffc584c09c7eac16ee92d301bc4b00a70177d96942b54a88bf3ea004cbdbdcc06a9adc3c9c89208940c0512b739832fe086c4d70c837ce6fc5c
-
SSDEEP
3072:9T22vepD6EgvLA5R1ynBJBAjFTKeCrMCe/9HkLm7XxcT7aa4zwNmv3pZhRxpVUqT:ZKRcvLA5RWJATUgxywXC/CUouO
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-133-0x0000000000680000-0x0000000000689000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
56CD.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 56CD.exe -
Downloads MZ/PE file
-
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\41BC.exe net_reactor C:\Users\Admin\AppData\Local\Temp\41BC.exe net_reactor behavioral1/memory/4948-139-0x0000000000570000-0x0000000000DE6000-memory.dmp net_reactor -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
56CD.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 56CD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 56CD.exe -
Executes dropped EXE 8 IoCs
Processes:
41BC.exeghvjtuf4AE5.exe56CD.exe5B42.exe6352.exe69SXx9WZ.exentlhost.exepid process 4948 41BC.exe 3480 ghvjtuf 1816 4AE5.exe 3024 56CD.exe 1008 5B42.exe 1956 6352.exe 3164 69SXx9WZ.exe 1960 ntlhost.exe -
Loads dropped DLL 3 IoCs
Processes:
InstallUtil.exepid process 4860 InstallUtil.exe 4860 InstallUtil.exe 4860 InstallUtil.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/3024-249-0x0000000000790000-0x0000000000FC4000-memory.dmp agile_net -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\56CD.exe themida C:\Users\Admin\AppData\Local\Temp\56CD.exe themida behavioral1/memory/3024-249-0x0000000000790000-0x0000000000FC4000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
69SXx9WZ.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 69SXx9WZ.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Processes:
56CD.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 56CD.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
41BC.exe5B42.exedescription pid process target process PID 4948 set thread context of 4860 4948 41BC.exe InstallUtil.exe PID 1008 set thread context of 3464 1008 5B42.exe vbc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\51d4ceb5-337b-4c7f-8eee-a1c5b8085171.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230218170035.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3460 1008 WerFault.exe 5B42.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ghvjtuffd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ghvjtuf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ghvjtuf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ghvjtuf -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 213 Go-http-client/1.1 -
Modifies registry class 4 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exepid process 2324 fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe 2324 fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2864 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exeghvjtufexplorer.exepid process 2324 fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe 3480 ghvjtuf 2864 2864 2864 2864 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 2864 2864 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe 1776 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe 1256 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
41BC.exevbc.exedescription pid process Token: SeDebugPrivilege 4948 41BC.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeDebugPrivilege 3464 vbc.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
msedge.exepid process 1256 msedge.exe 2864 2864 1256 msedge.exe 2864 1256 msedge.exe 2864 2864 2864 2864 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
41BC.exe5B42.exe56CD.exemsedge.exeexplorer.exedescription pid process target process PID 2864 wrote to memory of 4948 2864 41BC.exe PID 2864 wrote to memory of 4948 2864 41BC.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 4948 wrote to memory of 4860 4948 41BC.exe InstallUtil.exe PID 2864 wrote to memory of 1816 2864 4AE5.exe PID 2864 wrote to memory of 1816 2864 4AE5.exe PID 2864 wrote to memory of 3024 2864 56CD.exe PID 2864 wrote to memory of 3024 2864 56CD.exe PID 2864 wrote to memory of 3024 2864 56CD.exe PID 2864 wrote to memory of 1008 2864 5B42.exe PID 2864 wrote to memory of 1008 2864 5B42.exe PID 2864 wrote to memory of 1008 2864 5B42.exe PID 1008 wrote to memory of 3464 1008 5B42.exe vbc.exe PID 1008 wrote to memory of 3464 1008 5B42.exe vbc.exe PID 1008 wrote to memory of 3464 1008 5B42.exe vbc.exe PID 1008 wrote to memory of 3464 1008 5B42.exe vbc.exe PID 1008 wrote to memory of 3464 1008 5B42.exe vbc.exe PID 2864 wrote to memory of 1956 2864 6352.exe PID 2864 wrote to memory of 1956 2864 6352.exe PID 2864 wrote to memory of 3016 2864 explorer.exe PID 2864 wrote to memory of 3016 2864 explorer.exe PID 2864 wrote to memory of 3016 2864 explorer.exe PID 2864 wrote to memory of 3016 2864 explorer.exe PID 3024 wrote to memory of 1256 3024 56CD.exe msedge.exe PID 3024 wrote to memory of 1256 3024 56CD.exe msedge.exe PID 1256 wrote to memory of 3644 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3644 1256 msedge.exe msedge.exe PID 2864 wrote to memory of 1776 2864 explorer.exe PID 2864 wrote to memory of 1776 2864 explorer.exe PID 2864 wrote to memory of 1776 2864 explorer.exe PID 1776 wrote to memory of 1256 1776 explorer.exe msedge.exe PID 1776 wrote to memory of 1256 1776 explorer.exe msedge.exe PID 1776 wrote to memory of 3644 1776 explorer.exe msedge.exe PID 2864 wrote to memory of 3912 2864 explorer.exe PID 2864 wrote to memory of 3912 2864 explorer.exe PID 2864 wrote to memory of 3912 2864 explorer.exe PID 2864 wrote to memory of 3912 2864 explorer.exe PID 1776 wrote to memory of 3644 1776 explorer.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe PID 1256 wrote to memory of 3036 1256 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe"C:\Users\Admin\AppData\Local\Temp\fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\41BC.exeC:\Users\Admin\AppData\Local\Temp\41BC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\69SXx9WZ.exe"C:\Users\Admin\AppData\Local\Temp\69SXx9WZ.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\ghvjtufC:\Users\Admin\AppData\Roaming\ghvjtuf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeC:\Users\Admin\AppData\Local\Temp\4AE5.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\56CD.exeC:\Users\Admin\AppData\Local\Temp\56CD.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=56CD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffc533046f8,0x7ffc53304708,0x7ffc533047183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11475928101537820981,6766410331219362630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff76d785460,0x7ff76d785470,0x7ff76d7854804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=56CD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc533046f8,0x7ffc53304708,0x7ffc533047183⤵
-
C:\Users\Admin\AppData\Local\Temp\5B42.exeC:\Users\Admin\AppData\Local\Temp\5B42.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 2602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\6352.exeC:\Users\Admin\AppData\Local\Temp\6352.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1008 -ip 10081⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5248831967cd174eeb5bb5eba173da6a5
SHA181c9c24d106aeb26f4ae1dcd0866ec7ed6d81d99
SHA2563752c2ea4a6ba3d1a5b7545246c430a37cc79c8fdd60c82b4d0200ce083cf9c3
SHA51207cd5594939f896098976a4fec9dd1005fa031637697187f9a038b65ecb46d9d9d5fab3e51f7eade64c369e8a885c0c8e9b76efc71e3ed3c4e613c623b09425d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\41BC.exeFilesize
8.4MB
MD5d38e84427edbc6789f1bb12ae69c6dc5
SHA1718aa1778e1ad4a23b53adea4dbabeeb39b89f94
SHA256bd4e3e2c455b2322b4b874a319a14c638e6b567c7c1e83edc839ac05aee1a6a4
SHA512271966fc13137d5cda7eb9283c3c9c77361dd10d37eef713d0ac9c08326d930c1202d7470f1f2ad9e66f2a798354f09ce846139a8e2ca2b91d7719c215a68948
-
C:\Users\Admin\AppData\Local\Temp\41BC.exeFilesize
8.4MB
MD5d38e84427edbc6789f1bb12ae69c6dc5
SHA1718aa1778e1ad4a23b53adea4dbabeeb39b89f94
SHA256bd4e3e2c455b2322b4b874a319a14c638e6b567c7c1e83edc839ac05aee1a6a4
SHA512271966fc13137d5cda7eb9283c3c9c77361dd10d37eef713d0ac9c08326d930c1202d7470f1f2ad9e66f2a798354f09ce846139a8e2ca2b91d7719c215a68948
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\56CD.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\56CD.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\5B42.exeFilesize
1.1MB
MD5b5cd4deb250cbeda544d8622d7ed90bf
SHA1d8f784eba044a176e935cd6bc9a97d346a810c98
SHA2568f4b3502e38100486b960ef7d7aea1c43ba2ba38f5d31439b1ae9324c3f43621
SHA5121a828445c797a4af0279eb2d0ba2e973b2768da5eeec6ebc42c104a1bf689268798380b8da2496757d7ee0e61f10cadadc7369fb5cb535d13260d7721562f2ae
-
C:\Users\Admin\AppData\Local\Temp\5B42.exeFilesize
1.1MB
MD5b5cd4deb250cbeda544d8622d7ed90bf
SHA1d8f784eba044a176e935cd6bc9a97d346a810c98
SHA2568f4b3502e38100486b960ef7d7aea1c43ba2ba38f5d31439b1ae9324c3f43621
SHA5121a828445c797a4af0279eb2d0ba2e973b2768da5eeec6ebc42c104a1bf689268798380b8da2496757d7ee0e61f10cadadc7369fb5cb535d13260d7721562f2ae
-
C:\Users\Admin\AppData\Local\Temp\6352.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\6352.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\69SXx9WZ.exeFilesize
4.0MB
MD5feccda803ece2e7a3b7e9798714ad47e
SHA1e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA25614529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
-
C:\Users\Admin\AppData\Local\Temp\69SXx9WZ.exeFilesize
4.0MB
MD5feccda803ece2e7a3b7e9798714ad47e
SHA1e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA25614529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD5b7ebeabaab38662f3fcd1482129de04c
SHA16315a876138d7d62e6e94cd1bfc7d9eda1e5467c
SHA25658d7138dcfd53dcb2fa03ce5a3e49b1f799587878e258d6c5e81b8bbf28cb38a
SHA51227534bb0f5f614dad57aff1ae9ad4239e758818c3a99e791c2287b764681552ee23787bf13670ff6798f673edf9943412a41838d85ad2e367250fb3051c8caf7
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
346.1MB
MD5eb569e4309bd5329a17b19bba75f9711
SHA1b80c5f83309d308799c4f2b44649a842d8fb76ba
SHA25687c89147b569a4ba10fbc2bb23c2e370acd7ccfc9036f12a8183172f2952df92
SHA51255421e0ca00e47a7a8501d9691caa9de2315cb220054d7f63b033cad0f1e32574553f1bb4861f949183a31708b78b506a8514f7b3397b7c6b25b32698baed4c0
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
346.9MB
MD55835d524e92c1c3c821ef935145b2068
SHA156a29f3b01f6030ea870f43a447146df2cd39c11
SHA256f9d25ab4aa9d1151c43a5a75bccc91f8f67e7f9f320b5dd8ecd7d77a5c002ebc
SHA51290063a480ae504b11a48613480b23dcfa2a863b6b9b34d866ff73eea81fd68443931aad6f4f3c15a63c2b23510c43223894427956a911051f63b54bcf9fe53fe
-
C:\Users\Admin\AppData\Roaming\ghvjtufFilesize
248KB
MD545bd830cddcaaa086370c486ee506812
SHA12b84f19ded87a4f01a40a1fab2d73de308626b72
SHA256fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342
SHA5121ab6c283fe312ffc584c09c7eac16ee92d301bc4b00a70177d96942b54a88bf3ea004cbdbdcc06a9adc3c9c89208940c0512b739832fe086c4d70c837ce6fc5c
-
C:\Users\Admin\AppData\Roaming\ghvjtufFilesize
248KB
MD545bd830cddcaaa086370c486ee506812
SHA12b84f19ded87a4f01a40a1fab2d73de308626b72
SHA256fd10ab06cb077d980b0cd2b0f1e6da381ed09860b6a8fb0acf41cc4dbcd6e342
SHA5121ab6c283fe312ffc584c09c7eac16ee92d301bc4b00a70177d96942b54a88bf3ea004cbdbdcc06a9adc3c9c89208940c0512b739832fe086c4d70c837ce6fc5c
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD555c60c83d8bb6d0c92d0d5781cc03814
SHA1395affc57b0a846f8a747438dddcf9a9bcb1b81a
SHA25620bf72e84e48d7127f6cb21628d2f5d0e8f20b15eb93c9806f274e792e427b4b
SHA512fe954375c22d28588d3bcacaaa61a454fd94fb426851db2e4e02b0563c677d5553178c74fb58ff54806b3eb1ef1d81f9df0c415c344093587b7778926773b969
-
\??\pipe\LOCAL\crashpad_1256_UUASAGDGICAIVDQFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/228-211-0x0000000000000000-mapping.dmp
-
memory/460-225-0x0000000000000000-mapping.dmp
-
memory/524-206-0x0000000000000000-mapping.dmp
-
memory/524-209-0x0000000000D50000-0x0000000000D5C000-memory.dmpFilesize
48KB
-
memory/524-214-0x0000000000D60000-0x0000000000D66000-memory.dmpFilesize
24KB
-
memory/524-259-0x0000000000D60000-0x0000000000D66000-memory.dmpFilesize
24KB
-
memory/552-213-0x0000000000000000-mapping.dmp
-
memory/1008-180-0x0000000000F90000-0x00000000010A8000-memory.dmpFilesize
1.1MB
-
memory/1008-163-0x0000000000000000-mapping.dmp
-
memory/1152-264-0x0000000000000000-mapping.dmp
-
memory/1256-185-0x0000000000000000-mapping.dmp
-
memory/1256-197-0x0000014E09A40000-0x0000014E09A4F000-memory.dmpFilesize
60KB
-
memory/1428-273-0x0000000000000000-mapping.dmp
-
memory/1776-196-0x0000000000F40000-0x0000000000F4F000-memory.dmpFilesize
60KB
-
memory/1776-257-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/1776-195-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/1776-190-0x0000000000000000-mapping.dmp
-
memory/1816-152-0x0000000000C90000-0x0000000000C98000-memory.dmpFilesize
32KB
-
memory/1816-155-0x00007FFC52850000-0x00007FFC53311000-memory.dmpFilesize
10.8MB
-
memory/1816-149-0x0000000000000000-mapping.dmp
-
memory/1956-175-0x0000000000000000-mapping.dmp
-
memory/1956-179-0x00007FFC52850000-0x00007FFC53311000-memory.dmpFilesize
10.8MB
-
memory/1960-278-0x0000000000000000-mapping.dmp
-
memory/2236-220-0x0000000000000000-mapping.dmp
-
memory/2236-267-0x0000000000E80000-0x0000000000E85000-memory.dmpFilesize
20KB
-
memory/2236-231-0x0000000000E70000-0x0000000000E79000-memory.dmpFilesize
36KB
-
memory/2236-230-0x0000000000E80000-0x0000000000E85000-memory.dmpFilesize
20KB
-
memory/2272-252-0x0000000000000000-mapping.dmp
-
memory/2324-135-0x0000000000400000-0x00000000005BA000-memory.dmpFilesize
1.7MB
-
memory/2324-134-0x0000000000400000-0x00000000005BA000-memory.dmpFilesize
1.7MB
-
memory/2324-133-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/2324-132-0x00000000006FE000-0x0000000000714000-memory.dmpFilesize
88KB
-
memory/2712-250-0x0000028601780000-0x000002860178F000-memory.dmpFilesize
60KB
-
memory/2712-246-0x0000000000000000-mapping.dmp
-
memory/2716-262-0x0000000000000000-mapping.dmp
-
memory/2720-241-0x0000000000AA0000-0x0000000000AA7000-memory.dmpFilesize
28KB
-
memory/2720-242-0x0000000000A90000-0x0000000000A9D000-memory.dmpFilesize
52KB
-
memory/2720-269-0x0000000000AA0000-0x0000000000AA7000-memory.dmpFilesize
28KB
-
memory/2720-238-0x0000000000000000-mapping.dmp
-
memory/2772-247-0x0000000000000000-mapping.dmp
-
memory/2772-253-0x0000018AC0110000-0x0000018AC011F000-memory.dmpFilesize
60KB
-
memory/3016-188-0x00000000005C0000-0x00000000005C7000-memory.dmpFilesize
28KB
-
memory/3016-189-0x00000000005B0000-0x00000000005BB000-memory.dmpFilesize
44KB
-
memory/3016-256-0x00000000005C0000-0x00000000005C7000-memory.dmpFilesize
28KB
-
memory/3016-184-0x0000000000000000-mapping.dmp
-
memory/3024-159-0x0000000000790000-0x0000000000FC4000-memory.dmpFilesize
8.2MB
-
memory/3024-249-0x0000000000790000-0x0000000000FC4000-memory.dmpFilesize
8.2MB
-
memory/3024-156-0x0000000000000000-mapping.dmp
-
memory/3024-228-0x0000000000790000-0x0000000000FC4000-memory.dmpFilesize
8.2MB
-
memory/3036-208-0x000001BF175D0000-0x000001BF175DF000-memory.dmpFilesize
60KB
-
memory/3036-201-0x0000000000000000-mapping.dmp
-
memory/3164-275-0x0000000000000000-mapping.dmp
-
memory/3464-218-0x0000000006960000-0x00000000069B0000-memory.dmpFilesize
320KB
-
memory/3464-234-0x0000000006C50000-0x0000000006C6E000-memory.dmpFilesize
120KB
-
memory/3464-169-0x0000000000000000-mapping.dmp
-
memory/3464-192-0x0000000005EF0000-0x0000000005F82000-memory.dmpFilesize
584KB
-
memory/3464-191-0x00000000063B0000-0x0000000006954000-memory.dmpFilesize
5.6MB
-
memory/3464-227-0x0000000006D80000-0x0000000006F42000-memory.dmpFilesize
1.8MB
-
memory/3464-186-0x0000000005330000-0x0000000005396000-memory.dmpFilesize
408KB
-
memory/3464-183-0x0000000004FE0000-0x000000000501C000-memory.dmpFilesize
240KB
-
memory/3464-219-0x0000000006A30000-0x0000000006AA6000-memory.dmpFilesize
472KB
-
memory/3464-170-0x0000000000B00000-0x0000000000B44000-memory.dmpFilesize
272KB
-
memory/3464-178-0x00000000054E0000-0x0000000005AF8000-memory.dmpFilesize
6.1MB
-
memory/3464-181-0x0000000004F80000-0x0000000004F92000-memory.dmpFilesize
72KB
-
memory/3464-229-0x0000000007940000-0x0000000007E6C000-memory.dmpFilesize
5.2MB
-
memory/3464-182-0x00000000050B0000-0x00000000051BA000-memory.dmpFilesize
1.0MB
-
memory/3480-168-0x0000000000400000-0x00000000005BA000-memory.dmpFilesize
1.7MB
-
memory/3480-154-0x0000000000400000-0x00000000005BA000-memory.dmpFilesize
1.7MB
-
memory/3480-153-0x00000000006DE000-0x00000000006F4000-memory.dmpFilesize
88KB
-
memory/3644-187-0x0000000000000000-mapping.dmp
-
memory/3644-198-0x00000297615D0000-0x00000297615DF000-memory.dmpFilesize
60KB
-
memory/3760-266-0x0000000000000000-mapping.dmp
-
memory/3912-194-0x0000000000000000-mapping.dmp
-
memory/3912-199-0x0000000000560000-0x0000000000569000-memory.dmpFilesize
36KB
-
memory/3912-207-0x0000000000570000-0x0000000000575000-memory.dmpFilesize
20KB
-
memory/3912-258-0x0000000000570000-0x0000000000575000-memory.dmpFilesize
20KB
-
memory/4060-255-0x0000000000000000-mapping.dmp
-
memory/4088-224-0x00000204C9430000-0x00000204C943F000-memory.dmpFilesize
60KB
-
memory/4088-205-0x0000000000000000-mapping.dmp
-
memory/4116-215-0x0000000000000000-mapping.dmp
-
memory/4116-217-0x0000000000730000-0x0000000000757000-memory.dmpFilesize
156KB
-
memory/4116-261-0x0000000000760000-0x0000000000782000-memory.dmpFilesize
136KB
-
memory/4116-226-0x0000000000760000-0x0000000000782000-memory.dmpFilesize
136KB
-
memory/4220-237-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/4220-236-0x00000000009B0000-0x00000000009B6000-memory.dmpFilesize
24KB
-
memory/4220-235-0x0000000000000000-mapping.dmp
-
memory/4220-268-0x00000000009B0000-0x00000000009B6000-memory.dmpFilesize
24KB
-
memory/4272-202-0x0000000000000000-mapping.dmp
-
memory/4272-216-0x0000024FAFC80000-0x0000024FAFC8F000-memory.dmpFilesize
60KB
-
memory/4332-270-0x0000000000000000-mapping.dmp
-
memory/4380-233-0x0000000000000000-mapping.dmp
-
memory/4860-143-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4860-146-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4860-193-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4860-148-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4860-144-0x00000000004088B8-mapping.dmp
-
memory/4948-147-0x00007FFC52A60000-0x00007FFC53521000-memory.dmpFilesize
10.8MB
-
memory/4948-139-0x0000000000570000-0x0000000000DE6000-memory.dmpFilesize
8.5MB
-
memory/4948-136-0x0000000000000000-mapping.dmp
-
memory/4948-140-0x00007FFC52A60000-0x00007FFC53521000-memory.dmpFilesize
10.8MB
-
memory/5004-272-0x0000000000000000-mapping.dmp
-
memory/5088-243-0x0000000000000000-mapping.dmp
-
memory/5088-245-0x0000000000820000-0x000000000082B000-memory.dmpFilesize
44KB
-
memory/5088-244-0x0000000000830000-0x0000000000838000-memory.dmpFilesize
32KB