Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2023 10:05
Static task
static1
Behavioral task
behavioral1
Sample
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe
Resource
win10v2004-20230220-en
General
-
Target
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe
-
Size
6.0MB
-
MD5
c65a354ac28f2f45c7ca8a38e4f778d6
-
SHA1
42d84f6be5cfa1503dc7bd8275073872d71a4fc0
-
SHA256
396cb9e17c57f09c4afab97f91e72011e3f115b15e764c39d26473d92fe2c45e
-
SHA512
7acba2651fb1378a97c47ce6723808235ddd74d2cb736f5fb6f28a241f3b33188e9a511c6be2eb3ca8e7cad68c05a76a0c853edc5a417a16aacd5c0388950017
-
SSDEEP
98304:KSi1jH0UJukUYMwioEgGU9KM+ZFNIO05p0oO2gz8+fyTx:MUvkUMiij9KM+7Npc0R4+KTx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpDriverDoc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation DriverDoc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpDriverPro.exesetup.exedescription ioc process File opened for modification C:\Program Files (x86)\DriverDoc\Dutch.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-66TJJ.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-863GU.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-KLF25.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-0QPC7.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-DL9SU.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-ISL9A.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-UC06U.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\DOCSchedule.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Spanish.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Polish.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-8CUJM.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-UKTJT.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-LGRI6.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-59DT6.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-4VEF5.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-P65RG.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Brazilian.ini DriverPro.exe File opened for modification C:\Program Files (x86)\DriverDoc\Extra\DriverPro.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Portuguese.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\English.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\stub64.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-ED38P.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-04JCB.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Japanese.ini DriverPro.exe File opened for modification C:\Program Files (x86)\DriverDoc\7z.dll 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Finnish.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-30LOS.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-4VOOE.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Portuguese.ini DriverPro.exe File created C:\Program Files (x86)\DriverDoc\Extra\is-M70AS.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-6365A.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-BPVN1.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-1GOJS.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6ccb9d75-bbb3-4fbc-bf8b-cea6eef42e51.tmp setup.exe File opened for modification C:\Program Files (x86)\DriverDoc\Brazilian.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\DriverDoc.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-PDBNP.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-6098L.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-0F13S.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-QAJKF.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Finnish.ini DriverPro.exe File created C:\Program Files (x86)\DriverDoc\is-UFI8T.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-JL40T.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-7PJO8.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-KGA4M.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Settings.ini DriverPro.exe File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Swedish.ini DriverPro.exe File opened for modification C:\Program Files (x86)\DriverDoc\Italian.chm 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-IPE4A.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-9BTII.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-LPG05.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-F36EC.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Polish.ini DriverPro.exe File opened for modification C:\Program Files (x86)\DriverDoc\sqlite3.dll 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-CBU9T.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-LMSKR.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-6SFQU.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\Extra\Dutch.ini DriverPro.exe File created C:\Program Files (x86)\DriverDoc\Extra\is-TUJC5.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-FV37O.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\Extra\is-CLLC7.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File created C:\Program Files (x86)\DriverDoc\is-5RC54.tmp 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp File opened for modification C:\Program Files (x86)\DriverDoc\unins000.dat 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp -
Executes dropped EXE 4 IoCs
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpDriverDoc.exeDriverDoc.exeDriverPro.exepid process 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp 1428 DriverDoc.exe 1620 DriverDoc.exe 4932 DriverPro.exe -
Loads dropped DLL 5 IoCs
Processes:
DriverDoc.exeDriverDoc.exeDriverPro.exepid process 1428 DriverDoc.exe 1620 DriverDoc.exe 4932 DriverPro.exe 1620 DriverDoc.exe 1620 DriverDoc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DriverDoc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceCharacteristics DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ParentIdPrefix DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LocationInformation DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ParentIdPrefix DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UINumberDescFormat DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceCharacteristics DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Driver DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0003 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0004 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ParentIdPrefix DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ DriverDoc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumberDescFormat DriverDoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverDoc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 216 taskkill.exe 3916 taskkill.exe 984 taskkill.exe 1844 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpDriverDoc.exeDriverPro.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 1428 DriverDoc.exe 4932 DriverPro.exe 4932 DriverPro.exe 2000 msedge.exe 2000 msedge.exe 4340 msedge.exe 4340 msedge.exe 4324 identity_helper.exe 4324 identity_helper.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe 4340 msedge.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exeDriverDoc.exedescription pid process Token: SeDebugPrivilege 216 taskkill.exe Token: SeDebugPrivilege 3916 taskkill.exe Token: SeDebugPrivilege 984 taskkill.exe Token: SeDebugPrivilege 1844 taskkill.exe Token: SeDebugPrivilege 1428 DriverDoc.exe Token: SeIncreaseQuotaPrivilege 1428 DriverDoc.exe Token: SeImpersonatePrivilege 1428 DriverDoc.exe Token: SeLoadDriverPrivilege 1428 DriverDoc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpmsedge.exepid process 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp 4340 msedge.exe 4340 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmpmsedge.exedescription pid process target process PID 4720 wrote to memory of 4496 4720 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp PID 4720 wrote to memory of 4496 4720 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp PID 4720 wrote to memory of 4496 4720 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp PID 4496 wrote to memory of 216 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 216 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 216 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 3916 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 3916 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 3916 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 984 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 984 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 984 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 1844 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 1844 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 1844 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp taskkill.exe PID 4496 wrote to memory of 1428 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 1428 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 1428 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 1620 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 1620 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 1620 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverDoc.exe PID 4496 wrote to memory of 4932 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverPro.exe PID 4496 wrote to memory of 4932 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverPro.exe PID 4496 wrote to memory of 4932 4496 42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp DriverPro.exe PID 4340 wrote to memory of 1348 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 1348 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe PID 4340 wrote to memory of 4152 4340 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe"C:\Users\Admin\AppData\Local\Temp\42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\is-9C5LT.tmp\42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp"C:\Users\Admin\AppData\Local\Temp\is-9C5LT.tmp\42d84f6be5cfa1503dc7bd8275073872d71a4fc0.tmp" /SL5="$801BE,5347251,879104,C:\Users\Admin\AppData\Local\Temp\42d84f6be5cfa1503dc7bd8275073872d71a4fc0.exe"2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DriverDoc.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DriverPro.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3916 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DOCSchedule.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "DOCTray.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Program Files (x86)\DriverDoc\DriverDoc.exe"C:\Program Files (x86)\DriverDoc\DriverDoc.exe" /INSTALL3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Program Files (x86)\DriverDoc\DriverDoc.exe"C:\Program Files (x86)\DriverDoc\DriverDoc.exe" /START /INSTALLED3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:1620 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Schedule" /F4⤵PID:2588
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "DriverDoc Monitoring" /F4⤵PID:3696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.solvusoft.com/en/driverdoc/install/4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9d17e46f8,0x7ff9d17e4708,0x7ff9d17e47185⤵PID:1348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:25⤵PID:4152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:85⤵PID:2096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:15⤵PID:4392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:15⤵PID:4308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:15⤵PID:2064
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:85⤵PID:1920
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
PID:2364 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b99c5460,0x7ff7b99c5470,0x7ff7b99c54806⤵PID:4372
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:15⤵PID:5088
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:15⤵PID:4304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:15⤵PID:4868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:15⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10223401819236242866,10382375611195281141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4284 -
C:\Program Files (x86)\DriverDoc\Extra\DriverPro.exe"C:\Program Files (x86)\DriverDoc\Extra\DriverPro.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
991KB
MD5eeb340cd0317612256596870fdad903f
SHA1c4cd2abe134b3d5e043593dd88c7d61d6d53e417
SHA256aecadb80ac6e9bfdf585933d5bf3741a130206df61324cccbf613a31101a3d54
SHA512a4c03aeada2f9f0b333db50bdf42612eef742b6f26eb39749aebe9d504f47aef4d3e098f49b04cfd10a2c2fb73a7bbb1b53bfd098e4e6ccdd9ce8a9e56554c9e
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
6.9MB
MD5593731ec5ad57f5556ba30fbfab0d715
SHA1f1134e4ee01c4a38888193130ea5255f6a782685
SHA2565a5c40820ef02808d9d3759d915d8f8ff52dc6a3fc2590584f4c36a9ad3c1de4
SHA5128d28fcbe6f9b044648c730a189dc860e6fd6330fed4c60feb973b8f296358b83a1977ebe57fcfb22837cffd7a649d0f2d963b77982436e38b344d613c2b3df1f
-
Filesize
12KB
MD5b24c70f0951a902d62e97321ee12be9d
SHA1759555b579c811eaa2bc123edbf49fa6fdc0ab72
SHA256226b01c08d3cd2f0099c6138d97e4ec3096207e220d0203400c9dbeabdf1a446
SHA512b521e94e80d4d97ce6bbc76e954ed3cacfe06fbe9408e8228a442e71c1672218033ba10191083a8dec90e8f5eed475b59c8ad9112c4648099bd1c51778260ee0
-
Filesize
12KB
MD5c4e19798b19173eca54cc2f615a0b99e
SHA16638701c7b4991227e1f883414bcd1315b7b0864
SHA25601539234b53ddc8ac82665ea18daeadd1edd2b4b918b21fa72f3848b6639a301
SHA5124c976fc3282531d5ad32f5ec1f436378cf73f068c650c578e54b25cbe2911a4709bd14c46ebc74ef395afb771e8f8d9f28798b204d5f2a89589f8119ea7c8d20
-
Filesize
4.9MB
MD55a1d85fb3c9062304547475d6bd383ed
SHA1dc8722d155277e841ea9404beabb1c012c7eefc0
SHA256de9a6adbda9378230f1a4caff8c23d208a0d19114dcec00391869a83e129787f
SHA512681b4341548c34e2b7dce6731ef7cd35a2271ef482984e4f706b44c07962ee4673d5b2596020c2d2dd1f92867e7001ea84549ac517032f25b3e899313c758e3f
-
Filesize
12KB
MD5cba424ebfd76fbab92e4c611ebbc6bdf
SHA19678ae22d9585dd12d692522c30aebc5b92a2249
SHA2566951d18ba89c4875983cce91305f802f0f690675d76fd14fa0cb0f792b0aaea3
SHA51222967f3bdd097fa5ffa06945a69d5d39c26b9bd21892a19e9efa234b24349fed7d7e62187506c8d18475055041af15e9b3a877f56ac7eae29478253bc31cc8dc
-
Filesize
11KB
MD52e509dd5f4217be553fbe379a0a90c23
SHA19dd8f007d11ad0f4cf30cbc555bb3cf36d4c2a02
SHA256a1e376b66a11846fd448708b81a894d279032d0247bd5c0f79f606c945397162
SHA5126c11872669e593d77dbcefc4a5bd5257c49329bfa8a5260fcb743855d5e7dcfeaf48a69bbe16b81057b049957fca263c7efca630a257fc5813edb687467063cf
-
Filesize
12KB
MD5d140f9ae6ca875d2f8bcec576bb2c203
SHA1871cc1e85dde0d2b4bdab5566defbe8483348fcf
SHA25639fca6cb75735a2bc2abe2b35ca94cde8da856955de641c165c7e1e1f8b5b516
SHA5125815e0d2e5f9242f587d6d79679232c32a9279b25fde308763f210a4cf365430e76d259b714de0aed9904277b586380fbb04a057dd66ae143cca0eef1329362c
-
Filesize
13KB
MD5637686253a68504cc01fe055a25346f7
SHA159e36e5a2e71887acb4eac090e1cdb8d240379b1
SHA256f008522a75e279cdb23489e24b4835ce6516cf2a669df705c072b23f311b7a3a
SHA51216377b987a8ede42a379a39b641cf3a6c2dc11c454e9cc460808ab3dc8dab5c5782de26923ce524eaeaa5d389bfce5ba46561791424a65b08de2a69b71652fda
-
Filesize
13KB
MD5cae7b08264859d094eccbcd1686e4b58
SHA131e000b5f93a4af158e3211e9ef6ee24a43df6ed
SHA2561cdef54fcbaf02d46fb31cee5738e2e1f9d5bcd89b58f49ef98c011329266e69
SHA51231646eba2f4e4d312fafe191608c5fa963c4ed1753cc55340314c9c6142424b36d819f67bd9218ad41c2627c8289c5764a752ebc449d3e8e43aa5ab833631771
-
Filesize
12KB
MD549c62ebd53b8d40b961ab63d16d1b18c
SHA1b002185abcc6f84fb272445a3579cfe96972e19a
SHA2569f47adfacf4d1855d0de2b806149084cf6051de2b6de09692fbf17a93b149343
SHA5127895f99d82f95cb3f6c0f91a0c283472205f052c81e8321cd01ebae20d94813a9139262815a0d4258bd719e4cba63e5a2ae9457902f10244affaebed33e72d24
-
Filesize
15KB
MD54cc34523cefbe42b62cf1839c0f54663
SHA1fdaa0ad16c693906978f7e1364b1c850869354bf
SHA25694c1b8fc0bda3ba585e92b4ed812421bc6dea4da29b2321b1286d27615571b79
SHA512c0ffb819229709cc3bc340c859330da8c5c91763fb5ccccbaed073ed282150dbcefd329fbab440e88dafe30c39e8055be0009113a1400d9170a6701ba63b2824
-
Filesize
11KB
MD53285372c3ad0355bd7eec8488f40629d
SHA148288694c5a5724e8c56339d675666d8476741aa
SHA2562c402fd6e6aab9d8ffc93ca29f07fc55420a598ed1368ec2ad381cb4808195f2
SHA512ea6bd5c5274deb99c4c70f29f17e324649139b5b47cc054a52a2e3b3c4f0e4b1fd80cd105fd32d0b3ab29af115cc09ced4c7f8529bd651f7a6d265dd3d00acab
-
Filesize
13KB
MD592bfc521b92d8ac30cb6fdb31ee37fb2
SHA114f04856f4a3661007fabb846b83499ebc34cdf7
SHA256357ac44df2a8fa996a78061bc67531b8dd5d2770a3a4aa7ed1aad3c5c52e4050
SHA5124dfc21cdaa3c00e93008ad55061bbb02d31504cec26271cb040356a1e04408fa766b12425aea0e91adb230fe0d231466de4392f0b48c1477b9f083e795ab9b66
-
Filesize
12KB
MD5d8bd59eb5dcd48a976d2ae97c2edb6a3
SHA1a03eea088611d0acb75aa0d02f14b7c1e5a24e32
SHA2562cb3920f6b44c3c0915c4b7e8f5f24b9c4e3ea0932e14c8c0742fafd07a992e2
SHA51274fca4cd378009775c0eef179ee1e0961591e5ab0b3551dbb91e858edca9437bb1d99f581ced11752adee2c2d8b9c6dfc4329d9a0fdeb0385c09ba1012ba8109
-
Filesize
21KB
MD5b4b289047fd327d99e5809234174736b
SHA1c9f2e45efa8ce22720f2dc49bc85764dee49025d
SHA256eb0f8c2bfd6f0d3744e16ddd7db56590e5c9a4f1960b4ea9c2240f691b2504e4
SHA512dccac50a017bb1482e7657f5b166f0316336d049ef446ecc26b1a3cd38ca7e90cbb713bdac3b59414f8e2800fd0b25d25d3ccd4641993213052329e272b96f9a
-
Filesize
73B
MD54dfd24933bec370032a0fde1452d9b14
SHA1f3c3bc92eabe67c9072a0a29968322adad9489c2
SHA256035c7dd8eef04f652d7d7b6b28c27ddb0b867502d088c1cba12319b5718fb1b6
SHA51285ccd0c6cf38ee620b0a4a2289c4161fcb01fcd3546e1cf3ebfe83a087133972661e8b3854db5643caaadded1fcb3d621141a8f39490866d21b53b947f42d97f
-
Filesize
12KB
MD53eb3ce7cb9d27f10c18ba319882cc7ed
SHA17e09a5a88f46570f0d95d19602f38379ae01742e
SHA256419ef75a40cc8d0ae3ae7767bc87f9c967b0068afa8bb03cd67b697c00f40cea
SHA5125ec29890eaf47e4ea91dc948811bd1f9dc7dac27b8b116a620b634baf8e33ee605a6e815da04df45478c1460f4cca371ae469f7e4093e12184e24a3a934ef059
-
Filesize
12KB
MD545b6b39f4009ef7a14dde07ceb42647a
SHA15372f2432e6a110ee2fff3b37e30a1443132f38f
SHA2561388b135d43d916af79f2630308b7a28e010fb5e32205c70e796130c0828c7fb
SHA51248936b2885b73c0c7841d237a78ad38b0c60f63cac5746e4da87342fbc3b234e7feb437e7456dcb5824c06d022e5351c237819231b3f0d013762c34a2c0844ec
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
633KB
MD5094c675f4e0bfb27c2e77457cbcd9cc7
SHA19026248bd7802de39282653b0f56d68edfef30a1
SHA256d3dd110c4d330332a37f06268013e4595705981bc74e577f946485416651b83b
SHA512f1730b831df2805e10d78dc984e6e877e437de57cd20488ebfe48f92db8ced1889c369e70d17aee5eb366aa2c7baa14d426cf6c30324b527fa303b1bfccfe0a7
-
Filesize
152B
MD5ae2c65ccf1085f2a624551421576a3ee
SHA1f1dea6ccfbd7803cc4489b9260758b8ad053e08e
SHA25649bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54
SHA5123abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef
-
Filesize
152B
MD5c3770be634be8da92e71a3f9f76d79d3
SHA1f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f
SHA25623549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432
SHA51209c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72005347-1d9e-447f-b0ab-5e8434343b51.tmp
Filesize24KB
MD5cfd585ce0db9a1484f8223dc2cfce2f8
SHA14e5e287160c05ecdff8acdfa0899faa5bad4de82
SHA2560bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445
SHA512b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize552B
MD5a051a455ceaa383aea8deb2c0a5d840f
SHA1186d2eb8a7a51e02ae2e6dabd04d47ec00a31e3f
SHA2564a3868452f03ba0ecde486d0f814831f8aed1a5184c17869fbcec3ea034779ed
SHA512a65e4864514880ddf5d1999557b9c8e5ada41410f7d99494288e6f3cc2b68c05199123e0f6a7e1eb93d97b4167adaf75dee4d014353ca13c66fd31d0dd0e278d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD593a85db0b8bbeaf2aaca4a32b098e97b
SHA117296e5c111c0091af742a3e5e2fb0de9be4f328
SHA256fa79230f9d88d5dec362bc2d5ad13395252670a6af625c8c14b8d3d6cad1b515
SHA5120435cba0411198992c1cc5f5d930f742f7758fff5f2119110572446637bf4be2d06b62a1e5a0c557baf4a5ed4b3caad840ac781a66a4b404c7b4dc38309a78eb
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD5a7d2e0388704c1d2d33f7d117287dca1
SHA1ccd6e66354d012985802dd573c3cf09f78ba545d
SHA25670462e4b03a3fd65f9347968a712a571545ef2cec39627778fb341877651fdea
SHA51201338c5a40d3067bc737089d581498681954c6d27b1845e78bca1b82a1a4bde7129d970d8920cba571b5b2e4113df3e14574838479eb3e4e069bda4e6b7713f8
-
Filesize
2KB
MD5aa70aa255d17cc333b641ef3d2dffb83
SHA176832fb5d0e6bef83b0242b6e2cf70f981f1b938
SHA256191c1ee55c56f75526680381a238bd30eeade322e04584f984fe5e7b6cee79d1
SHA51243e462197154549be7c5655f94866c3c0c3a9e5f876f6ad6e36e936ecf75b5b009ebf90a4660ba3618b0884b3cc0da71866188bc9c6c90a0903b2d57f6705603
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD518d898323f52f501a54c3c79afbb8971
SHA1c3a5bc1452e96b11b163ad400e8c788f1a62b3f4
SHA2561664d42da814eebe512086a6b8cfaf7ca224af6f351bb31430cc87ebb62e9de9
SHA512db5196826cbccc54e40c8492d56212535740a0efeeb561ed59a2be0797a0358a631cf0f10e2be08560e5795581abc272fe2fc8ed29408fa0d4f75adfd3e76b1f
-
Filesize
6KB
MD56901b1d7e256111a9830f0041d90fa86
SHA17fdf5f4629c02bbc0751c2a264078501c7f678f7
SHA25687925775fa97ecc604ee974e48677b8e1a73560cb1e429087a0e2b9cbad39078
SHA5120ce553e15cda5d54ba1dd18745de556e0403e85f856dfe0792d5b7320bc72fab77f92e4f49ca3e36a0b5a5d618b24be77d8898606bbaf031b0df9b408361038a
-
Filesize
6KB
MD5d4de9e063f5c561f372b6f5e7ca4a513
SHA114d1f5b1084b13f1d57875dc3a1ed7e9a4eaf256
SHA256957fecd0ac739a2c1dec76275dcf179aee326623a6c76a74ac48a9abd9f4e13b
SHA512ed9297c6fbf355d59a95fde02e71342066d7b004dfce65f37c5dad00143e6b05bd31befe0b3da062d83ff9debd25210c0789e6537438c6070aeb65f37fb05790
-
Filesize
24KB
MD5b3fbb8a02260d5e41407a7e1af3ee2f6
SHA19180c8b9593405936b0fe52272571b63829525d4
SHA2568c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de
SHA5128a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
9KB
MD5bd72c91f043f77007731a272dbeb081f
SHA110975100f161251071cc794b0a97ad33862e3c79
SHA2564e339c25fd18840714a67cc6e8052b1a82969d618d7e2b2ad3a8c2290464a540
SHA512b5ab39838c27ff9b341d0b0843137c79fe41ec500f8230661ea6235cafd1ef40959a6f81e2350497a98f717f0052c16223d3446fded5896de914dfe177ace022
-
Filesize
12KB
MD550d45f83341c9d1f7f0c394a95b21527
SHA1bf2706cda3b888969f8d5582ca2c6a2923646c8a
SHA2567e1dafe68254dc357cc4ae19e1e5c6c4931677022d7ad6566e17557e02b7c1ed
SHA512c17105d8c1a9b25597541c998bde97206fecce031684966c1b29da71afc9bb05d567b6572b0fa9be186db6355fed6a811d3d1a844f9591b7e4810ce7b1b2ebc2
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD55bc6f2499528dd209dea1edef5883d3b
SHA19b6a51d492c90468637680b927ff0d1900f9f518
SHA256b598a9f2ea08e2a657b36ce114d15763c7c01004b2a28818334d1f22704f8818
SHA5127c4fbf13859a810962f4d30eb6ef59468767a87b0a637ce038b5ab2aa0c2d0035e4feacc30e8e87837952b32c820d2822ffc8b3234a34aa16b2b32414682b200
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e