Analysis
-
max time kernel
340s -
max time network
344s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-11-2023 19:42
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20231128-en
General
-
Target
sample.html
-
Size
876KB
-
MD5
b5e8bb22c22ac62ed1edbb861a607a19
-
SHA1
6dad8605496b38c06a4cf6365ee8ea12fafbe731
-
SHA256
4fdfc2ddcff86c23da74987ac3596de288e8d295606902abd541f8e1082d0662
-
SHA512
198225c152dbd3c962bd5b364daa1f4fa0a3c53aa56925cb8dcf3b2a04c42b6ebb5eb2a5e9eb5aea3d8aa21367264fcaef06e046d444257b2543966db04338e2
-
SSDEEP
6144:FBqNLZNLpNL4NLTNLmNLwNLHNLd1UHKXWc+6J6+yyI92bUF6vMeh+v9C6vVO/DKT:FsNlN9NMNnNqN0NbN5I3OUUv8zerPm3b
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Drops startup file 2 IoCs
Processes:
WannaCry.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC97D.tmp WannaCry.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC993.tmp WannaCry.EXE -
Executes dropped EXE 36 IoCs
Processes:
WannaCry.EXEtaskdl.exeWannaCry.EXEWannaCry.EXE@[email protected]@[email protected]taskhsvc.exeWannaCry.EXEtaskse.exe@[email protected]taskdl.exetaskdl.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exepid process 1496 WannaCry.EXE 4364 taskdl.exe 1664 WannaCry.EXE 1056 WannaCry.EXE 1140 @[email protected] 4564 @[email protected] 4560 taskhsvc.exe 2316 WannaCry.EXE 5012 taskse.exe 5084 @[email protected] 5060 taskdl.exe 4872 taskdl.exe 4592 taskse.exe 1176 @[email protected] 4872 taskdl.exe 4404 @[email protected] 944 taskse.exe 1344 taskse.exe 2972 @[email protected] 1644 taskdl.exe 928 taskse.exe 1636 @[email protected] 3256 taskdl.exe 2292 taskse.exe 4912 @[email protected] 3236 taskdl.exe 4300 taskse.exe 2112 @[email protected] 2792 taskdl.exe 1192 @[email protected] 3256 taskse.exe 1344 @[email protected] 2732 taskdl.exe 3628 taskse.exe 1332 @[email protected] 2428 taskdl.exe -
Loads dropped DLL 8 IoCs
Processes:
taskhsvc.exepid process 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exepid process 4872 icacls.exe 4540 icacls.exe 1444 icacls.exe 468 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfdxzssexrabcz467 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\"" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
WannaCry.EXE@[email protected]description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCry.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
Processes:
msedge.exechrome.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 31 IoCs
Processes:
msedge.exemsedge.exeOpenWith.exeOpenWith.exeMiniSearchHost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3484251756-2814966285-185304317-1000\{E9F21ED2-7A94-46EF-9395-3E0D3CFC26FF} msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 84003100000000007c57899d1300444f574e4c4f7e3100006c0009000400efbe7c57b95e7c578b9d2e00000067570200000001000000000000000000420000000000d73daa0044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000007c57869d1100557365727300640009000400efbec5522d607c57869d2e0000006c0500000000010000000000000000003a000000000083641d0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000007c57869d100041646d696e003c0009000400efbe7c57b95e7c57869d2e0000005f57020000000100000000000000000000000000000083641d01410064006d0069006e00000014000000 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell msedge.exe Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
chrome.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exetaskhsvc.exemsedge.exeAcroRd32.exepid process 1808 chrome.exe 1808 chrome.exe 1400 msedge.exe 1400 msedge.exe 4932 msedge.exe 4932 msedge.exe 1512 msedge.exe 1512 msedge.exe 3868 msedge.exe 3868 msedge.exe 1392 identity_helper.exe 1392 identity_helper.exe 4020 msedge.exe 4020 msedge.exe 4056 msedge.exe 4056 msedge.exe 2460 msedge.exe 2460 msedge.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 4560 taskhsvc.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 1932 msedge.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
@[email protected]OpenWith.exepid process 5084 @[email protected] 4008 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
Processes:
chrome.exemsedge.exemsedge.exepid process 1808 chrome.exe 1808 chrome.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exetaskse.exeWMIC.exevssvc.exetaskse.exedescription pid process Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeShutdownPrivilege 1808 chrome.exe Token: SeCreatePagefilePrivilege 1808 chrome.exe Token: SeTcbPrivilege 5012 taskse.exe Token: SeTcbPrivilege 5012 taskse.exe Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe Token: SeBackupPrivilege 4960 vssvc.exe Token: SeRestorePrivilege 4960 vssvc.exe Token: SeAuditPrivilege 4960 vssvc.exe Token: SeTcbPrivilege 4592 taskse.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exemsedge.exemsedge.exepid process 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1808 chrome.exe 1400 msedge.exe 1808 chrome.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe -
Suspicious use of SendNotifyMessage 36 IoCs
Processes:
chrome.exemsedge.exemsedge.exepid process 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1808 chrome.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe -
Suspicious use of SetWindowsHookEx 42 IoCs
Processes:
@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]MiniSearchHost.exe@[email protected]@[email protected]OpenWith.exe@[email protected]@[email protected]OpenWith.exeAcroRd32.exe@[email protected]pid process 1140 @[email protected] 1140 @[email protected] 4564 @[email protected] 4564 @[email protected] 5084 @[email protected] 5084 @[email protected] 1176 @[email protected] 4404 @[email protected] 2972 @[email protected] 1636 @[email protected] 2032 MiniSearchHost.exe 4912 @[email protected] 2112 @[email protected] 1596 OpenWith.exe 1192 @[email protected] 1344 @[email protected] 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 4008 OpenWith.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 3444 AcroRd32.exe 1332 @[email protected] -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exemsedge.exedescription pid process target process PID 1808 wrote to memory of 2300 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 2300 1808 chrome.exe chrome.exe PID 1400 wrote to memory of 2604 1400 msedge.exe msedge.exe PID 1400 wrote to memory of 2604 1400 msedge.exe msedge.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1612 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 4192 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 4192 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe PID 1808 wrote to memory of 1776 1808 chrome.exe chrome.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 5 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1004 attrib.exe 1572 attrib.exe 1112 attrib.exe 436 attrib.exe 2208 attrib.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xdc,0x104,0x108,0xe8,0x10c,0x7fff63ef9758,0x7fff63ef9768,0x7fff63ef97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1812,i,17700048637764364832,15065051441950666318,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1812,i,17700048637764364832,15065051441950666318,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1812,i,17700048637764364832,15065051441950666318,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1812,i,17700048637764364832,15065051441950666318,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1812,i,17700048637764364832,15065051441950666318,131072 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff63b83cb8,0x7fff63b83cc8,0x7fff63b83cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5885427031918674992,12720936194688085090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff63b83cb8,0x7fff63b83cc8,0x7fff63b83cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6340 /prefetch:82⤵
-
C:\Users\Admin\Downloads\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry.EXE"2⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 254311701200648.bat3⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE3⤵
- Views/modifies file attributes
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nfdxzssexrabcz467" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nfdxzssexrabcz467" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\Downloads\@[email protected]3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\taskse.exetaskse.exe C:\Users\Admin\Downloads\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exetaskse.exe C:\Users\Admin\Downloads\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\taskse.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry.EXE"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15207437845662773879,7270635946756831224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7108 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Users\Admin\Downloads\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\@[email protected]"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=15E38F3278FFDBB1234AC233E8373298 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F58B66405D4BE362C707781F8F017A3E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F58B66405D4BE362C707781F8F017A3E --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E3F9D8AE9C30C677CC08AA3016EE2F3 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=720D2B605A3340A56C96068DA543C648 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35DE9111568CD05FA00E24B073D174C0 --mojo-platform-channel-handle=2004 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9339E86594BE9168280F214B4345A3B8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9339E86594BE9168280F214B4345A3B8 --renderer-client-id=8 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]Filesize
585B
MD589c3b0929135f670fb350ca3c15c81cf
SHA189cf9c3e3131a5567f568ff5761d7f9135338320
SHA25626f5158332f323614e4cc96688ac3d081076bba462456dc4e4546572fcfe7407
SHA51266b626293ddcc4514dee7d4189bf0ec3d70c8ec63fb78b3d3e077c193120ce9dc3950bb8cce6df3220842d0bca4afd227263584c1a58cd5ef83b2f633c434541
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5ecd85460d4f6630b296979ab218a7aa5
SHA130eac792c892039ee59949e6a60c8733718c6405
SHA256179209f31203518751fdea62c6ce70310bd1128e6e3a67674247590cd27b4b50
SHA51266b1d0223fec3fc829cd925583446af9c9307dee5fe7e4ac765a6a2d6190f6756a6a941594f7fce7b656d03aeef1d4fbb225e16f12a47e0f63059523905a8231
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5086d8efc64093b52d43bdb3fceca285d
SHA1d8b405620a414de480cc9f56196c29e728bb2250
SHA25601a910bdd4f553ffc8df123c0c44d4e2ab9b6bef03f42072269e4d4398acb160
SHA5120104d62bdb94cea38901c68add59ae5e4cc0d2c4cb215fe23ff4427e5336bf3983f3379e9d14e849ac887c5c9f5c53254bb227c351ff3918954858b1e15536a1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
115KB
MD5beab90c7f2bbe241489e9f7fc4021f1c
SHA12a2b1c451a7d99dadaa4c8695c3389970b4fce82
SHA2567a3fc2ed9bcc8d50882267b87e09b079e4b187a4a93c419d336116ecbc90a562
SHA512c6f7f65123d1d14a7d03bb113294fdd363b236aacac0a97d07552010b159a4daba8fdf1a79865e8968244e44b70a4e3883e069500de3d1fb000d20893c0675b2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56b9543a1c167d24c0d4b0399a13a7e79
SHA16f58a92dc29ffc1b309ecb634fcef10030d096a5
SHA256115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e
SHA512ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52ff3173fc54a93964535b7a87f4b9aa4
SHA161bd3298a38e550011928acbc72181ebd7027121
SHA256da2da18239f92a534ee33a0aa5869575ed9cc5594905f03c54f1663ad21037f2
SHA512d25f64a404456a07c5ba869f6582c3297064a8905f123490c4aa3c8ed8f769a2347942c7b2564dbbb216ffd18896fde8355c33f381c7b3391a41f5fddc592365
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54ee43ae2ad5e06541907a2f8fc04472c
SHA1ce1a8eba69efd025d85e2f96beb611c58de27979
SHA25665859e769ac5e156bb0e35df49bfffda8650ef0f2ddb5d12a2fde73578aea8ad
SHA51234ea48a16ee682c8889db2a6c873aefd7cc77d7b21cd837bb783deae2c793ddf2a6e8c234c23cab028dbf9155bbd2bd8103a4d81ced4c8984673c1b83a2769db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56b9543a1c167d24c0d4b0399a13a7e79
SHA16f58a92dc29ffc1b309ecb634fcef10030d096a5
SHA256115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e
SHA512ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\168cd314-a07f-4c2c-ae12-656b5d9e82be.tmpFilesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0Filesize
44KB
MD5740f1c26c39128765b6332dc0e0161b4
SHA1a4a0565b3301773404f303007ac018c27c0d598c
SHA256796c80fbabcaf13361ba23755b7fe428d0c90dcb396ef47ee35be95f4ea2881b
SHA512c361ebfeea5316db4298e5642f8ae805f1b5a058f3888f93e393607a3665ce0dcf43ac3205d1d92c341b664d3d38dc9aafbf266a79bab57b1ea1e38eab4bec61
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1Filesize
264KB
MD5d66fb27b1ce4afc66a2ac8c591b2c5db
SHA1ad3edb1ffc0fd6df8128afde869381d59d4ce31a
SHA256022e1519f8f276c9f858f8a9d7f1c1d822fed2aa63e2448371060b726183958c
SHA512502bc68034ee4052b71ecd5384e4a0f716d854c0324bf0f96fc88f3220c86b179a65e2fa29401de6cc0bdb677c9aa10f1e04163876e961fe9753caa41e4f06e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD51e7aa733e89717b5ca86d5b917f5660c
SHA18d6376cc9e1cd4c708987abdf41d2c1fb2688bdf
SHA256c62c1a0c48c764dfcd9d6551d930bb2bfc06c059efedd5c64d590739714653b8
SHA512b095ea5b953199f16412bc21ca429bc5e6274b046df8f7622c8274121cf34a2e30c0a698214718764de9d68d732f099478276755fa57ec42a8323dd9df1644f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider CacheFilesize
6B
MD5a9851aa4c3c8af2d1bd8834201b2ba51
SHA1fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA256e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
SHA51241a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOGFilesize
331B
MD5ab8a477558bcbdd246a7962ce70d5f33
SHA18360fd4ac5d6392323555f3843b306bd199f3c2c
SHA256880730dcea370a08b0f2e3bd955c40bfcd8ddad0c5284e663e74f4325913ddf2
SHA512960f55e79be99034d7a5656ec69dc91fae601deada87dc8901c07b97c3f7756ba1e48059a29350cf9dc89906b7f97f7272cbf4398f13088748f9f886855a1360
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
865B
MD5c5a48d5f8ecbe87ab1c4eaaf7a36835b
SHA1af85fe21fa1c090607a7612a2ac916a36da1a9f7
SHA256b3d496cded5f9f2f84340eeb25e771781a93280a6bd07020f7008bbc9e94debd
SHA512dd95dd95763dcace9a1215fa51c6c521548ef4a4910bfdadec534355835236244785fe13bac1ef420706b8b369747a332db8c53d1cbea874d82c35b3b08a1db8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5effb18228fe80d1767d5bfe8edc3dd74
SHA1b6d4eccfeaa134423145a565ee1ff65ec41ea1e6
SHA25676bd5b765fbdcf6f3bcfb39e8551ef050459bc7b4300f12856c682abb774e563
SHA5126814116bdfe2ba82191249622a8812fa9731179f0a73fdd2ceb4eb1042f10bd1461732a544a3a1e8182114a137aacf84e4eb60a30221592ea93306b88b66d209
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD554fa5f588ec005fd3b1803e175711347
SHA1157454a964b5b7140e11408e06238f7ade38a3f7
SHA256f682488af62f6aa13c20c5e67303a863ac548592ae5a6c28348b2029519a10bd
SHA51284d8dd56220c2b1f7b60c2a5a64f7c8a9ad182d247e493aab8bfafc5d70f53135946a605af08cfe91c52d69258829b4b574ebf693bd5a81e4f1a3a802a0ca6f3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58f457a002e1a91ece7629ff487daeb46
SHA18bff389817f9eb5ae0236a9b9953c6f94b7e1443
SHA2560fc10b6e6c246750496bdbeaf084efc4ebbdb3c991f7f39ec49e620c3621fced
SHA51274c6490c0649d33a7157ffff1078814ebae9ad8911e4fe1c8a5b8766f96ea348ea81797855d6da6136824c231bb7a6e06b69fbe5e9ab88afe560e6d5eb3155ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f208c92b1babd9f2d872de788b3680c7
SHA1a77214d53212c72a94088256dc20ced44f7d5a95
SHA256ba0cad427a65aea4d975ee5c5ae84b7e1f5a76a04d3d0ed17cbea609b6be016e
SHA512729d78d40aa5ebafc7e1accbb95fbe154fe16365a77056b52a6c3eeb81ce8a58ad3a94495d547650a0bb5c5c2058aad267549d4c078c6497e9ed66d1904aad36
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5add0984704853a4b8b9f236a1f0442f9
SHA19ea680e8bf94772495c588f4807e425bb18ba91f
SHA256cd84918e9337ea3e0a17e814260adec325b3792520fcfe32a8fcf1359dd65736
SHA5126aa1f8f21c875b843e3bbb1bb14e0fd0648b2d9b79c5ca25f34ca3ec50862e8d68b950e6a7cda0409a32e18b266d0910e5bec198f257f3fac706f84eef6f2477
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5add0984704853a4b8b9f236a1f0442f9
SHA19ea680e8bf94772495c588f4807e425bb18ba91f
SHA256cd84918e9337ea3e0a17e814260adec325b3792520fcfe32a8fcf1359dd65736
SHA5126aa1f8f21c875b843e3bbb1bb14e0fd0648b2d9b79c5ca25f34ca3ec50862e8d68b950e6a7cda0409a32e18b266d0910e5bec198f257f3fac706f84eef6f2477
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f37fae392eb4aad1e5820d4eebe823f6
SHA1904c11535fdf1df57f6e7592cada1bd96bab4361
SHA25681b74bccf8671fb5bb4751afb54324f51d1cd44c28fd2b489ed2a229aa47f1a4
SHA5125ec482355d5ad491f3479ff3a5eff6ad2f2ca3a64fa565f2e2c0c8bb4f86905fba55426aac8d716cbc7149f324294dee18770b0331e79d5ae689ea6c9d50cc22
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD522cea2ad8515b028cb1ce733911db8a2
SHA16efbe149f26c16a45d550beeaf596fab62877b4e
SHA256c542075f43ba974ba953a4f134aeed38566fd8c1f21b85e1c31c7cf299cda4a0
SHA512f145ffda647aad3b9c4083a2571c9eeac1657a0c5a68bdb6a5aa0de166a6650399e56605aa9e24da0aed57114bb0c3845d073d617681541d9e078824651f2136
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD522cea2ad8515b028cb1ce733911db8a2
SHA16efbe149f26c16a45d550beeaf596fab62877b4e
SHA256c542075f43ba974ba953a4f134aeed38566fd8c1f21b85e1c31c7cf299cda4a0
SHA512f145ffda647aad3b9c4083a2571c9eeac1657a0c5a68bdb6a5aa0de166a6650399e56605aa9e24da0aed57114bb0c3845d073d617681541d9e078824651f2136
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOGFilesize
319B
MD5434c9f1e43507eb8a201c65bcc038282
SHA1dfce2e6747a67ec4aeee38ed6048cdb0ddd2f853
SHA256db3c95b3b20160270e94f7b2b0f22507a9579ee9ed3afddf680be47f5638d344
SHA5122369397327b192ee19819ee2846708c7f568266f4cfea54a7b715fe6dfe3e2d3ca665ff64a0b876b902899803e06fa8775b83ec7ab391fb427d8d7b60d9ad5da
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13345674184607534Filesize
1KB
MD59b16f1702f04ae39e3420d9eb858001d
SHA13453e8a1e97b4d6808a3cb0278b0f977d492ec17
SHA256c226b75a4ade0be8a9a624804e46c71e2cae8d79fca29a3aa499183480d633c7
SHA5126c13c870283ec4db2111da2f67a168bfd136c1362c36277d0dc2b33f84a7eb63695e6dbcba0a602d5f5e175dd4dd5d9db0a658115e222efed224836fe121195f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13345674185026534Filesize
1KB
MD528cfd33075896d8e10e6d802e4fac949
SHA1321777d5a9fd9664afe71e538aeab078684f90e2
SHA256df22e1949dbbaa3936d1e5e7743016f197f223a49848ca5f4a3f27e3e3276af3
SHA512ae33d7db6750c940601a1bbf1ba9eb946bc3c7ca02c039223154469f2f3165d38d043ceae5ea2d3fbe6b54dcafde240a97482c743b4baf41d622319993e5e5fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOGFilesize
347B
MD5ebdb5e5b65700166a28c3782cb5c9149
SHA186197d8f8b732fd53ff1111ef8335a2209efac85
SHA256a024f61c6dd888e917758e2aae89cd26f7adbd0707df74106e6a1bb1e533c31c
SHA512d20018a9ccedfe13a3ea8d876cb0ca43116a263689c68c05f7a4cdc60f150be59f64495204ca53743ade98632a081059605ca3dcbf5dce8f2fa23595217e4a69
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOGFilesize
323B
MD53c2410d761cf922f99c2241328b2abfa
SHA11b1a014b46c256224b874fa93f0fc23052c53d0d
SHA2562b5b7e0eb7da4998903dff3cfad0f90888658be37bdf3c7adf46b2d877f5e482
SHA5127353f319979d076c82cb9a63c21d2f3259e6d762fa10fbb0252536d9c9bdca156453dfcad6201deceafc056c86ce79773b4d891070961ff4bdd83032abde1d55
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5abad8bc776adf6765c8203bb2f34acf5
SHA1b367b0324ec8ed4e54e4f9685290238f724b06fe
SHA256e64c8c2bc8469837e7e615883e88db0f6dc47cd66dc112d1ccc0cbcc12a70f1c
SHA512e4ce427e8bdbbc9a6576841273443e3e753573bafc1c587819a2dbac7d7fde44045bc6f0dc4c6d5d50ce0b5f0f01b847faafedbcb7982589fa4648ff93a4f598
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD534f4163264a91aca346c964faf7d3f2d
SHA1b4cd21fb4ab85fd6223c3b8d9c9d35e596152224
SHA256e03f4fc8371e7a920c90cdf6d10fbe0062e65578424c8ad4cd1f3d866ac49afb
SHA5127b45d45d4971ae38d9013efea1595f8354a69dcb1113351fc18b03c382d9b99d29319a0a3c90573e0ce3b9430d97787b5cdb9dfcdad91f86effea8b8c1028d24
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589cc8.TMPFilesize
1KB
MD5421b461b03b8d8d4686c2b1265964d71
SHA1360b42d9c8963020f1f7cc040822f7e8464279a7
SHA2560a74be1b5f17fb5c19f3ade2dee1e3ef5e67567e49c35173e2766fc095c7b166
SHA51202b2fd4a325be97a69783bd4a0320781d00719eabfda4f31307cc6775483b93c8c9197d0f15d9f9300a44d29e5c02a116c6c529274574471fa5e3fc221fd4a10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.dbFilesize
44KB
MD54d5ba7a0506c6aadd5747ec0bbf066ef
SHA181b13c1fc96a174fe73dbad2452c55821d9f95b6
SHA256a8c9c3f53b264a87a02a965af4cc6c440137c8a6f034f8fd530325caed34a5a2
SHA5124d385ebbcc9a9ede1755cb5962f2b5ea39d8155a8e045a9bdd2ce85d9077ebdba3421411e43de7e3bcfd643c052ec0701b4bebbd0c2c83dafbd8a83261e82f80
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOGFilesize
319B
MD5a2099f614191fe296b3cecf60372c306
SHA17a64104827b0dd65f70fd1685090a878e37ce0c8
SHA25635f1fc58b1cea117510d8137c0ade9766ada76dcbb9bcddc53a539acdd08c9d3
SHA5120d469e8d48e2aac24c9d887a580ddcaef48c4a51a59f0f8828d65e8a6c97299dc0f9a049f45714107ee0172a6efbaa17ee34816019d708dba51b5e59e9e83799
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOGFilesize
337B
MD5bd38002c7e33ace706fff7efae10f419
SHA1a603163c77ecfac4001df0dea1c986650145bcce
SHA25695a2399a5e6a804bcf26e04004efeb6be6d61e4f8e712e466ce32b406ab1e849
SHA512d5eb6bdd39f1a1bcb9c137b39a6be433306d72291d3295c426e4b50bd43fb32fdeec07e5797354614c24a45ec1838a7845f3e44d34f823d485282d2ecf8ef478
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0Filesize
44KB
MD54a3d95d35f0c997faa01e23ba571aa46
SHA1c67d95aee1839aa7c298973518059a10c16b9183
SHA256e575fa2b0d8badfa38c7f529c5b83af95dac9f070b8bb35bee78ac2d7d7f1c52
SHA512a581b39139cfe704cf23ec59b8620d4403ca13bf689bef63b8b66b6152fb342551b41ae1a17a61208b6b054ead23be1012ed2becfc5202a1da952120665463bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1Filesize
264KB
MD515337a13f9b7f76675a73d1fffce0df1
SHA19e253c5b9ba7a79ec19d5331fbe0f81cfc54a718
SHA256fb3e5889a3ac5fa993858c37fae1c4c201f57386fab56a810b7385b107aa9b70
SHA512a1bf2bae4f85f7bbe4d3190ab132d3a6789b164777275b1f737eae5e314838b617a9538319265e15e14af9b1d2f6bda17c8a12410de140a9d3152c48d4f94f87
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3Filesize
4.0MB
MD55c12f1399da5d391933d2955de0d276d
SHA1516b514ba629cf32de41d7c479aa36ed882a638e
SHA25658eb9086615e2bcf055b4236cdf24708d75a9c25cbbe6fb6f08870086b8de2b6
SHA5125360226a875df923727e12d7ef3a7a8a287d0eb91a28629c29b2227ee54bbafecc61f5edda78ddf718d3853cbdf636efa0203f55023532d5d1651ba26b43d39e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5b29bcf9cd0e55f93000b4bb265a9810b
SHA1e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA256f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
SHA512e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c4326623dcad97c87eca8fe484c87eab
SHA1b3505fd96b360813dbc4f313f0958098b2924eb9
SHA2567065c7d22701811f677d5968cad6d148e8eea6db90f346195b2b9b9893427d54
SHA5129df19baf91b8ce9c1781241170826c1f803866708c2f0f326e63f856f1f850a5cb46045b47788544eb0a1133bd96388c1a1e5d8cf3a6b998d32bfb4afb7e2fc9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD566dcd41b7a4c8037aa6e993c96d81a10
SHA1e337bbeffd302b632b73c8a7f5df310f592713cc
SHA256e76a62ffb94f54f049c2f8ce84095f9ea39dccc525ac192ea2a12c992776a459
SHA5122a1ef220878b9be0bca829173ffd305ea3d1466a2c72f36ae8075262100d3ed77c4966e1f7d096152b9f1d2d1ede804101d8233dae040c00e6e6f90020c0989a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c4326623dcad97c87eca8fe484c87eab
SHA1b3505fd96b360813dbc4f313f0958098b2924eb9
SHA2567065c7d22701811f677d5968cad6d148e8eea6db90f346195b2b9b9893427d54
SHA5129df19baf91b8ce9c1781241170826c1f803866708c2f0f326e63f856f1f850a5cb46045b47788544eb0a1133bd96388c1a1e5d8cf3a6b998d32bfb4afb7e2fc9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5261cfee54313d75c64ed38d57ddab609
SHA108e8e4cf32e3672cef77b5a123346e648e5f4a14
SHA2566a13626c37ed67cf0b79084d1d85541a4477a6875a973a5ebcc6e5aaa691e984
SHA512911b87cceeb9232df445187f63b7bb33045386d0c15575518cc9578c0871da215ae898fde5ece5ca0c04b65fbfab2df5e240392c1e780b35c352ab7d0446c115
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txtFilesize
4B
MD500a5182b4fba5252b72cbe52ae70a754
SHA1ddb06f946f6f18df673e0dbc9e4833e9d39a1c92
SHA256ffd33f2cca130db5c3cb2c4f33535d38365b530de55505d3330294ca639a3450
SHA512aba81b6e39b7c11cd82bed5d2f58cde6763b68daf176bc1dd4a0cd7cc9bcb912877bf7314224ea9b8313c548911c157cb51cbb486fb87106d51aa6d22ccde32d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb0a270c-4d6e-4489-beaf-9e023f40b614.tmpFilesize
11KB
MD54a9b624dd27077b6514793dfab656e78
SHA14031f4db5c2a6dc960a3c8f140ae2ffd64d8e606
SHA256ae35ba691d6efdee286ca2ff7427df79c096211cfbd43c2722b9700dd94f933c
SHA5124bc051e4fc3b817649dee8d6e53e03321062b8bf41f163cd7507f0a89781e3cf50574d775ce6b7398964aaa381aa2abff6feb6e6d1896f654529cfd0d93616d2
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD5fe6a3b39038f7211e2f24f931c5b600e
SHA18d7cf96c3e8a7d3c0c098962351cfd8ed6c394f8
SHA2566434366d993de7598e5d28d81e92e82b83176d9c860bea6e47820e1abd479553
SHA512d76734e4f7d8b46e4433005286a3fd55b6f7430d31efdd2546f568b34263ac808721e69a816a88dc1c5079a2dfdc4d2c36dc77ec3cc638283e112aa831ff9b5c
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD55da743026a9c47e88f0c8b8beb12ac9e
SHA145e1cd6893686283a220815846e1e44fb098d5fa
SHA2562dbe1697948df50862fbd2932402ddb124d4697ce1ddd50ad380d97e5b7ced7a
SHA51237de52ecd5e8a45864ba9135b4754cba4d4b3ffc24bbcb6cf80e6ebf0fdd1beaad6a89b05abdfa9d1f079ca3eedbb0eb58cdc5832aef6da95de927914b9fbf7a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txtFilesize
846KB
MD5766f5efd9efca73b6dfd0fb3d648639f
SHA171928a29c3affb9715d92542ef4cf3472e7931fe
SHA2569111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
SHA5121d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
-
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.newFilesize
20.3MB
MD5b91e32019934c35e0cf618520cc22217
SHA1506a586ef4f02c5ec10cdf8ff1f9b8013479c130
SHA25667a80d8c2376067ac7cd55a64ab9ed58527c9cba42546f27ad78d10462df1c78
SHA512a31e734156f0fbbdc47a95e0df39fc49a94a86e3de35cc4fb3e46ddcf27880c669d2530ec83efc441af00f914e14731d5b1334bb0b1bd9b7a5f3aba7f384407e
-
C:\Users\Admin\Downloads\@[email protected]Filesize
933B
MD5f97d2e6f8d820dbd3b66f21137de4f09
SHA1596799b75b5d60aa9cd45646f68e9c0bd06df252
SHA2560e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
SHA512efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0
-
C:\Users\Admin\Downloads\@[email protected]Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Downloads\TaskData\Tor\tor.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\Downloads\WannaCry.EXEFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\Downloads\WannaCry.EXEFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\Downloads\WannaCry.EXEFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\Downloads\b.wnryFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
C:\Users\Admin\Downloads\c.wnryFilesize
780B
MD5383a85eab6ecda319bfddd82416fc6c2
SHA12a9324e1d02c3e41582bf5370043d8afeb02ba6f
SHA256079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
SHA512c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252
-
C:\Users\Admin\Downloads\c.wnryFilesize
780B
MD5383a85eab6ecda319bfddd82416fc6c2
SHA12a9324e1d02c3e41582bf5370043d8afeb02ba6f
SHA256079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
SHA512c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252
-
C:\Users\Admin\Downloads\msg\m_bulgarian.wnryFilesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnryFilesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnryFilesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
C:\Users\Admin\Downloads\msg\m_filipino.wnryFilesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
C:\Users\Admin\Downloads\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\Downloads\t.wnryFilesize
64KB
MD55dcaac857e695a65f5c3ef1441a73a8f
SHA17b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA25697ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA51206eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2
-
C:\Users\Public\Desktop\@[email protected]Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
\??\pipe\LOCAL\crashpad_1400_JUZHRFGHSPVMLBELMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_1512_OZMDWLWNPATLYAKIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1808_BDRZWCRSRMIYXRMOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1496-653-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/4560-2213-0x0000000074240000-0x00000000742B7000-memory.dmpFilesize
476KB
-
memory/4560-2298-0x0000000074020000-0x000000007423C000-memory.dmpFilesize
2.1MB
-
memory/4560-2212-0x00000000742C0000-0x00000000742E2000-memory.dmpFilesize
136KB
-
memory/4560-2211-0x00000000742F0000-0x0000000074372000-memory.dmpFilesize
520KB
-
memory/4560-2214-0x0000000074020000-0x000000007423C000-memory.dmpFilesize
2.1MB
-
memory/4560-2209-0x0000000074410000-0x000000007442C000-memory.dmpFilesize
112KB
-
memory/4560-2231-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2237-0x0000000074020000-0x000000007423C000-memory.dmpFilesize
2.1MB
-
memory/4560-2239-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2240-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2292-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2210-0x0000000074380000-0x0000000074402000-memory.dmpFilesize
520KB
-
memory/4560-2302-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2311-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2327-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2208-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2184-0x00000000742C0000-0x00000000742E2000-memory.dmpFilesize
136KB
-
memory/4560-2187-0x0000000000310000-0x000000000060E000-memory.dmpFilesize
3.0MB
-
memory/4560-2181-0x00000000742F0000-0x0000000074372000-memory.dmpFilesize
520KB
-
memory/4560-2178-0x0000000074020000-0x000000007423C000-memory.dmpFilesize
2.1MB
-
memory/4560-2169-0x0000000074380000-0x0000000074402000-memory.dmpFilesize
520KB