Overview
overview
10Static
static
10samples (2) (2).zip
windows7-x64
1samples (2) (2).zip
windows10-2004-x64
1083e147374...08.exe
windows7-x64
8083e147374...08.exe
windows10-2004-x64
812437a49d2...3d.exe
windows7-x64
712437a49d2...3d.exe
windows10-2004-x64
71945c44901...7e.exe
windows7-x64
91945c44901...7e.exe
windows10-2004-x64
102040fa2a3c...d4.exe
windows7-x64
12040fa2a3c...d4.exe
windows10-2004-x64
12b5109e9a2...d9.exe
windows7-x64
102b5109e9a2...d9.exe
windows10-2004-x64
103538750cfe...5f.exe
windows7-x64
103538750cfe...5f.exe
windows10-2004-x64
105d96952d47...5f.exe
windows7-x64
105d96952d47...5f.exe
windows10-2004-x64
1063fb410fc5...22.exe
windows7-x64
763fb410fc5...22.exe
windows10-2004-x64
767beeb7a19...08.exe
windows7-x64
367beeb7a19...08.exe
windows10-2004-x64
16e5678ebd4...71.exe
windows7-x64
36e5678ebd4...71.exe
windows10-2004-x64
371506a3322...fb.exe
windows7-x64
1071506a3322...fb.exe
windows10-2004-x64
10734b9974ec...6d.exe
windows7-x64
10734b9974ec...6d.exe
windows10-2004-x64
1081a27b3dcf...40.exe
windows7-x64
981a27b3dcf...40.exe
windows10-2004-x64
10a1bd0fa8ad...46.exe
windows7-x64
10a1bd0fa8ad...46.exe
windows10-2004-x64
10a465bc0871...e3.exe
windows7-x64
6a465bc0871...e3.exe
windows10-2004-x64
6Analysis
-
max time kernel
12s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (2).zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
samples (2) (2).zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win10v2004-20231215-en
General
-
Target
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
-
Size
426KB
-
MD5
11db0fc2064d7c858067b99b413e357b
-
SHA1
dbfe691315009c224e3b826dfb89ac7d910a7f08
-
SHA256
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d
-
SHA512
120153a24b079eda7a55f97b31a7827f34ee8e6a69593180f0588ebc38efcee6c7a90131af366f9c0ce55288247bf4b6ab5fd9541ed365370f1f42c279ab93d8
-
SSDEEP
12288:qntVoEco+qy0h6/id8Mq560WjLM7Ti/L6tdEyvIG9ij8e:mVdcvr0hCoV8OjvUdEyvItjd
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
pid process 4872 4872 4872 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exedescription pid process target process PID 4872 set thread context of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 set thread context of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1040 2112 WerFault.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 4928 2112 WerFault.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exepid process 2112 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 2112 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exedescription pid process Token: SeDebugPrivilege 2112 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exedescription pid process target process PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 4872 wrote to memory of 2544 4872 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe PID 2544 wrote to memory of 2112 2544 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"C:\Users\Admin\AppData\Local\Temp\12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 6284⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\HOW_TO_RESTORE_YOUR_DATA.html4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14933831008037075014,11276756147825854798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:25⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 16444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 21121⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2bcb46f8,0x7ffe2bcb4708,0x7ffe2bcb47181⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2112 -ip 21121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2112-36-0x0000000005550000-0x0000000005AF4000-memory.dmpFilesize
5.6MB
-
memory/2112-19-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-38-0x0000000005CA0000-0x0000000005CB0000-memory.dmpFilesize
64KB
-
memory/2112-25-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-29-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-33-0x0000000077843000-0x0000000077844000-memory.dmpFilesize
4KB
-
memory/2112-31-0x0000000077842000-0x0000000077843000-memory.dmpFilesize
4KB
-
memory/2112-28-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-34-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2112-37-0x0000000002FB0000-0x0000000003042000-memory.dmpFilesize
584KB
-
memory/2112-1155-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2112-1118-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-35-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2112-39-0x00000000030A0000-0x00000000030AA000-memory.dmpFilesize
40KB
-
memory/2112-27-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-26-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-23-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-978-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2112-40-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2544-17-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/2544-15-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/4872-11-0x00000000022C0000-0x00000000022CC000-memory.dmpFilesize
48KB