Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2024 09:36

General

  • Target

    94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233.exe

  • Size

    2.4MB

  • MD5

    dfed4e36537ae0dcc15fd7ecf432e074

  • SHA1

    da095b411cb6c6e49cc04eda43a839e0141da075

  • SHA256

    94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233

  • SHA512

    66bba0e6b9b09ff9beb3e5dee9b7bcf4252e083b2bd7b3041953551cafc45922f6f38afc8afdb8e46fb679643e1ca06894a503ce296e4cfc2094497e77e1cb4c

  • SSDEEP

    49152:ZOng5rnpYo9282VV9Mg/WihJvjwbE9o/NYswY8hwjVpPmynUz61ryRwf:B5rnP9AX9Mg/WkJ01Zqgv3H1ryRs

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 4 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233.exe
    "C:\Users\Admin\AppData\Local\Temp\94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IQ4uA69.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IQ4uA69.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2BI8713.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2BI8713.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb69b246f8,0x7ffb69b24708,0x7ffb69b24718
            5⤵
              PID:4860
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4762672433130441146,3440371064840751098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
              5⤵
                PID:4024
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,4762672433130441146,3440371064840751098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2716
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://facebook.com/login
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2304
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x100,0x170,0x7ffb69b246f8,0x7ffb69b24708,0x7ffb69b24718
                5⤵
                  PID:2220
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12570695859624056937,18141450656685451231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                  5⤵
                    PID:4028
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12570695859624056937,18141450656685451231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4128
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                  4⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1512
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69b246f8,0x7ffb69b24708,0x7ffb69b24718
                    5⤵
                      PID:3428
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                      5⤵
                        PID:4036
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3236
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
                        5⤵
                          PID:3780
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                          5⤵
                            PID:2752
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                            5⤵
                              PID:1596
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
                              5⤵
                                PID:376
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
                                5⤵
                                  PID:1296
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                                  5⤵
                                    PID:2924
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
                                    5⤵
                                      PID:5356
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
                                      5⤵
                                        PID:5364
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
                                        5⤵
                                          PID:5772
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                          5⤵
                                            PID:5780
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
                                            5⤵
                                              PID:5960
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5976
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5464 /prefetch:8
                                              5⤵
                                                PID:5348
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,2300323769885504132,6952828148470343543,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3932 /prefetch:2
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1940
                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5zg3Oh1.exe
                                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5zg3Oh1.exe
                                            3⤵
                                            • Modifies Windows Defender Real-time Protection settings
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Windows security modification
                                            • Accesses Microsoft Outlook profiles
                                            • Adds Run key to start application
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            • outlook_office_path
                                            • outlook_win_path
                                            PID:5104
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell" Get-MpPreference -verbose
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2992
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                              4⤵
                                                PID:5788
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                  5⤵
                                                  • Creates scheduled task(s)
                                                  PID:5164
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                4⤵
                                                  PID:6052
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                    5⤵
                                                    • Creates scheduled task(s)
                                                    PID:4948
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 3040
                                                  4⤵
                                                  • Program crash
                                                  PID:5656
                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6BN2It1.exe
                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6BN2It1.exe
                                              2⤵
                                              • Executes dropped EXE
                                              PID:4960
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1028
                                                3⤵
                                                • Program crash
                                                PID:3876
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:5092
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:4992
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5104 -ip 5104
                                                1⤵
                                                  PID:5788
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4960 -ip 4960
                                                  1⤵
                                                    PID:3512
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5704

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      b810b01c5f47e2b44bbdd46d6b9571de

                                                      SHA1

                                                      8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                      SHA256

                                                      d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                      SHA512

                                                      6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      efc9c7501d0a6db520763baad1e05ce8

                                                      SHA1

                                                      60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                      SHA256

                                                      7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                      SHA512

                                                      bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      2c2500956b2d6d9a9edd46f14274b651

                                                      SHA1

                                                      ea4b4f9695224877fb6072330c0886edd9d19bd9

                                                      SHA256

                                                      91346d997e6ddd1e0f343c82781e5d87f7374f01eef2933f121568622436a29e

                                                      SHA512

                                                      6df7433b1089da21e3f0f93b3b1fd3d1f5842edea60af5eab9de78e4234ae0c54f7b171cb18679bd5e7c5f1db7c4ffe176872b439961ee97b8eb5519ff101a62

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      c57584dfd30ae70f0ae3687260a52bc7

                                                      SHA1

                                                      d1c2cab2e5c3c13ea6e85c22170b5f108ab2436f

                                                      SHA256

                                                      ded013d95793e140c73a1b03f630fd829604d47ab984c451398bdbea7a31b23a

                                                      SHA512

                                                      34fb8693a5d158a9787d5481e3ad3628f4e906e2c3dbcb5562fe7b03997e20062aed32c69d6c7082d27669cc7111f0b26d5a6ad443fe94bad13a2eb16a4477f3

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3da97816329170211aa89feba4cccd51

                                                      SHA1

                                                      6fa4512714035830d18857308b3ef9accc0a9c35

                                                      SHA256

                                                      15568f7d33da8223e582d673655051661f725b4b727f93bd276c97a3dd0816fa

                                                      SHA512

                                                      abe9972257c14f7e8c36b90eade11dac5caa00516d6a2f617ad6c462dc1160133e972ab4e9cd60fdb8c00f4c10cf623f386471ec4a3e63bba991d86f7a43513e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                      Filesize

                                                      124KB

                                                      MD5

                                                      56c5b7dfd01fa7e000f751baba2c4894

                                                      SHA1

                                                      65237440b08e0288d006e6f9a89ee92151c8b06f

                                                      SHA256

                                                      fe3d4efbb5f83d6069946d0468e47189f70a704c13886423e8f57be2a309030b

                                                      SHA512

                                                      6b2a52b309d6746fd6d44011bcdee375bb8e0e810149c8fefd02c669d537723763c069575be61c8f6bc57f8cd81e563cac2c8309e4217321fd4f7f26ac9bcdd7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      111B

                                                      MD5

                                                      285252a2f6327d41eab203dc2f402c67

                                                      SHA1

                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                      SHA256

                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                      SHA512

                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      d96e742df78c7bac6dcdf9c0d3d3683d

                                                      SHA1

                                                      1303e724ce7ba759b2ac025b05e6881e7593ea0d

                                                      SHA256

                                                      0ce1dfc1884f23b889447c86d6bc446d2efbcfe66ef0f73532739a75ed859e6a

                                                      SHA512

                                                      7d4f8bb7b4c9d26d55cfe9ff133419633f921097315940a6ea641a0f3533b943edaef5ee51146e373d494122b9d60a9e3a42d3d6d80dd7954c870dddbc0011b1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      9cc5fe76aeace39824939cb5ed753543

                                                      SHA1

                                                      61513047152f7d144659e10395555bd038b338cf

                                                      SHA256

                                                      ab3d73f81d599d8671c71431168194284ad88f7be6af09af751a09d0b6a4609c

                                                      SHA512

                                                      91924953f72681e0405eaf855e270c0b144672d8311e6ce98f7aa16e5f5519c61b44da6d28c20d768b665dca4bf137ad90ff06e7ce57018ba36fbf88de75d1f3

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      1853387cb8943910ed0b14f53b44a952

                                                      SHA1

                                                      70e97683eb1d067b53c78ef7c9312326edb89129

                                                      SHA256

                                                      9019d43839db57e3d8b4973b23e1b8fb8cf065b8fa2e409084dd0fb3a596fee5

                                                      SHA512

                                                      c8029108fbeaa1b174f2d09ffd38fbc3603538dae7932a74a145f3c65a76a332e5cb83b245b99d427425a7fdfb7de747df3bca57b3b3d34313adf005732ec14e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      360db063d6fd4a542fe21dc00779e20a

                                                      SHA1

                                                      76261ca6955164acee82918378a3d7264a2b2cee

                                                      SHA256

                                                      33ea5e8f9a48e48a9ac19c37edbdf39c3c967e9e19aa2304afc7a6a74aa6f645

                                                      SHA512

                                                      d332cb2b5555304ead318e4ee21d0b02e9f4cb13ba5a2fe22f2e52cac66981f73282a5bfc6f6bd55c015ad9515aeb203a0e2e6b9945796b38cfa947e9a2bf603

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      6283cc9e13992efd43c6c9812357d62e

                                                      SHA1

                                                      8168553d6e31449b04cc59a4775a74771519fcc9

                                                      SHA256

                                                      d38424fbb700ed1e3297ceac43adc98ee00bb02299a096c1c7eb0f7ca2233640

                                                      SHA512

                                                      221ed9671f4dcebc1d314d6d4caddb9f3dc31b80336e2119a0b7c7e6f1eb2c6bf079889fefd1146ca70a165921dfb16f4414abf32b221fe7fdefd6a2f8d29516

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      121510c1483c9de9fdb590c20526ec0a

                                                      SHA1

                                                      96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                      SHA256

                                                      cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                      SHA512

                                                      b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                      Filesize

                                                      89B

                                                      MD5

                                                      1c31e2aced5c37f52a9ebc827af375d9

                                                      SHA1

                                                      809cb7ad014eebbea8897d81e62d753ad253f122

                                                      SHA256

                                                      d0c7472f17347886d726864170ab536ad4d0d47e45153a82a1095c2479f5aa65

                                                      SHA512

                                                      f8e38ef68c4c4a36f5c2145a8467ba2dda0642aa57e48c33a77e8c4813721c6e45b31f6daa3b195df421ddff04aa863198d23ede4f61b1e18fe2effc643ba840

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                      Filesize

                                                      146B

                                                      MD5

                                                      43240c95a11b0977d4e9c3209ec026dc

                                                      SHA1

                                                      c7dc8520ef63edab5501f598e7aef7a3870290c2

                                                      SHA256

                                                      cf754d9804d08e388cf9056cd5977b86869659780641287e960af904143c43e3

                                                      SHA512

                                                      c63ef0c68dfd1de35dd1accb3094fa531b67df7e54fd1377d361330711ba2feedd615c029992169d8f9c8acbe7427d1b0ab5ce110f3c336c0e02dd545de68160

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                      Filesize

                                                      82B

                                                      MD5

                                                      ec6ccb99a32f38a14fe1ffab38f0b6fe

                                                      SHA1

                                                      a54414dd8a62a226636a389ffb787ac0815c2db2

                                                      SHA256

                                                      1bac606cce8968a3537bc94790008ebce7fad0e77d886bbf2443fa04bdb98e9a

                                                      SHA512

                                                      534800165d82420794d6753dad85059af60ee3577978f760ff740b5cd37851076c37114cab8eb6e16261e76d07f4334f89e3f60995b1856ea4d373eeff522e35

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      46295cac801e5d4857d09837238a6394

                                                      SHA1

                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                      SHA256

                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                      SHA512

                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                      Filesize

                                                      72B

                                                      MD5

                                                      4fff1a707491422c0e35dd5d04b26132

                                                      SHA1

                                                      422eb99931dd98dc9979df5bff0db237a0e0e08b

                                                      SHA256

                                                      790a0df89f8d9b0fcdf04e89616bf2dbd10f25bd71ddd1a789665a42bf07928b

                                                      SHA512

                                                      e112ba6762b6b429e2104defddd7545e230cb4bace4981764f79cb593cf9ce5b61fe96214f831495c0aa91288a3d4daf356fdd428a2dd3056719722474a7f4b6

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591459.TMP

                                                      Filesize

                                                      48B

                                                      MD5

                                                      abd9de02524bb0150c83e35d45c750b3

                                                      SHA1

                                                      caec94e4a7363e22cc954532dc31645bf46a8045

                                                      SHA256

                                                      643eb81d97bcb99a99af6a6d0def4658acc8cf30cdb61bc6e7679711fc6631e6

                                                      SHA512

                                                      02c5f9a7c3924d0e217a78faf38b87e4f5fb20fcc4105d5a4d5a0fbd2f735989044b48a85de34e37f817fd11c5c1d7d967f83dcbfddbff94b245546f48e6f13c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      67edd8e860f9f31cffa5b2cb7f1350b6

                                                      SHA1

                                                      8e0378d51863cb17fe09c030f5441d0533008872

                                                      SHA256

                                                      2e46387f4c67fd2022eb3f041cea0fe19bde0837a234072eb02fdc7bcb332b4d

                                                      SHA512

                                                      aee2dbae1b6782d179cbb4230198f4df3dbd940d7f31a7d7d4925e24ac3d87e31328335eae507fb4d0b6997759e84ddd086d1e6a21d37e953c2de24400d826f3

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      d23c96cd3845a83ea32d9d7b36007650

                                                      SHA1

                                                      67b22d1d23f88744d00631e982d392d41c0060a0

                                                      SHA256

                                                      5910daed53592f012a5b2ca19b122bacd26c391b555a3cfd410a63b499cc1c4e

                                                      SHA512

                                                      5b05770bb1495d57994e6c9d6718b967d2e43a028c98dfe32041f8a06f2d8157c0872da1c8110da6e686bfc3db2d2f8677476f1755521b42d60de58966d50dce

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      d7e5b907167ef3d11ba2a6dfb8f68388

                                                      SHA1

                                                      f65212c8ae021d0425548288e15f478be2f52fc0

                                                      SHA256

                                                      cb244024f46687c29195fc0389fd40ed1c8fcdc490fecb995d5f4b2f201c9b31

                                                      SHA512

                                                      f46ed3e2055071d37a9aa6d7e378c1dce1ca7b837ce0cf15ded8939692dc42bbacf436768170dc67db2ba0ae2ba4193c9a7f7c06419563dd51e9d45be4cd9b51

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6ef82ede8b35a0cd1bb32be2bfab9f34

                                                      SHA1

                                                      ad909d1c34d75e05cc78a82405b914fd0ea02378

                                                      SHA256

                                                      c9757c3f8d187171bfbb1b8d71d1b80db116a49e3264eb9ba7f50e294b94ebad

                                                      SHA512

                                                      3dc7148d01c59d5800ec33647c7530bddff8bac1f4b7bb7243b05c34fc6e398ca890ea39490b65149fbff6f1f6265c475fa306ff12d68d8e6d9babf0a99f0fff

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      e00e942708b45e34aa45c394cc4fea48

                                                      SHA1

                                                      1b22f041af53b5ea5d510eb5c1693d1a1c8a535d

                                                      SHA256

                                                      f36738757421adea128038602a3b9249361b5f872af486078551c006b5f84588

                                                      SHA512

                                                      674c8d29a05f1e9efe1c2a895b368ef4921bad441d55b1c09c53786a82ef04a62dd9cf01af239626ef4dc1dcb4d1443b7e1b2300fd83c531665dcb03a24f0ce8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588a59.TMP

                                                      Filesize

                                                      874B

                                                      MD5

                                                      dae855042fa00687f25ad37351081e94

                                                      SHA1

                                                      da38c3f9b569edc1bbf8f3d3bb548af3c25cd494

                                                      SHA256

                                                      ef10a1064a61d49fc6984365a477266a315fff03811eeb2824b1d66d73846bd3

                                                      SHA512

                                                      3710d217ef640b109dd11fd15c2cf7fb8ff84d88c40debb33344147cd40aff15a4736843d06b739c98bcf348311de61eac72dc05d0d6a54ecdd4ae4d68ae4c16

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      065bd1622eeba214a8c1af7978bcca0c

                                                      SHA1

                                                      3274fc2d8230b8f31d09f8705ce959e1cf2fc227

                                                      SHA256

                                                      6622d96657ab1d18eb1b81072775f4f99a4411ce4ba2dbfeb2bfc66ea2be69ea

                                                      SHA512

                                                      5f12bdca694e5b06bd4caa60577aea0d227722c2e743b085fa1fd155efb412e3542ef71347e210b3113fcdb36169f465e53e1bf9e57730d871e8d09953082f73

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      71afb203c8bc39c477016e22040e2c76

                                                      SHA1

                                                      f12022aa913b6ba236d8520fe2b1cdc964512364

                                                      SHA256

                                                      da429783ce2dda3a0d82254bb5b279606aaa1e87f2e3d4cfcd92cd56e56a0582

                                                      SHA512

                                                      8459fe1f4fdeb4a24b86ccd8f48029d9a4c54a7e23972850ee7da54a2512ba81d840953d273cb2ca57a5996f65c51269d8021ae2e220b84965955960fc2c914c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      3859b4788ac99c99f437d5f23e3bf11f

                                                      SHA1

                                                      079b6f40b103cbbe8ee36472f956e979acf7b459

                                                      SHA256

                                                      317193e168fec9963deb821bda234ec2beb74c33954ed13a298d8acbc20efd37

                                                      SHA512

                                                      b85a1ac330eb92b982c0025de8bf8e84446d271908e850701c0fd4d4f1523e5abbfe36c1beb37a5c3c5b07e8fe7773dcbf48926fc4ef89e1f21d63f1e147523e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      b353d1649158fe5358f4ef2ee670dcaa

                                                      SHA1

                                                      29c81c1c10e2d15a5b966d2139472797ddd6153a

                                                      SHA256

                                                      8926636ee762380b3f85a09ae52fabf9c6b7ce277251c544093774c5b2a8a350

                                                      SHA512

                                                      0d2dc655392c7d7eac090a55ea8c860f5e5020bb773fd3f9f2b5978b9a7d82b8d859bf6d9ea405072aa1ce2883a6f8902a131a473c9eb8332d70050a34f115fb

                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6BN2It1.exe

                                                      Filesize

                                                      448KB

                                                      MD5

                                                      700a9938d0fcff91df12cbefe7435c88

                                                      SHA1

                                                      f1f661f00b19007a5355a982677761e5cf14a2c4

                                                      SHA256

                                                      946583a0803167de24c7c0d768fe49546108e43500a1c2c838e7e0560addc818

                                                      SHA512

                                                      7fa6b52d10bcfc56ac4a43eda11ae107347ba302cc5a29c446b2d4a3f93425db486ed24a496a8acd87d98d9cfb8cad6505eb0d8d5d509bc323427b6931c8fff8

                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IQ4uA69.exe

                                                      Filesize

                                                      1.9MB

                                                      MD5

                                                      67100e5762fa443510a6888de508ee90

                                                      SHA1

                                                      2cc60c3e6ca35c48561b4409fb1f780c9902954a

                                                      SHA256

                                                      b3caa6ebdc7bdf74ce503115575e45b50d5a88468cc8eaff0ef0acd3136c8f73

                                                      SHA512

                                                      8015a71fa002cb01fde78902a67c798cf764aa81ddc9ec98ac8e67f5fff44dedc008bebb163bc10fe4b9a744b5c8f3927e984e1cfff4db349fb02d805fd60215

                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2BI8713.exe

                                                      Filesize

                                                      894KB

                                                      MD5

                                                      779db1fcaa2b01c67fa62fdcf541137c

                                                      SHA1

                                                      85aa8928790bc40c8dcfac0585e87526d285905b

                                                      SHA256

                                                      0b343aceb8665dabb2f978310bc369bcac837bc19c7422d059fd485d50bb2c42

                                                      SHA512

                                                      b657c28f2159a283214b8ad103492f467e79bbd6465385bde9f15e5c3712433e7d77bf08b5637c2d4dcd7c2fa85fe4704ce0cf4096af4097861762fe10f5a00f

                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5zg3Oh1.exe

                                                      Filesize

                                                      1.5MB

                                                      MD5

                                                      5029a0767b3bb36cd7105e83778330ea

                                                      SHA1

                                                      83d56d1f28cf29b87e26917bf17b70edeef7724a

                                                      SHA256

                                                      d7dd9ecebcbb7f231089d5f387682120d46a895b652f5a9c6ee663b1922fa8b4

                                                      SHA512

                                                      c2872608b20a7b53414573c30317f1c0bca3ab4e69dd47b21900b63e7b2691c65278d03504314ff4043a33eed5bfe36cff8be13b771a5115bb6aac1691e837ed

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ygxqudpj.kl2.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVS9NxFFmPzsDnE\8mHALaahkOKvWeb Data

                                                      Filesize

                                                      116KB

                                                      MD5

                                                      f70aa3fa04f0536280f872ad17973c3d

                                                      SHA1

                                                      50a7b889329a92de1b272d0ecf5fce87395d3123

                                                      SHA256

                                                      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                      SHA512

                                                      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVS9NxFFmPzsDnE\OCAorIPNrPZlWeb Data

                                                      Filesize

                                                      92KB

                                                      MD5

                                                      ec564f686dd52169ab5b8535e03bb579

                                                      SHA1

                                                      08563d6c547475d11edae5fd437f76007889275a

                                                      SHA256

                                                      43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                      SHA512

                                                      aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVS9NxFFmPzsDnE\sqlite3.dll

                                                      Filesize

                                                      791KB

                                                      MD5

                                                      0fe0a178f711b623a8897e4b0bb040d1

                                                      SHA1

                                                      01ea412aeab3d331f825d93d7ee1f5fa6d3c46e6

                                                      SHA256

                                                      0c7cd52abdb6eb3e556d81caac398a127495e4a251ef600e6505a81385a1982d

                                                      SHA512

                                                      6c53c489c4464b9dc9a5dd31c48bb4afa65f7d6df9cc71e705cea2074ebd5e249cad4894eac6f6b308b3574633bc6e1706dfc5fda5f46c27f1e37d21e65fbc54

                                                    • \??\pipe\LOCAL\crashpad_1512_JABBXOTWONIWHUQS

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/2992-215-0x000000007F810000-0x000000007F820000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/2992-233-0x0000000007640000-0x000000000764A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                    • memory/2992-204-0x0000000002A60000-0x0000000002A70000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/2992-128-0x00000000029C0000-0x00000000029F6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/2992-244-0x0000000007830000-0x0000000007844000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/2992-249-0x0000000007920000-0x000000000793A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/2992-250-0x0000000007910000-0x0000000007918000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2992-255-0x0000000073FE0000-0x0000000074790000-memory.dmp

                                                      Filesize

                                                      7.7MB

                                                    • memory/2992-129-0x0000000073FE0000-0x0000000074790000-memory.dmp

                                                      Filesize

                                                      7.7MB

                                                    • memory/2992-234-0x0000000007850000-0x00000000078E6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/2992-130-0x0000000002A60000-0x0000000002A70000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/2992-131-0x0000000002A60000-0x0000000002A70000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/2992-135-0x0000000005480000-0x0000000005AA8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/2992-235-0x00000000077F0000-0x0000000007801000-memory.dmp

                                                      Filesize

                                                      68KB

                                                    • memory/2992-232-0x00000000075D0000-0x00000000075EA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/2992-178-0x0000000006300000-0x000000000634C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/2992-217-0x0000000070670000-0x00000000706BC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/2992-216-0x0000000007280000-0x00000000072B2000-memory.dmp

                                                      Filesize

                                                      200KB

                                                    • memory/2992-228-0x00000000072C0000-0x0000000007363000-memory.dmp

                                                      Filesize

                                                      652KB

                                                    • memory/2992-152-0x0000000005300000-0x0000000005322000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2992-231-0x0000000007C10000-0x000000000828A000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/2992-239-0x0000000007820000-0x000000000782E000-memory.dmp

                                                      Filesize

                                                      56KB

                                                    • memory/2992-227-0x0000000006860000-0x000000000687E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/2992-173-0x00000000062C0000-0x00000000062DE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/2992-153-0x0000000005B20000-0x0000000005B86000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2992-170-0x0000000005CB0000-0x0000000006004000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/2992-154-0x0000000005C40000-0x0000000005CA6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4960-490-0x0000000000DB0000-0x0000000000E2C000-memory.dmp

                                                      Filesize

                                                      496KB

                                                    • memory/4960-483-0x0000000000DB0000-0x0000000000E2C000-memory.dmp

                                                      Filesize

                                                      496KB

                                                    • memory/4960-488-0x0000000000400000-0x0000000000892000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/4960-489-0x0000000000400000-0x0000000000892000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/4960-482-0x0000000000BB0000-0x0000000000CB0000-memory.dmp

                                                      Filesize

                                                      1024KB

                                                    • memory/5104-465-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-430-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-308-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-307-0x000000000A930000-0x000000000AC84000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/5104-304-0x000000000A140000-0x000000000A15E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/5104-283-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-185-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-113-0x00000000089C0000-0x0000000008A36000-memory.dmp

                                                      Filesize

                                                      472KB

                                                    • memory/5104-89-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-236-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB

                                                    • memory/5104-17-0x00000000007A0000-0x0000000000BFE000-memory.dmp

                                                      Filesize

                                                      4.4MB