crimsonrat | f32fd9c137672a426d418f52069fc716ecbb5d32fdb2954c1771a8d90435ff31

Analysis

max time kernel
554s
max time network
555s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
15-02-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

google chrome.vbs
Size

70B
MD5

a8f9c450316c75f40e9f809fb65baca5
SHA1

e4a9a0ceeb77653f64469442ede3e7426762d25e
SHA256

f32fd9c137672a426d418f52069fc716ecbb5d32fdb2954c1771a8d90435ff31
SHA512

fc050c7b5e2e76763912e65781987023839be8e8e096bf5ce61614357ab6196cad8b57809e201e73c1666ee2f66ce36ecbf3a096825947d865bfc24819ccdde9

Score

10^/10

crimsonrat dharma persistence ransomware rat spyware stealer

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Hdlharas\dlrarhsiva.exe	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (536) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Deletes itself 1 IoCs

Processes:

CoronaVirus.exe

pid process

4532 CoronaVirus.exe

pid	process
4532	CoronaVirus.exe

Drops startup file 5 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe

Executes dropped EXE 11 IoCs

Processes:

ChilledWindows.exeCoronaVirus.exemsedge.exemsedge.exemsedge.exeCrimsonRAT.exedlrarhsiva.exemsedge.exemsedge.exemsedge.exeCookieClickerHack.exe

pid	process
2396	ChilledWindows.exe
4532	CoronaVirus.exe
10380	msedge.exe
12372	msedge.exe
14664	msedge.exe
28472	CrimsonRAT.exe
11308	dlrarhsiva.exe
16428	msedge.exe
39028	msedge.exe
14684	msedge.exe
14808	CookieClickerHack.exe

Loads dropped DLL 6 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid process

10380 msedge.exe
12372 msedge.exe
14664 msedge.exe
16428 msedge.exe
39028 msedge.exe
14684 msedge.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
10380	msedge.exe
12372	msedge.exe
14664	msedge.exe
16428	msedge.exe
39028	msedge.exe
14684	msedge.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3404610768-3912631216-307532709-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3404610768-3912631216-307532709-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ChilledWindows.exe

description	ioc	process
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

2 raw.githubusercontent.com
3 raw.githubusercontent.com
45 raw.githubusercontent.com
Drops file in System32 directory 2 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe
File created C:\Windows\System32\Info.hta CoronaVirus.exe

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com
45	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\meBoot.min.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\ui-strings.js.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClientSideProviders.resources.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.scale-125_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpStoreLogo.scale-200_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\resources.pri	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\sl.pak	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-32_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-lightunplated_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-process-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_initiator.gif.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-process-l1-1-0.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-40_altform-lightunplated_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-400_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\de.pak	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\STRTEDGE.ELM	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\iw_get.svg.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SnipSketchSplashScreen.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\ui-strings.js.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\ReachFramework.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\adal.dll	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\LensSDK\Assets\EnsoUI\id_arrow.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-150.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Link.js	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-30.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\getVendorSettings.js	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1CACH.LEX	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png.id-A323A10C.[coronavirus@qq.com].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js	CoronaVirus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

17748 vssadmin.exe
8200 vssadmin.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe

pid	process
17748	vssadmin.exe
8200	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

Processes:

msedge.exeChilledWindows.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3404610768-3912631216-307532709-1000\{B776533F-18B8-4716-B6F8-095CEE78DD00}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3404610768-3912631216-307532709-1000\{638C320B-9EEA-42D2-8182-10136A7019FE}	ChilledWindows.exe

NTFS ADS 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 97758.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 981690.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 435046.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 903244.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exeCoronaVirus.exe

pid	process
1272	chrome.exe
1272	chrome.exe
4632	msedge.exe
4632	msedge.exe
3232	msedge.exe
3232	msedge.exe
4368	msedge.exe
4368	msedge.exe
1964	identity_helper.exe
1964	identity_helper.exe
2024	msedge.exe
2024	msedge.exe
1912	msedge.exe
1912	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
3000	msedge.exe
3000	msedge.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

Processes:

chrome.exemsedge.exe

pid	process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

chrome.exeChilledWindows.exeAUDIODG.EXEvssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	2396	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2396	ChilledWindows.exe
Token: 33	944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	944	AUDIODG.EXE
Token: SeShutdownPrivilege	2396	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2396	ChilledWindows.exe
Token: SeShutdownPrivilege	2396	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2396	ChilledWindows.exe
Token: SeBackupPrivilege	9232	vssvc.exe
Token: SeRestorePrivilege	9232	vssvc.exe
Token: SeAuditPrivilege	9232	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsedge.exeChilledWindows.exe

pid	process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
2396	ChilledWindows.exe

Suspicious use of SendNotifyMessage 36 IoCs

Processes:

chrome.exemsedge.exe

pid	process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exechrome.exe

description	pid	process	target process
PID 916 wrote to memory of 1272	916	WScript.exe	chrome.exe
PID 916 wrote to memory of 1272	916	WScript.exe	chrome.exe
PID 1272 wrote to memory of 2484	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 2484	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3740	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 2096	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 2096	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe
PID 1272 wrote to memory of 3788	1272	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\google chrome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd731f9758,0x7ffd731f9768,0x7ffd731f9778
3⤵
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:2
3⤵
PID:3740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:8
3⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:1
3⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:1
3⤵
PID:3244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:8
3⤵
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4524 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:1
3⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:8
3⤵
PID:348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:8
3⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:8
3⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5104 --field-trial-handle=1836,i,2736897723684193565,16614696012782659295,131072 /prefetch:1
3⤵
PID:2140

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd6ea03cb8,0x7ffd6ea03cc8,0x7ffd6ea03cd8
2⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
2⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
2⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5360 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3412 /prefetch:8
2⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Users\Admin\Downloads\ChilledWindows.exe
"C:\Users\Admin\Downloads\ChilledWindows.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6096 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
2⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
2⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:2152

C:\Windows\system32\mode.com
mode con cp select=1251
4⤵
PID:14920

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:17748

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:8832

C:\Windows\system32\mode.com
mode con cp select=1251
4⤵
PID:8852

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:8200

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
3⤵
PID:7236

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
3⤵
PID:9020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:10380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1376 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:12372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:14664

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
2⤵
- Executes dropped EXE
PID:28472

C:\ProgramData\Hdlharas\dlrarhsiva.exe
"C:\ProgramData\Hdlharas\dlrarhsiva.exe"
3⤵
- Executes dropped EXE
PID:11308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:16428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4892 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:39028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,7981994497311068992,15624121478025255712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:14684

C:\Users\Admin\Downloads\CookieClickerHack.exe
"C:\Users\Admin\Downloads\CookieClickerHack.exe"
2⤵
- Executes dropped EXE
PID:14808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:9232

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:13492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:6928

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e121999693bb4188bd084097469dccff /t 7500 /p 7236
1⤵
PID:12948

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\00d7a44733104baba468428006f63693 /t 8940 /p 9020
1⤵
PID:15408

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:25816

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll.id-A323A10C.[coronavirus@qq.com].ncov
Filesize
2.5MB

MD5
4c4b8a7d04690cae854702e0ff167e38

SHA1
c95b31b7141622015364778b32a2215bb815e048

SHA256
6b2cb20206aead47bec9665167c659000396599fc356d051adbacef4583f1d25

SHA512
1e6a73959180d580ee7651d7cd19a9185f356ad84098a5916f49078b69acc6217579821d1a15755f61d99838d82ee561c0ecf2b34f013991556b9250095bee35

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe
Filesize
3.5MB

MD5
a3ad4238b95bfb73498ff2928777a7d3

SHA1
e2d2d0c8aff3c08825402187a5b60538d29026b6

SHA256
61eeaa2c6161d68aecdaef7978782eaaa56cdc21054efe471fa175857eeeb896

SHA512
95ba448f68a3c87623be3a79b290c96cf7a2e61f84a4dc328b5a21752b547a7a53e68d42f9038fa1259f50f47e5d7a8b039269493f689ac0f729f33cedbbf780

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip
Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
e1820780834a6206976a0f370df1cf8f

SHA1
c03530ba9626819c01b5593a3311d72166f4e468

SHA256
96721a53524780a94b6d0b72a3bfa94fa9e2b708b078740a0286d83ad7fe7704

SHA512
2176219092e526973e1795d99fd544ebd8330da6eecc04ce194750cbbb6f4433557a67f3b33df57cf73584c7dae7dad6b91463e384e59096af25c0aa1edf86f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
1cbc73a792485e757303d144a59b37d9

SHA1
198d16a9d6e4b5c85f55782e23c160d867231871

SHA256
5d515ca69d35044cd791c96c4cb496299840da50a08f9c8e645b26215aa16729

SHA512
93fbae90601c7591f6f507b07bea8b39c544af13dea943586b5efb0d28747daf22c09f814342d4f838e24608575a28f00db144cf7fdcf9b5ac7aff75471e9ad9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
00627ad35286ec2c3fa12803d74178bb

SHA1
dc717058daff4978e628d69942374c859c1a6680

SHA256
31d571cc3090c5b771f21dd58aab031110f3936be876c9673ffa043aa95983b4

SHA512
e87ca41173d224c2a7a1ece1d9e26917020cad36ee597708574d49acdd6fec40434978135dc60a8c197f695a25fcddf87b9390924bd403c1f9af467977eb78ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
e027f3285ee670ebdf78eea85265c111

SHA1
41ec20c560419316b434517df43f8f602822188f

SHA256
f67f8a44ddc219f3916ee1b80203b58d53e013c2cb49405d1b3d1948685e535d

SHA512
475c442483cd23755c2bbb0a738c1c9edad836791976189d8505fcfda6e7e940dd505ea5e6157805c50031ff05e5d4495c4d25eeb5c1be23d662f4ae29252311

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
39d276cf077e22a408524c62c2ee1fc1

SHA1
ae94f225f7cb5bc9ce96d6c1ca577a91ba53fef2

SHA256
60318d8b8b6c2b2b6ead4b40c0c5a20dfde18ab36e27a07f76e4f724ca15706a

SHA512
9b90704442c13f73a3acfa69c3859e7a2807ad177511863841c23f85b2050d39e7fd656b487fb30bcea105b01cc754ca01c9248f5d309207a2679284e5ee56d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f5adea1bacc8a0d0eb8bdbc77e9866d7

SHA1
bc0c9c51f1e12d481ff37765dd4c97d984bc2213

SHA256
47453bd2ebd38e0a111d0fe7bbe9aee553e160196b801ddbdc001a4287f41a46

SHA512
aa7cdbdc636dec35dd63cc8949b8ef694a7cb0bec9b8a83a11c1f25805e2428c2e4d296c5ff4f993f35e179cac57c0b20acbfea9e41822b45c0881adc2b7ecd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
f862f10b3955cb733e23a81dc0e20f73

SHA1
96adb3ced314de15fe3b4016c5f795da28eac3ce

SHA256
7a3d880838a4cfb1ab05d6c6035e15f866a52f3afec7283075c3be3e3af20c5a

SHA512
3d1a3cb2fc4b69b3e4a32871df29438139c72158b1b0094ed7bd1cce53fed15e6041628a78496c1508f71256420a37bde1b6cdf6ddc6ba6d0d495e757856ed24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
255KB

MD5
0d75625690dfde434c6c5f1d2ddf1145

SHA1
ac1254b1a1c27dc16e7a31b14c3c58b98d33748c

SHA256
19adb77aca0722632bd67be917401edd2df3a42d992e170a6372beeca6e36eb2

SHA512
b5edbe07e94b8a7ad083744273ca697412c4370d6e9d72e1200cbbe8bbbb75e8b6bc58a6b9412eae6a0d0dc82a2776c2b16bb89f050c2c64d604c48ffae918ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
255KB

MD5
b9e299698ba0767cae07be778663e301

SHA1
5315dcb931d0f8962b60458f2ffab427e53e81ca

SHA256
416a3080fc79e4389114077359d7400c26e1f954a505c254400796c75fd3f805

SHA512
a7f9294263c1a092a80a2183b6513acfb93182ff5a5558ec9238fbc99b5bf637ca4b07731778b9362419700f1f9ad8530311387e0296726234016ede01fe921e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4aa37444d26e81e6f3837eb15bcaa892

SHA1
3d00127097989429f311f33daa8380ad7af4cb56

SHA256
ab703e5dfb5b92527f094fad6ec479839375907700be9a2fd1c3cb9105f9e655

SHA512
f21a34c234433a688602b2b56d6844f224641bea45b8585f77f4853e192107a65c5e104e10cd86c1d97ff41a22fd05d65224993803b22113ed0b517e686c5176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d8e4396-51f9-44c8-9c7d-fefb42114b13.tmp
Filesize
6KB

MD5
b6e99ff5eb6faa5fbaee069b218bca95

SHA1
ec466eeb2af9af96c643c72f6690c47161796255

SHA256
0029e3fddbfc59a5a163c8cf6bb355f199bb14d5b1ba61c3eb6a4fcb786c57fa

SHA512
5b312229bb73ec533324071f72ad4d3d9ece1b15d7ff33bf8fce18014ac2ca737ca117c9fc5d3aca7f511fd8e21e73981a25aab91da15ff5611d2a0865b377e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
5257fc484ebce2e992ba50a22326a008

SHA1
0034ba2233afce35a948453aeda71082e4475786

SHA256
38105bb71590ad12eb0fb212475a9ed5e4316b9c676f6122ffb17b12563d40d4

SHA512
89c3c35d7dd27efcfedef886d50e02fed2064933158f583a77d6d3a60f661a33bb2cff890fa2522d4fc4eb4132ea443800cb806461ddbb9a2a7e53438a20d152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
90c61021d967caacf680f3aff48bc1be

SHA1
184d22f8ebbfb2a8e6f4616bc2032af1eb9da7b3

SHA256
62ce9f89dd46bb669ef262ad8518044f3ca80f60dec7a81c7a273b7267c93325

SHA512
efabe139c962f2b2f4d6a79b579d55ea2314727d72d813f85a97ea8f7be82e842799332f901c7499729105237f1517d20a68b1aef046819db350d8c02486b28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
661ce50ca178055723d55168524a2fbb

SHA1
db9ab175294012241dd5b23ae8813e6b4a64b048

SHA256
acf275ee94b8e2995cb87fdac05d6524609105ce1ddee32a3e884402ca159cba

SHA512
4a951820e5bb6b09d4d06909b99dd132d51d269817b85b377b471448a2d7500d0c8385511e5439e7cb0f0b2f1582f9046603e661fc9b8a085e184f9c75c4fa79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
936B

MD5
55a4b3b48782638c12b00fb3a72812e4

SHA1
521a8216c3f3e93783dd037e85745d6c3ffa1222

SHA256
d22e5d26b7e4ec1f9a50af981c750c147a099ff232e092e9397b8bd6b65fa200

SHA512
e2f49f7ba1cc9ed806dbd944c265e35d6a06172d560af842d5068f8af927c056edfbae35f876a1b877abf8b5bec9dad47921f1bff3c031837a2fb8121b96acd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1f3ab33a5cbd8045f0198535a6fe920a

SHA1
cde0dd178c90770ff4518ba23f994beca8757cc1

SHA256
15bd3ef3113396834e77206782ed50362c0cef2ee202147df352f6ec584799fd

SHA512
d1d8c769b66b594bfc04aa8a6ac420d874ad26b94fa6c4b101d1f4683b86401bb51eb4c09f779f710f5512b18c8172fa7f8420bdc9c0dc4091fee1778ac72249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0525cc0e1721ca8d544e72b54c95bd7c

SHA1
4c2e546fec4341a561373718084a309ea73bae5b

SHA256
a08bfbcd6d1e7522b50b6af2218957db9011de24f45a53a28b55b02ace0eda03

SHA512
17780c1fa9ed9d8fae445e69f4b0ea78bb4b94d32271f9d8df1121d18084dc259037800d838091a027f61be2fb9a20a7bdefe2da366e9f944bb1d22728d95563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
35916ea22422df6347a86904313f0d43

SHA1
1dbfb4bea63a8c5357991235b532f7ead4ce9593

SHA256
a7e69e68cf3128d71b2e9c1d9e676d07928ff07e5cc71656bc7c527acbb317af

SHA512
090bd71f15a1e41891d41585ce99d4a13bbc6aaf823e927ad465ccc2700fedaa7a2d5fd5098adc2b70fb895a025c4dad9a23886eb39cf27a0fe408df3bd513f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
22a8c8e770e49910604a085091413a39

SHA1
3bc7475bd24dba5329cae4a0239da087b4f39d09

SHA256
a9141c41401f91c53a611197515901ccfb4547fec08e7b04d7fc473f8c9add12

SHA512
a3ce7633a495fdf2230f497e09ceb2c8b83d8db5112067a3e3333c9c99e2fda89e2595f1e870bd91def2339fb2200f117aa7901896831cd171e68b7b3110610a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fa8935fd30bfe623ce82672a1fbcfe7e

SHA1
af804ce20b5457e389ae01163315032bcd321c2f

SHA256
9dcee4524d285188ebf105127c5e3dcb0655a20d35165ba0f8c38a43d2264ca9

SHA512
16cd59982e5bd071fd72ea40002de7f8e4d5db1b4cad3f1a5e6953b24c5884f034f844a3c60c713c01de67636ecb31159a18792a2de7d8ad3a38a662522bdbaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
314ff8865ebdecc8861ed516d5381bc5

SHA1
ae102e0b1273e7483b2e4170c34069218991de13

SHA256
b51ca75c792b9a7a4912ee6de757a7eb75c6a6adc4eb552be82bb3310a51443e

SHA512
713b47e65c4a5a0f8694879bbf0258c2f7bbbbb84b2fce027d6e0110742e764e072055c306f406e65fa9424b2a2e587d266a5e815f9b1d2033cce6e2849cd39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2caee5480d88a744ab7edd6cf4bd5266

SHA1
13949aa72f8483541d50289ce2bc5c373c380c01

SHA256
07da635a9854e64217618998758fb0be6d8f99afff73995e12fb5df265c61af9

SHA512
ebce805815c590dfc8433a7dab35393cc6bcdcf202b54e60debca2756357c89dc4dc91b979187d36fa7f6dd5d93004018d8a6492acd04af73b04e22eae0a3bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9c99de57952e071f5ef2026729f6a8af

SHA1
3f7f0f511c0126e2735b7026fd7b9694ef46b6b7

SHA256
77fbd319ebaa765a103d00ae8e2b0637586cd7fdac255f421d4ef46ffb1f42f3

SHA512
637bf8d405fc1d89c66841f8cf7551a958722d704bc3c75611e1a451a7f138f8c09b8a4083c7104092122982d5272c0fa2bd2fbf861a3158fcbad8ae7bf9f2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f492761321b7cadc657901655c01811a

SHA1
c031cdaf421a82d88c252ea5f85b68dca56a27c2

SHA256
0192b52a630c649cf3fa33e2fbb77bc852f28d64a77dc3b5eee9c1ea504d4794

SHA512
b266cc73203696ce7e138e9a92c6e1277fae142ff58142514a28fbc2d15fe895943890479ffd1e8940debce824bfbb5930d470de80ea298f19602e346b8f20e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
ed5095edc8a7e8f3370ff4dad884b9ab

SHA1
bf2d9c578651eec574dfafa60320cdbf336d99bc

SHA256
1e017844b7b692aeb779f1160a528ce12e42ea3302061c2e82fffb434670fe27

SHA512
61c5a2037f44cf7037b63df2d0fde77d25ccb9789d2dd571220824ad2bac1bad3a739cfa840f57a90a75e2c71ae500176a9e0a483cfeeb9270b4147cfd1ab74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
227322556c8e5ca984ee197dc6470424

SHA1
b6b5d774a8e0d84c423c4b52a094cb854c7df9ed

SHA256
35337295ac16e01d7d578f195f00ee85a877099ac1586a3668bd17c9179bc61f

SHA512
cb260b701ef20562133d97186aa6615e0f9ecc8d6ba9931c37a94173488bab916530cb113eba0df1c07eb753b93eab61b6c355dab26ec258b8627f92a013b3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
0b0c8e2c55ef8c5442396b424db109ca

SHA1
de7e8bc7681d03891d687960ef0270458bf79e37

SHA256
3e1f4a08ad4bc85b65e9da07a392f673dc06b7dc5014e784cd8252c30380b8d0

SHA512
d112444be94d9a1fd39b003d6c35dc9d80e82f7795d4f145af96737d577272c6792768d71bd132930f0ef661fde05820b9aac9fc1e73b994a199ed8adf69c0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7535128417004a08a7ef20e57ca28308

SHA1
1e9eadec2d2507fc5ef9ba511239b9ed4bc4cfd5

SHA256
01e4f5a07cf3be1abc2dd8d0eb9f192bbceb88ebffbf7f08099ec404c136bc22

SHA512
c62e26fa2d0b16489affe5b2f4a5423332067ccac5469cc9c1b924f8316d624ff8ab5216cbb102776ef26f785506989083a5cd24f1dc4240584ce053a61b8d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
249548d40b6e0bb2fa41f66d43118842

SHA1
6fa3f823ed88a15961aa7493363c57cd2cdf9759

SHA256
ad0690e08ba86d5b39342247fc7530dab65e146f6e0f3d6c6271f6a996b471d1

SHA512
3eb1c3a933b032b9e971e167e10d18851afd02a5d3a63210b595331d2ce2cd1e90d997e60773254b661ecad47725833dc7e001a82bb76c7fb9c2321936950b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5d1511.TMP
Filesize
6KB

MD5
06cb6b3c1031a352d9580fc4a0eb0234

SHA1
ce1de70d05f81051ac99d8514d998af34fcc5a8f

SHA256
25724a87bf8a268c5c13cb49ff654a1cda393c5890fc5c3ad28ae10c55a117de

SHA512
405f4a577c35d548a0f9dd6c8df1e3ddb327303d94bb7bc2903c9d0e55a906af74c453ae96d19bb61005bda6dee7634f3ee348b07aba026b4a5f27685f6d1aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
25KB

MD5
40833cdbd5d7994ce8fa41b927a81b3c

SHA1
7d0113a707e380a6c12a7581af0184b6e49ba481

SHA256
857a656a5e259b4671d5778cf4c93bf038e060b195cb7e9fb3d9c5bf25c8f2f7

SHA512
38d77bf562e1abeffd91ada2832a160d29509ed748751f43de43c5846c9fffab53884fe31b19ee7336c36557d726b9ff17dcdda0f311d8f04407e44748f2f4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
8459a0442a01729ded24f1e929fd3534

SHA1
e2636b3e715bb0de468f38715ad83700fb2a4961

SHA256
672bec4267ae2687fd5c5e15067a633624f296e0278b849f23dbcf944a7f597f

SHA512
b61992d1f9cb8224645e1de09cf8cf3be964ce09cc0c5fc601600487da0349ede96061d8efd5501f4fa1dcb1f7e9e2cb6a37c544322f3e5b2345dcc7237ad345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
66b4ed4a79f2219aa40da7976c34e0a6

SHA1
0b7c5b3f03edaff3f2d6ce8736364a6c4b0c3dcb

SHA256
46cf93ab649d83d90ef6b087c26f7576db756dcfca3d4151dacd395e02a3bb0d

SHA512
7d94e0bc6a7a7bd1d16262a415d4c77db38c17ddceb0f3c0cf0ab0c29d4f621c1a889ae9fc4c1c3b0cb4b89cd8210017c92f8b4dddf3909be8cc04dd98d3757e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
509786f4725b074b3395287685d4fb33

SHA1
79c653bbb0ffab7032cab5493490815714065e7b

SHA256
f4f2c26285c81f51cd1f60c658eb2ad05fb2ce3dfba402abb4729964d896218d

SHA512
da6e02ad88e6916db743ab2fdc1645eef4823f947eec6e43886c9b687cd20dadd5fb89d1f8a42e9b551c259365e02e65635959c26ceff8c6a144d0e5a1ac1633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
058c92aaf72264a0cb025ab9f0a24fe7

SHA1
f2dcce27fcba4fd2210fd1ec2d9489ba32eca54a

SHA256
907b76a68c50a220e2180a25bf8da0d4eb42ba821ff8345dc0ee3eaabeccabe9

SHA512
c7903e1f2ac31b30bfd4683c7fd41acf6e24721d9846bd7b682bd0be2187bcaf680393ec0de445845302bb5365eaa376dc7f1a31e77fefa668e8c5388e8425d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
42a5f2071f4f26b511c769b02cdcec1f

SHA1
705da29137dee03d60eeeca3f8bf47613e41c635

SHA256
1f2580501baa9d67b758962e2ea9b89fb16c692d6470d51cd2fae97af1dcc0ec

SHA512
1f4ad05c1d0186e4b9168ec694d40bb347f9bb2729f83f643c36f08804025d55062d116a2b490ce8e6bf2fce5f83717e3bcef87459abe060b9d3bd8404477b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
06264f4426cabb8b11a554cfe189b75e

SHA1
bde17eea65925444c85c9b75594d44353cccf89b

SHA256
9044036d1e835455949c72183b3b2201c0aacfacf12cc2d4108b4fd7377e8470

SHA512
14987e865414c332dae9699524ed7bbc209d79177d7931aa35622257096f93bfeaa09472ceaaad796726a9ceeaee385681b108b833d4f3f48f3ff5a0b6356807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
e599650e06bcf5a1d229ef024815a90d

SHA1
517c49031ac86909759ba8f844c49980d29f9583

SHA256
542a020c0a189030208230c11da3567bcaf544a62a63f2096fe0cb61c3c2d0d6

SHA512
e42e6dd6bb0486c3c629977bc61282ada18605a27352023ce713d6aa16295a51645509fe5dfcc8f0f811dc459430337ddf2fbe3a23b51f87bfeb2d9b9ff37b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
cd16e74c03188d98fc0031b0351c527e

SHA1
539e8f59e72bfee056b8491270d7e66732bca46b

SHA256
b0f82ec2f9f4876c43e98ea7bda33c973e33eb38e8d1ab0ea5e1cfe9166185b5

SHA512
dd9f293eb4f13bc294802d8ecfd898d26502b3b563fbd12234c1d058917481f30c960290cc18944d3c76f6edc5725b17fed7696bf2502983d7e55a1b36138db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
f563976f9c24371a9d5fd82fd660e2e7

SHA1
51f36f8375bc325c5382ec87f6265f3d86aa9f74

SHA256
552eaa14671320bd69cf40c96ed701a78e4c80e9442098b40adbb9d86ff746fd

SHA512
78667123d8d30e5c5b43dc6991120096dd2eca9f4a7f17c91cf2ccc0990bdb74dd2464999f13914d737dfd2a2188e29271b56bbfae528716c33365b42dad77bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582594.TMP
Filesize
1KB

MD5
0d15ab61a34b17f5dd574e43ce3ab078

SHA1
4e2d083c1fcdc5c15e2dbbcee3c69441ff0c232d

SHA256
406cda090ed384b80ee5f8c7061841680664207904dabd1990bc40ba32e833cd

SHA512
2c2694b46b27b48b98d3901840a87c7362a4a524210f32b6540951190f25a2eab5cca4120e1c48bd148e9507cf2e45afa7cc2e97b4be38013b70b7c9c65f8485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cc03a.TMP
Filesize
1KB

MD5
1cb8bd45bb10f98927424c0725ecfc7e

SHA1
144fb073455216e5a3479d2d48366113f6766fdb

SHA256
526a1a93157611401acc9aedef7a1906d66f9bf565b63daaeaf99c544cde8d3a

SHA512
0dc308d456eee0b11c259173e789fa028383730c4d1dec61b7ba4b3740eba5d6876a537722c415076bd73a3579d7481f54f6f561dd02545bc820161b2a0caa62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db
Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
0aca352481bfc40d1eec7c031e449915

SHA1
667634e40bed994d81772c0d78d7b5cd9d113ce7

SHA256
91c32d470a5ff0278aaba672a76825e41b5c7b016740564caf8c26063f85e19f

SHA512
04c7c43aa1d78eeea6e7211ddae52f4ebc78486561c0d34f3ea7fd6314524f0015df134617cca55366981f5ddb79e6d5a82aa503f1b2e27ca8ed6e03ebb38b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
2a33e103b99c51950ac1a2638fe30d66

SHA1
1d5149a76fcfd564c45079b8eb48408f30cccd99

SHA256
b1d3525665bc9568ceeb2434f5bf7fae4977fcb98c9da47e9c92673156652b5a

SHA512
5e8af81b75e59c0de64a6bbf456717342366df65bf6ca1c9e23f1d9d7ea8538d03fdbafa7a8d99b46d415f121e1ceeb26fc8060fb08bb661610c03f08d1552cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e45cbc7c7e7837521272bce22f89421e

SHA1
80b347200c5300567b4803c73cbc4d782161cc73

SHA256
b5572c6afc1a0a8f7e6409c2f4c654eb9fc3126ca7627385ce2a0daa19214ab4

SHA512
1da0d54689a490ee6d1d3f42ae7231b4525a5391830c07518cc6514e4b38d11cff3e457e5618094f4c6b1b6caa3e46b1f07c97c61fba2a671741cfba83e20052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
ce6764fc56ff9fe311720f0b4f672848

SHA1
d32e443e058e95558c903f10d73ee491722d6226

SHA256
d9afbf0c4e855a0ceb536b58a2c977bd185e53cc5ae94e1c1d015fdf2ca08fde

SHA512
e4a0fa01be59eae1d3e2daa7022621c37f1282e1f7185f76172fb033c49d27d709bceadb506eef1e9ef86f48d697722efe5d54d05c3dbdcb8e55db807704af80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Filesize
640KB

MD5
9972fcd3dc39a2ab337d03e225d143c0

SHA1
f23c053fd9bce97f2fcfd6c25cd44b35bfddfc8c

SHA256
0408866a04e7b66455913cb947465fb44cc02e481f9026a4c17b76528522fc1b

SHA512
f389d12bab349187f6206f6c82d6bee712f5d8669b83a2cc49fc6b26b00953bf2455e942fce6c77533adc9e6aaa0adbc90a1a06674698c5d300d4a1c31b451d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 435046.crdownload
Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 903244.crdownload
Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 97758.crdownload
Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 981690.crdownload
Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4
Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
\??\pipe\crashpad_1272_UHLJXBDRVZHVKZMA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2396-634-0x000000001BD10000-0x000000001BD18000-memory.dmp

Filesize
32KB

Download
memory/2396-706-0x00007FFD5F590000-0x00007FFD60052000-memory.dmp

Filesize
10.8MB

Download
memory/2396-621-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/2396-636-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/2396-708-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/2396-722-0x00007FFD5F590000-0x00007FFD60052000-memory.dmp

Filesize
10.8MB

Download
memory/2396-635-0x000000001D050000-0x000000001D088000-memory.dmp

Filesize
224KB

Download
memory/2396-619-0x00007FFD5F590000-0x00007FFD60052000-memory.dmp

Filesize
10.8MB

Download
memory/2396-637-0x000000001C390000-0x000000001C39E000-memory.dmp

Filesize
56KB

Download
memory/2396-620-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/2396-618-0x00000000002C0000-0x0000000000724000-memory.dmp

Filesize
4.4MB

Download
memory/2396-707-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/2396-632-0x000000001B650000-0x000000001B660000-memory.dmp

Filesize
64KB

Download
memory/4532-921-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4532-934-0x000000000A6A0000-0x000000000A6D4000-memory.dmp

Filesize
208KB

Download
memory/4532-935-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4532-8847-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4532-24861-0x000000000A6A0000-0x000000000A6D4000-memory.dmp

Filesize
208KB

Download
memory/11308-24956-0x000001C7E2420000-0x000001C7E2D34000-memory.dmp

Filesize
9.1MB

Download
memory/11308-24957-0x00007FFD5CF10000-0x00007FFD5D9D2000-memory.dmp

Filesize
10.8MB

Download
memory/11308-24958-0x000001C7FD3F0000-0x000001C7FD400000-memory.dmp

Filesize
64KB

Download
memory/11308-24982-0x00007FFD5CF10000-0x00007FFD5D9D2000-memory.dmp

Filesize
10.8MB

Download
memory/14808-25063-0x000000001C340000-0x000000001C3DC000-memory.dmp

Filesize
624KB

Download
memory/14808-25064-0x00007FFD539A0000-0x00007FFD54341000-memory.dmp

Filesize
9.6MB

Download
memory/14808-25092-0x00000000011D0000-0x00000000011E0000-memory.dmp

Filesize
64KB

Download
memory/14808-25060-0x000000001B7A0000-0x000000001B846000-memory.dmp

Filesize
664KB

Download
memory/14808-25062-0x000000001BE70000-0x000000001C33E000-memory.dmp

Filesize
4.8MB

Download
memory/14808-25061-0x00007FFD539A0000-0x00007FFD54341000-memory.dmp

Filesize
9.6MB

Download
memory/14808-25091-0x00000000011D0000-0x00000000011E0000-memory.dmp

Filesize
64KB

Download
memory/14808-25090-0x00007FFD539A0000-0x00007FFD54341000-memory.dmp

Filesize
9.6MB

Download
memory/14808-25065-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/14808-25066-0x000000001C5A0000-0x000000001C5EC000-memory.dmp

Filesize
304KB

Download
memory/14808-25067-0x00000000011D0000-0x00000000011E0000-memory.dmp

Filesize
64KB

Download
memory/28472-24960-0x00007FFD5CF10000-0x00007FFD5D9D2000-memory.dmp

Filesize
10.8MB

Download
memory/28472-24923-0x00007FFD5CF10000-0x00007FFD5D9D2000-memory.dmp

Filesize
10.8MB

Download
memory/28472-24924-0x0000020137DB0000-0x0000020137DC0000-memory.dmp

Filesize
64KB

Download
memory/28472-24922-0x000002011D8A0000-0x000002011D8BE000-memory.dmp

Filesize
120KB

Download