Analysis
-
max time kernel
256s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 20:36
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
orcus
209.25.141.181:40489
248d60d8a7114264bce951ca45664b1d
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programdata%\Chrome\chromedriver.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
winlogon.exe
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe family_orcus -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe orcus behavioral1/memory/2212-1451-0x0000000000DE0000-0x0000000000EDC000-memory.dmp orcus -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
UnityCrashHandlerV2.exechromedriver.exesvchost.exeBlitzedGrabberV12.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation UnityCrashHandlerV2.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation chromedriver.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation BlitzedGrabberV12.exe -
Executes dropped EXE 12 IoCs
Processes:
BlitzedGrabberV12.exemxfix.EXEUnityCrashHandlerV2.exeBlitzedGrabberV12.exeWindowsInput.exeWindowsInput.exechromedriver.exesvchost.exechromedriver.exesvchost.exeUltraEmbeddable.exeUltraEmbeddable.exepid process 4160 BlitzedGrabberV12.exe 4664 mxfix.EXE 2628 UnityCrashHandlerV2.exe 3700 BlitzedGrabberV12.exe 3392 WindowsInput.exe 6088 WindowsInput.exe 2212 chromedriver.exe 5260 svchost.exe 5996 chromedriver.exe 5388 svchost.exe 1404 UltraEmbeddable.exe 5140 UltraEmbeddable.exe -
Loads dropped DLL 1 IoCs
Processes:
BlitzedGrabberV12.exepid process 3700 BlitzedGrabberV12.exe -
Obfuscated with Agile.Net obfuscator 33 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/3700-308-0x0000000005750000-0x0000000005942000-memory.dmp agile_net behavioral1/memory/3700-345-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-347-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-365-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-379-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-375-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-377-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-373-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-371-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-369-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-363-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-361-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-359-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-357-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-355-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-353-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-351-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-349-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-367-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-343-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-341-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-339-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-337-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-335-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-333-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-331-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-329-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-327-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-326-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-323-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-319-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-321-0x0000000005750000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/3700-318-0x0000000005750000-0x000000000593E000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mxfix.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" mxfix.EXE -
Drops desktop.ini file(s) 2 IoCs
Processes:
UnityCrashHandlerV2.exedescription ioc process File created C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe File opened for modification C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops file in System32 directory 3 IoCs
Processes:
UnityCrashHandlerV2.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe UnityCrashHandlerV2.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config UnityCrashHandlerV2.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Drops file in Windows directory 3 IoCs
Processes:
UnityCrashHandlerV2.exedescription ioc process File created C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe File opened for modification C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe File opened for modification C:\Windows\assembly UnityCrashHandlerV2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1500 1404 WerFault.exe UltraEmbeddable.exe 5280 5140 WerFault.exe UltraEmbeddable.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exe7zFM.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{45A9CEF1-9BF4-4976-A830-1E4C79AA5D07} msedge.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings 7zFM.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3316 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exe7zFM.exepowershell.exesvchost.exechromedriver.exepid process 3744 msedge.exe 3744 msedge.exe 3968 msedge.exe 3968 msedge.exe 4776 identity_helper.exe 4776 identity_helper.exe 2748 msedge.exe 2748 msedge.exe 4780 7zFM.exe 4780 7zFM.exe 6000 powershell.exe 6000 powershell.exe 6000 powershell.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 5388 svchost.exe 5388 svchost.exe 5388 svchost.exe 5388 svchost.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 2212 chromedriver.exe 5388 svchost.exe 2212 chromedriver.exe 5388 svchost.exe 2212 chromedriver.exe 5388 svchost.exe 2212 chromedriver.exe 5388 svchost.exe 2212 chromedriver.exe 2212 chromedriver.exe 5388 svchost.exe 5388 svchost.exe 2212 chromedriver.exe 2212 chromedriver.exe 5388 svchost.exe 5388 svchost.exe 2212 chromedriver.exe 5388 svchost.exe 2212 chromedriver.exe 2212 chromedriver.exe 5388 svchost.exe 5388 svchost.exe 2212 chromedriver.exe 2212 chromedriver.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
7zFM.exechromedriver.exepid process 4780 7zFM.exe 2212 chromedriver.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exepid process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
7zFM.exepowershell.exechromedriver.exesvchost.exesvchost.exeAUDIODG.EXEdescription pid process Token: SeRestorePrivilege 4780 7zFM.exe Token: 35 4780 7zFM.exe Token: SeSecurityPrivilege 4780 7zFM.exe Token: SeSecurityPrivilege 4780 7zFM.exe Token: SeDebugPrivilege 6000 powershell.exe Token: SeDebugPrivilege 2212 chromedriver.exe Token: SeSecurityPrivilege 4780 7zFM.exe Token: SeDebugPrivilege 5260 svchost.exe Token: SeDebugPrivilege 5388 svchost.exe Token: SeSecurityPrivilege 4780 7zFM.exe Token: 33 3340 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3340 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exe7zFM.exepid process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe 4780 7zFM.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
chromedriver.exeBlitzedGrabberV12.exepid process 2212 chromedriver.exe 3700 BlitzedGrabberV12.exe 3700 BlitzedGrabberV12.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3968 wrote to memory of 624 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 624 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 1292 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 3744 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 3744 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe PID 3968 wrote to memory of 5792 3968 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberV121⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d51846f8,0x7ff8d5184708,0x7ff8d51847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5884 /prefetch:82⤵
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11616828430536158993,16284997028190011267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BlitzedGrabberV12.rar"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7zOCA275B38\BlitzedGrabberV12.exe"C:\Users\Admin\AppData\Local\Temp\7zOCA275B38\BlitzedGrabberV12.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File mxfixer.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uewher5f.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE9B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAE9A.tmp"5⤵
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install4⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\ProgramData\Chrome\chromedriver.exe"C:\ProgramData\Chrome\chromedriver.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 2212 /protectFile5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 2212 "/protectFile"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOCA2714D8\README.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exe"C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 8803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zOCA28FA69\UltraEmbeddable.exe"C:\Users\Admin\AppData\Local\Temp\7zOCA28FA69\UltraEmbeddable.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 8723⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Chrome\chromedriver.exeC:\ProgramData\Chrome\chromedriver.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 14041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5140 -ip 51401⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f0 0x3241⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5397120f5a71b2f5fb31a42656d2d7e49
SHA16f0ff453d0b5da25cd8f11b160eab8f968ecb04e
SHA256709c26e563c871ea66a712420bd8fd08a35dccce42ba58edf816941c081e844c
SHA5123e9336fb2fb54bbf21de3be2df33d50d3efe4a8640283278d0fe9fcbf084d9360cace0f42299f4b570a1ec36295f2b90f1bac490b3fb45543d55b239e88a21a2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD512fe095c7beb9e61412cbf7248962a3b
SHA159c6d5e6111592bb985a59750ae761fa72929094
SHA256700be6e264e2466fbb562200d442712fe78988213038c2674189c7623e785e5f
SHA512fe27996ae6721b7adae6765bee6327f3902cdda01ef3d5b7303ccd5d32e6e88b5d059114a8288f5cda137bff61fa6780aab573bc998648fbdc40e4e700497e22
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD54b66e372540d01e6c410f3e7d9d24107
SHA1776d31ac11e9db4341f64604984925c3b8799880
SHA2564938c0302c4dc438c44c62d9f0990d39e4fae6fd8680a0e0a83820eed54589a0
SHA512a55004661c39ed235b66bc171715c2c3ed55a43148082b827c93362968d91823f7ab1ac88f245620c613caa7be13df74a7aafa1f89df8496784422d262a0eede
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
358B
MD58096c6fda10904aabeb07f339e1d36c8
SHA150bb52158acd9b2113640866af009b1460629737
SHA2566ffd1fbd47451c45209c555fdc13fc91fdaa0e78017f938e83f55d4eac70790e
SHA512c1921eb71c846300e1f8ddf85d41c504a5f67ae3e7e8b740dad2c6f23428805ad782c1b228efb583a2e34e3fda76ffc9c17fd2bd5fa5a255e9ed1285f7d3e72c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1001B
MD5e67cdc28bc67d278dad45fe115a3ad47
SHA1eb4f88169c316f5d7a04b79df54131c866afeb77
SHA256cfd70a86c44a74e29f27ba7eb52b384289d80450394844ec22b5e26a42a67079
SHA5127deccc14f01c0c3f7ebad0da30baceffaab78f8914ef0eaf5424f402a3430d3f65682f58eed6003c66d6b3cddb9ffb58dee4bc808936ce0d97ba614aab561881
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50bed0996dcae814b3dd3c0f9022e5664
SHA106be915f6f5be50251ba88709da4ea2e484ab5a3
SHA25668dbf834ff9cf2ef57c8cceb4e0efbadf973a9e27969b74062c744cbe431ac7f
SHA512c67dc7f3271cf84bdef4d7b4334313b6bef36d708a412eaecbf1c380a4560715c57a60cc1d156c83033bface7214824e2a47f267d18861e4bc4b8b78a818c1d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5cc4cc89856b60d0a9e47a9d6b4f22700
SHA1265747b649d48a02ff532faf13baa38fe0ba56f8
SHA25660f716bec1a67609be0f67bfc1b4d8624dc2ca267a6663f665876cf14bef97d4
SHA51279d8dcf376f39ca869b0afa600b848e56de0ec8c62e02e11db9f6ccfa4eb4de33efc4d1931490f56f86b74d62e477898271388b3787c1f50f7bf44a3c51da7e0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD51818969041644c6aa024e64b638c3ed8
SHA1fd3dfe0ee2c502e9a236bf33f6d2e9e3188a4609
SHA256745d18dc137992888aafb553e05b685e089108d7f88bd46dd91a2a17a22514a8
SHA512420575b7d03fdcbe4ffb5338c18f2a3a36ce1f81bccc07261570ace0aa35f8d3eb73faf59a368d54625d3b2cf8675a60cb91213f8df3b05ff6012417bf4fb382
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5d0fe6230169b6d46a068a2b0423fac6d
SHA12b90df48024717e067885b26ba5be0a94cb48c64
SHA25625cda71e10aaf5d482fbf53eb2ee01d3f1e64e4dd24cd8481c2da1b5bf7207d7
SHA51239457dd048ab06f7c9818299e37afd89ca85d15096bf5d74919823fd8dd37cfa9b9caafa6da731f77f92fd4557f175f43a5ff76e7e086aca1e7e451491b8b9e3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
706B
MD54a442db49333a17d4f3a02e2a9adfad0
SHA1c95abad6cbfaaa6df22ad70190598da5ec93c7be
SHA256db662b7ff1db4e6e5d0228c4e1a69b76d5020f8c5adc7ac1569e9d845f434995
SHA512fe7dca2c7f03d572027922a61a39d26b2b5709df9fabb2123cc210a63673d71fa7dd02fcaad28cff9a69d72b4130f03158cb43e4fceb5b9ebbca8733284f51bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5f0cc260e48820c5db1d8e81f51b4d3e5
SHA1ba5f201f7af0c3366134767c292436d331d2767e
SHA2561052baef74594077a7e5c7da438d6b83852dfdec2d520bc49986186e8d49e1ea
SHA5123ee9d1c7fa30b775cceb17f3778358c2b8df30c3f5fd1c0ea7268a9aa464383b8c7083588ab34a7f7035591ff0fe38b4b7a4c68b514f13b51eb6e804a3203093
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD522ca8747bb1d64a1053936457ca3fd18
SHA1732c54c933d4bfa68a122cbad192741777310f87
SHA256fa7becb55f60748a0ad234412a3f498afe62cfe233eca13c2944c59627e12514
SHA51242b46183aa893401f25c011cdaf2cbfde9494e5b165826af4f005e4e867211314f3f6740ae59f17c2b8eaf3c6081a8f9ad2a6e1e3ddfd1b693f8cfb4df9740ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5304ac30cc63984d7a96b42e099bd530a
SHA1f26f1c4e2e4d3ef018d4482862f304576bef42ef
SHA256c9565f64b267accf7c2977f34a86c6c1500e3fb808c39e4e336646a75790b337
SHA512773e19e2f3c87a43e9b5ac8109aa5d54c0375f5e7a49d1010471d9fd0a6ac6996449abc27b98cdd85869a7bbc6258eba56482ac478296fa0ee8dabcfdb4c8bc4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5928393be9f4a1095e3ac651d3641b877
SHA1b532c10506f21651c4da426dc8ee1eb738170d96
SHA256154ce7c565c066f1a0f509c5cfa00634eee3c889f2871805bab42d83f64c41fd
SHA5120153d5dd86642a794c62d6379056f80098afbce66cbf6f43623e0998bce48b0c6a7527be6df6d23ce963d2cb873e057116c086ee7b38f1ed4c5becb35f6666b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD517a4c479660256461f44caa15c665d14
SHA13fd0c1595e78db00ed1418ea5d685aa06c6f963e
SHA2561eb279344eb0d876ea7abbc74f237436e680e57ad01c05375880fc0df69f9cdb
SHA5121dbd9cf5b32706791ee987512d2bf5bc1989085035a05646e1fcadc512a97a8597cc1d6534a5e8a86b9b1b72a8d975841a87940ae769432502fe3850c08402ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5e2d02e8d6d3049e3aac78273c8b1b419
SHA162d741f56ea7811a5e96ccfe7a872b882c4d7a3e
SHA256d6d8e4dce1bbc6e66d692f9bfa8952af4bb679eb6ce96bbce8f769e8ff0be7cc
SHA51221817d3de22f0f9dba30bbf616d7bd790544e5dbe19074166a2e7b95c4ca6a10eb4f5abf92fca9fd47b16c650c086f10b16e341425d9298ec0aabb7be11e4de1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5793c4.TMPFilesize
538B
MD56c32ddd8426e32aa28ec954e0ddeee34
SHA1d67f30e024893c81d864bb8660c48f7cbac38035
SHA256e212c59990b0c3b64198ddb9f3572c475f8d9a86a00c1deda4402e07ceaeee7e
SHA5129b342a664d79d44ee76ee410b749f4c7fa6fc09c2f98e10fbdf98a7269986662b033a5479a63c54860c913952a93bd1fc4d74bd8b86171c7af16d187a28b5c01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5f832dfbd9c17f35372b17a301bfe1eec
SHA12281b45f29de0803663c2f56d593cf17360ffc38
SHA25658bfae23399eddbb9ce27e39f8eafe87b9ae66b2190fb86a879405de1497030c
SHA512c1953a68f26b1275096fb8cb088891167d3cbb1136fcc43ad184bd3d4f13154d4b58d4830344307e9a80fec3fb9175abf1a3c9381e5934eeb72770036753d11b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD59df2198a71ad38ecdb2a1546960af67c
SHA194c77ea1fb2abd18b4f599795ba20f2ceaf0c63c
SHA2568a105ab108789c72bfdd4363a401569fe2302b2974b546feeccccac753914f24
SHA5123745e55a644a7c4a798a281692149c822f317698b7c1704e277e20c107e92d4bb8b7d7a6c70e5edeef2b081af98f76ed6937a59054790ca612635b831854f8c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD579dd10fef5eec6037d9981f6edecf043
SHA1aa70160f2ac3e321a3baf01aedc93d916271607f
SHA2564c5fdaddc88132148b8e753f0aaed1fe13b48ec60ac553cb09f1dcde615b9d03
SHA5126e84906fadaaa59bd2a1ffb1ba9ad389d38dff66190865825d40c78d1581c73126232252e380a476250b1aa86ba3b8d42d0e6f693d40b2c2770940b561d4791c
-
C:\Users\Admin\AppData\Local\Temp\7zOCA23FF98\UltraEmbeddable.exeFilesize
465KB
MD5b6b77d0798d39d7fadd69784c4e47c30
SHA1967af699bd9e0f2f20b0743323e5cdd6c3767ea2
SHA256e5c9880090d757207a5cd373f5e1d20c42d7486c742b3a30a2ee741a7aef5ef8
SHA5125140dcebbeb53c8e74364de824d78d6c5fddcfa08f0ac38ff0d898e71bf4f8630f3b529571a7f64be00981e83af7f85a9b6665aedfaf7f0720995fae8a8e28d6
-
C:\Users\Admin\AppData\Local\Temp\7zOCA2714D8\README.txtFilesize
1KB
MD5110a464be52a150056f184348f09a6c6
SHA1c7516032dbae3d9e3c0342da0bd690318b93be6f
SHA25697b778580fd7487beb8062a777a654b718a3b16622d8bcf46594ac9048dd3e6a
SHA51204c97df944b110f6c481f2b06b406d7ba5b2b3a6176a2527ae8b9820d925a341fd106e20dd3694353effa4f623c8eeb3f858de478ebc13fa6c68d6ab04db85cf
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exeFilesize
1.6MB
MD5228a69dc15032fd0fb7100ff8561185e
SHA1f8dbc89fed8078da7f306cb78b92ce04a0bdeb00
SHA256920bec9d500f6446b84399ab4c84858d0f0d7d1abb2e0377399ebbc4bafad709
SHA512373621c4743fa72571b3c8375aa6f7852303a821558b016b002d2af07154787d978f66696db89eeed8fe41f4aed5d66b690d4f87469939f9b1dea2ac2b9101f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1Filesize
35B
MD55d792fc7c4e2fd3eb595fce4883dcb2d
SHA1ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA25641eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA5124b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e
-
C:\Users\Admin\AppData\Local\Temp\RESAE9B.tmpFilesize
1KB
MD56191d32334e5ddf3c0c27b5f79169062
SHA19c2f961629494ef4a3352ac64981d5e7c4d242b3
SHA256dddb4b315c2831d5c9909544e2a70312de814fae169472c0e050187099d04676
SHA512eff46a64428d7eb38af514a60cadfb15a76a0c1dac936d1574977d8d82b1ee31f2c729453b5e58213907f1dfb8a09e1a4a3264fbf884e7ef90076b68bae464b8
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exeFilesize
6.0MB
MD53926c7b8fdfb0ab3b92303760b14d402
SHA1b33e12ef4bdcd418139db59d048609c45fe8f9eb
SHA256c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7
SHA5124a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezt10bt3.w1w.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
C:\Users\Admin\AppData\Local\Temp\mxfix.EXEFilesize
155KB
MD5b4ec612c441786aa614ce5f32edae475
SHA13a264f8daeec9b156ddb5ed576d490dd8fbd8e7d
SHA256e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd
SHA512c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16
-
C:\Users\Admin\AppData\Local\Temp\uewher5f.dllFilesize
76KB
MD5a2c40d3a1086a78d528d4682b3296c77
SHA162ea20cfa5dc5e3894a7c581d38cbd3c9256695b
SHA256d4fc45f5fc8ba781a2692c94541bd10bb52091183b42e45dd3ad7b48a98bdc70
SHA5120f57f3a3dc86900b4bd165b355e4d515436cc2a1a1f61c7e59e2485cf1678bad28f6a059e4f03f1429a4533f5625f3fe8e655e1e2606a00f5a3e22b171a22468
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\Downloads\Unconfirmed 99939.crdownloadFilesize
3.6MB
MD54282ce784621bf22365f21260be70e5e
SHA13e743738e2ec8cc35d64ebbad99abcfde46eafe3
SHA25606fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd
SHA512aa776cfdc39c152814a7e0e6def451454ca30fc4388dec48f3d12b1e50a0ee3925bfd2333700919b52af725cfe7ece93146ba24a9c0d2a6c0d602f7b243b77ec
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCAE9A.tmpFilesize
676B
MD5fdc0ddb7ad5dfcc5a6f4754587196c30
SHA1fcb9e44cba3f042b672a2ffebe5fcc9d0a3d2697
SHA256981cdf2a55cdb542b5cec957b22aaa5405026f3eea67430c71be81949e8975d1
SHA512a1362306da0e47091ade5bb1c91f50ef61ef403325bd51dddf66cbf5911f603040c24e4f6e0e495c88762966261b91d98ee4ee629ffaa1b74ffc397f547e83ba
-
\??\c:\Users\Admin\AppData\Local\Temp\uewher5f.0.csFilesize
208KB
MD59fda52d737e56facee46407b51d4ceb9
SHA111e4b1628af6d9d9a923a16304d245737e665c49
SHA256fb81fede19f89a22edb84326f085812bdbb38cfb61d4356862e69e3e9134d9ac
SHA51247f8332c4e85aed02e0e2c26f3e42ab364ca055a949dc807bee75c6198b22136bab01aa7a9625d05fe1fdb3361fa63da34868a412a1024abc2714640f19e4a5f
-
\??\c:\Users\Admin\AppData\Local\Temp\uewher5f.cmdlineFilesize
349B
MD555cb3fc5fb967e63fba73c434b552af8
SHA16f7def5c2b9d6fd1d7bbb94bd911624bf8a47b5c
SHA256f166ccc75d6181a1a44da18f2818e80bf06d937ccd1e8956edc36e7e0d8416ed
SHA5124d693509ce171f58fcef818ea6738ba0816b89b3d1bc5853a99911435d47858576ca72a939aaff71ecdd64ef67b6926f84043ac154fcf0c22e4898eee4e0135c
-
\??\pipe\LOCAL\crashpad_3968_OJVJWAZHRZWQWCLHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1404-4391-0x0000000000DF0000-0x0000000000E6A000-memory.dmpFilesize
488KB
-
memory/2212-2156-0x000000001C170000-0x000000001C180000-memory.dmpFilesize
64KB
-
memory/2212-2189-0x000000001C350000-0x000000001C512000-memory.dmpFilesize
1.8MB
-
memory/2212-1451-0x0000000000DE0000-0x0000000000EDC000-memory.dmpFilesize
1008KB
-
memory/2212-2140-0x000000001BBF0000-0x000000001BC08000-memory.dmpFilesize
96KB
-
memory/2212-1806-0x000000001BB90000-0x000000001BBDE000-memory.dmpFilesize
312KB
-
memory/2212-1800-0x000000001B9D0000-0x000000001B9E2000-memory.dmpFilesize
72KB
-
memory/2628-304-0x000000001C690000-0x000000001C72C000-memory.dmpFilesize
624KB
-
memory/2628-627-0x000000001CD90000-0x000000001CDB0000-memory.dmpFilesize
128KB
-
memory/2628-623-0x000000001C760000-0x000000001C776000-memory.dmpFilesize
88KB
-
memory/2628-303-0x000000001C120000-0x000000001C5EE000-memory.dmpFilesize
4.8MB
-
memory/2628-302-0x000000001BC40000-0x000000001BC4E000-memory.dmpFilesize
56KB
-
memory/2628-626-0x000000001B920000-0x000000001B928000-memory.dmpFilesize
32KB
-
memory/2628-625-0x000000001B9A0000-0x000000001B9B2000-memory.dmpFilesize
72KB
-
memory/2628-299-0x000000001BA40000-0x000000001BA9C000-memory.dmpFilesize
368KB
-
memory/3392-643-0x0000000002490000-0x00000000024CC000-memory.dmpFilesize
240KB
-
memory/3392-642-0x0000000000B60000-0x0000000000B72000-memory.dmpFilesize
72KB
-
memory/3392-641-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/3700-318-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-365-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-353-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-359-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-349-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-367-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-343-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-341-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-339-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-337-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-335-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-333-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-331-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-329-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-327-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-326-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-323-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-363-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-317-0x00000000737B0000-0x0000000073839000-memory.dmpFilesize
548KB
-
memory/3700-321-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-361-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-357-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-351-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-295-0x0000000000990000-0x0000000000B3C000-memory.dmpFilesize
1.7MB
-
memory/3700-319-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-369-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-371-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-373-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-296-0x0000000005980000-0x0000000005F24000-memory.dmpFilesize
5.6MB
-
memory/3700-377-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-375-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-12080-0x00000000065A0000-0x000000000663C000-memory.dmpFilesize
624KB
-
memory/3700-12097-0x00000000714A0000-0x00000000714D7000-memory.dmpFilesize
220KB
-
memory/3700-379-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-355-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-347-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-345-0x0000000005750000-0x000000000593E000-memory.dmpFilesize
1.9MB
-
memory/3700-314-0x00000000714A0000-0x00000000714D7000-memory.dmpFilesize
220KB
-
memory/3700-308-0x0000000005750000-0x0000000005942000-memory.dmpFilesize
1.9MB
-
memory/3700-307-0x00000000053D0000-0x00000000053DA000-memory.dmpFilesize
40KB
-
memory/3700-298-0x0000000005470000-0x0000000005502000-memory.dmpFilesize
584KB
-
memory/4160-247-0x0000000000160000-0x00000000003A4000-memory.dmpFilesize
2.3MB
-
memory/5260-2999-0x0000000000CD0000-0x0000000000CD8000-memory.dmpFilesize
32KB
-
memory/6000-285-0x000001E222C30000-0x000001E222C52000-memory.dmpFilesize
136KB
-
memory/6088-648-0x000000001A830000-0x000000001A93A000-memory.dmpFilesize
1.0MB