Analysis

  • max time kernel
    58s
  • max time network
    59s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-06-2024 18:22

General

  • Target

    https://d1vdn3r1396bak.cloudfront.net/installer/35947554047/558187

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://d1vdn3r1396bak.cloudfront.net/installer/35947554047/558187
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff973053cb8,0x7ff973053cc8,0x7ff973053cd8
      2⤵
        PID:240
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:3060
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
          2⤵
            PID:3064
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
            2⤵
              PID:4352
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
              2⤵
                PID:2232
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                2⤵
                  PID:824
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                  2⤵
                    PID:5096
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4536
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4784
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                    2⤵
                      PID:3144
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                      2⤵
                        PID:2628
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                        2⤵
                          PID:4920
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                          2⤵
                            PID:2464
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
                            2⤵
                              PID:1784
                            • C:\Windows\system32\msdt.exe
                              -modal "590376" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFE659.tmp" -ep "NetworkDiagnosticsWeb"
                              2⤵
                              • Suspicious use of FindShellTrayWindow
                              PID:1732
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7079966357572790393,9039871920039118486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
                              2⤵
                                PID:1868
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2276
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2148
                                • C:\Windows\System32\sdiagnhost.exe
                                  C:\Windows\System32\sdiagnhost.exe -Embedding
                                  1⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5336
                                  • C:\Windows\system32\netsh.exe
                                    "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
                                    2⤵
                                      PID:5508
                                    • C:\Windows\system32\netsh.exe
                                      "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
                                      2⤵
                                        PID:5844
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
                                      1⤵
                                      • Drops file in System32 directory
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5624
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
                                      1⤵
                                        PID:5656
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
                                        1⤵
                                        • Modifies data under HKEY_USERS
                                        PID:5980

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061318.000\NetworkDiagnostics.debugreport.xml

                                        Filesize

                                        71KB

                                        MD5

                                        b19127c1f8806894fee331ba6ee3c65a

                                        SHA1

                                        c75a035e6c0dd15fbb6207eacbfe9618c5fb0c2d

                                        SHA256

                                        4fb74558b8f62f90dc5fe847e302a60fd73552a118c8db7a3454ba27a521b270

                                        SHA512

                                        baa355cc136a50633507030717e1583f55e841d0a50085a289c9b8dd3034cbd94a0d19c3c3d4af83cf5856394f2e50982541228593d1faf7b7038355cc147b4e

                                      • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061318.000\results.xsl

                                        Filesize

                                        47KB

                                        MD5

                                        90df783c6d95859f3a420cb6af1bafe1

                                        SHA1

                                        3fe1e63ca5efc0822fc3a4ae862557238aa22f78

                                        SHA256

                                        06db605b5969c93747313e6409ea84bdd8b7e1731b7e6e3656329d77bcf51093

                                        SHA512

                                        e5dcbb7d8f42eabf42966fccee11c3d3e3f965ecc7a4d9e4ecd0382a31c4e8afea931564b1c6931f6d7e6b3650dc01a4a1971e317dab6c1f03932c6b6b7d399f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        6876cbd342d4d6b236f44f52c50f780f

                                        SHA1

                                        a215cf6a499bfb67a3266d211844ec4c82128d83

                                        SHA256

                                        ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

                                        SHA512

                                        dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        c1c7e2f451eb3836d23007799bc21d5f

                                        SHA1

                                        11a25f6055210aa7f99d77346b0d4f1dc123ce79

                                        SHA256

                                        429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

                                        SHA512

                                        2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        6877827bdd3c8de8a1ef2e0b64c77bdb

                                        SHA1

                                        adf09c6e8de20ce708671d01cb2289c442ab839f

                                        SHA256

                                        3d0e36cb83223723bc832bdb436b7c682d973a9b1c6eb14b6178f664b140419c

                                        SHA512

                                        608ae27c21dd445a292e15cf5eab55245e756082f4fa63a77b4bfb94c782a5f84880c794bea64a7441190f106ba32cfe03d50d8ccaba37c47999b67439fdd855

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        69a5f57e2e8aeed076c29285a9681b94

                                        SHA1

                                        df1391b12c7792332afcd73f55edc4ca589cfa49

                                        SHA256

                                        d92d91bf50497277db88d51fcb5db2f45683066890a008c56eadfe88e7696ab7

                                        SHA512

                                        1aab626e23334a8f1e8f172da24845c11a850b489f6206214885249045b923fe535b85e39e31e44076154e02328c39698e6ae65428b66b60badac0ce37531722

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        76106ea47fa721b26d714c959610a8fc

                                        SHA1

                                        3fac8ff3641d75b10bd414035055db467f9fa1f3

                                        SHA256

                                        1c6d2735e44e4dbf75a237c41f4fa441039f148a6192adcee74e07eb3ff3cb56

                                        SHA512

                                        1f53beddcd66833769134231eff18dfdc7defbfe152c691d085274e8ade7e2ee3dbf566b1ac2731ecb422b8612efa46e99b48f2fe9c00ed8bd43c9d063e2dad3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        46295cac801e5d4857d09837238a6394

                                        SHA1

                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                        SHA256

                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                        SHA512

                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        206702161f94c5cd39fadd03f4014d98

                                        SHA1

                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                        SHA256

                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                        SHA512

                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        8KB

                                        MD5

                                        3703bab54d8ce893becbc5d276a7b914

                                        SHA1

                                        e6e4ed09082117c379a4fb5627d64d4db17b71b3

                                        SHA256

                                        7b443e464238977d4c191027df4d021b91bcfde726efa87d9447da082f2ce8f2

                                        SHA512

                                        775c52f0f366c91ab3cc125c87e4181b3278733883bcbf20b66da21a2582752598223c1253dcafee68d4dddc2ad556d35283c8f11271b344fcb1256624ad6c55

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        8KB

                                        MD5

                                        85718255a9b860ead83080077043667f

                                        SHA1

                                        003282fbed6e0d90ba2e22bb1e41b4a52949fd54

                                        SHA256

                                        4c55900b8bd62bcdb6feae98e42ee835ac9d6392a86fb4dd4de8407d45ed0e2b

                                        SHA512

                                        3a2168cd85ccfb5d91179bce70278a6a2e1a03f7cd6e65f25baf008eea1dd776a0c86cce707baead1098c6a7fa36c91e404449e744efe460b2965f9cd45a9b55

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        8KB

                                        MD5

                                        dc7556d93ac8a7151962548bef53de63

                                        SHA1

                                        f4e130e56877d0f52a388ef2c3a81cb1a3fe46fb

                                        SHA256

                                        b1a1164bde49efc00d3cca04abaf4eb8f9a534109ab4bdaff029d5d20426d49c

                                        SHA512

                                        692e205126f5cfef35e06f1dd59e7100d2e5e66d05f7519ac1393396f90fb314b4dcdb3ce64222de47e8655e12f434712233dccef32f45ce5b3fe34f71f72a88

                                      • C:\Users\Admin\AppData\Local\Temp\NDFE659.tmp

                                        Filesize

                                        3KB

                                        MD5

                                        a9e92c50084c7d056e4a6b76677aa295

                                        SHA1

                                        5307c3d356a57f1f074abdc0743ba9d33c5062c3

                                        SHA256

                                        fcec1b1431322148abc8157c8cfcaaa7da3d8df971e91a3ed26790813b877638

                                        SHA512

                                        70e78f42d4bc51c4b30d61c88ff5593da42c58d3cceb5c1082619a9ca0af460e600e496c41a0a6163e06eef853bcd51df19278c6e3409b7edbec50574ecb9e9e

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjv5ka4o.spx.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Windows\TEMP\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\NetworkDiagnosticsTroubleshoot.ps1

                                        Filesize

                                        25KB

                                        MD5

                                        d0cfc204ca3968b891f7ce0dccfb2eda

                                        SHA1

                                        56dad1716554d8dc573d0ea391f808e7857b2206

                                        SHA256

                                        e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a

                                        SHA512

                                        4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c

                                      • C:\Windows\TEMP\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\StartDPSService.ps1

                                        Filesize

                                        567B

                                        MD5

                                        a660422059d953c6d681b53a6977100e

                                        SHA1

                                        0c95dd05514d062354c0eecc9ae8d437123305bb

                                        SHA256

                                        d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

                                        SHA512

                                        26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

                                      • C:\Windows\TEMP\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\UtilityFunctions.ps1

                                        Filesize

                                        53KB

                                        MD5

                                        c912faa190464ce7dec867464c35a8dc

                                        SHA1

                                        d1c6482dad37720db6bdc594c4757914d1b1dd70

                                        SHA256

                                        3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201

                                        SHA512

                                        5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a

                                      • C:\Windows\TEMP\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\UtilitySetConstants.ps1

                                        Filesize

                                        2KB

                                        MD5

                                        0c75ae5e75c3e181d13768909c8240ba

                                        SHA1

                                        288403fc4bedaacebccf4f74d3073f082ef70eb9

                                        SHA256

                                        de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

                                        SHA512

                                        8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

                                      • C:\Windows\TEMP\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\en-US\LocalizationData.psd1

                                        Filesize

                                        5KB

                                        MD5

                                        91f545459be2ff513b8d98c7831b8e54

                                        SHA1

                                        499e4aa76fc21540796c75ba5a6a47980ff1bc21

                                        SHA256

                                        1ccd68e58ead16d22a6385bb6bce0e2377ed573387bdafac3f72b62264d238ff

                                        SHA512

                                        469571a337120885ee57e0c73a3954d0280fa813e11709ee792285c046f6ddaf9be5583e475e627ea5f34e8e6fb723a4681289312f0e51dc8e9894492407b911

                                      • C:\Windows\Temp\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\DiagPackage.dll

                                        Filesize

                                        488KB

                                        MD5

                                        ec287e627bf07521b8b443e5d7836c92

                                        SHA1

                                        02595dde2bd98326d8608ee3ddabc481ddc39c3d

                                        SHA256

                                        35fa9f66ed386ee70cb28ec6e03a3b4848e3ae11c8375ba3b17b26d35bd5f694

                                        SHA512

                                        8465ae3ca6a4355888eecedda59d83806faf2682431f571185c31fb8a745f2ef4b26479f07aaf2693cd83f2d0526a1897a11c90a1f484a72f1e5965b72de9903

                                      • C:\Windows\Temp\SDIAG_50b996e0-d760-4845-a23c-6fa697311248\en-US\DiagPackage.dll.mui

                                        Filesize

                                        17KB

                                        MD5

                                        44b3399345bc836153df1024fa0a81e1

                                        SHA1

                                        ce979bfdc914c284a9a15c4d0f9f18db4d984cdd

                                        SHA256

                                        502abf2efedb7f76147a95dc0755723a070cdc3b2381f1860313fd5f01c4fb4d

                                        SHA512

                                        a49ba1a579eedca2356f8a4df94b1c273e483ceace93c617cddee77f66e90682836c77cea58047320b2c2f1d0e23ee7efa3d8af71e8ee864faef7e68f233bec4

                                      • \??\pipe\LOCAL\crashpad_2856_WLPOMYSVVQPFVBLW

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • memory/5336-454-0x0000029BC67A0000-0x0000029BC67C2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/5624-475-0x000002C04D600000-0x000002C04D610000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/5624-471-0x000002C04CFC0000-0x000002C04CFD0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/5624-479-0x000002C04DAC0000-0x000002C04DAC1000-memory.dmp

                                        Filesize

                                        4KB