eab0cf5d172d9ef0cd49d7c7944be946d95235c634a48b12a4c450eb7f68d657

Resubmissions

18-08-2024 23:55

240818-3yqldssbqe 6

18-08-2024 08:48

240818-kqn4gsydjm 10

Analysis

max time kernel
136s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18-08-2024 23:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

nuclear_bombs.mp4
Size

188KB
MD5

89a4d69ff3c526730c4fd6c3c8b16cc2
SHA1

c5a41e374ce559c402e07eb63f94de7091ef3af3
SHA256

eab0cf5d172d9ef0cd49d7c7944be946d95235c634a48b12a4c450eb7f68d657
SHA512

c6288a36be86f7593a146f4b385a6389c48bc58b1fafdd32a32a7c710d3360204cb3b902166fad683aa012a409e547394b77aad24290d4a62b07012a50aa4124
SSDEEP

3072:WURDsJZX3lZAbWgdAALG96g5ehTtcq6Sm7bsxuTw53Fna6+:IJZlZAbRGALG96g5eHcq6SQk53Fp+

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1760	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1735401866-3802634615-1355934272-1000\{7E5A2AA5-CE37-4A31-A425-92BF6A649FAC}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2008	msedge.exe
2008	msedge.exe
764	msedge.exe
764	msedge.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
5024	identity_helper.exe
5024	identity_helper.exe
2540	taskmgr.exe
2540	taskmgr.exe
2124	msedge.exe
2124	msedge.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3528	unregmp2.exe
Token: SeCreatePagefilePrivilege	3528	unregmp2.exe
Token: SeShutdownPrivilege	1760	wmplayer.exe
Token: SeCreatePagefilePrivilege	1760	wmplayer.exe
Token: 33	2948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2948	AUDIODG.EXE
Token: SeShutdownPrivilege	1760	wmplayer.exe
Token: SeCreatePagefilePrivilege	1760	wmplayer.exe
Token: SeDebugPrivilege	2540	taskmgr.exe
Token: SeSystemProfilePrivilege	2540	taskmgr.exe
Token: SeCreateGlobalPrivilege	2540	taskmgr.exe
Token: 33	2540	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2540	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1760	wmplayer.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1608	1760	wmplayer.exe	82
PID 1760 wrote to memory of 1608	1760	wmplayer.exe	82
PID 1760 wrote to memory of 1608	1760	wmplayer.exe	82
PID 1608 wrote to memory of 3528	1608	unregmp2.exe	83
PID 1608 wrote to memory of 3528	1608	unregmp2.exe	83
PID 764 wrote to memory of 460	764	msedge.exe	97
PID 764 wrote to memory of 460	764	msedge.exe	97
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2900	764	msedge.exe	98
PID 764 wrote to memory of 2008	764	msedge.exe	99
PID 764 wrote to memory of 2008	764	msedge.exe	99
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100
PID 764 wrote to memory of 1132	764	msedge.exe	100

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\nuclear_bombs.mp4"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1184
  2⤵
  - Program crash
  PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
1⤵
PID:3352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=fc-vhh.exe fc-vhh.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe66fb3cb8,0x7ffe66fb3cc8,0x7ffe66fb3cd8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5582868972533555565,3418807146587767862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5800

C:\Windows\System32\fc-vhh.exe
"C:\Windows\System32\fc-vhh.exe"
1⤵
PID:5868

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38a9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7c4281df4f19bb5337e3e58e9e38ba6b

SHA1
769a0b7252a761d828e0b94873064d9c6c4ec760

SHA256
5d54b2feb45bbc6a6f3277579e4b685142aea0033fc92e637892fa9453ba650b

SHA512
da9a3ea0bb3440eadef00d759ca542ee1f0caeeea92c3975ab136228daba97ff03e6425229be8678dd5f58875d74a4095f5a4198d01c88e9b607ce6c726fb744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
63f42f1c79e98255682111419bced474

SHA1
392a69cc46c562c9e64eca8816292a2fa62fabea

SHA256
b4961ea15fb968ed3aaa6eb5241233e07e85721d48a2448648f641f433064362

SHA512
fd54189b134af5d282743f6572bc86af41ff43e8f5c034c9c58cb96c3bb9160c8fe356c8d833ae96019b9834c5ac4c00043a91b97e8d3da6cac055605fa2e7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1909c1a280903269466b7b30529c979

SHA1
e26b879fb183a5a668786c002a7964b49426753e

SHA256
90d24ddabefe11066c7cffd3ba2f66f31b699cf8bea3ec16a19f9bb91939b44b

SHA512
b16ad6bf598cb29490e3532176f9e57577f7d377d884bbbeb8187b808ca861ca8c82d1758a33e02e31f9ec49e7fccaaa263d2b7c68cfe1ce71b17da68cb3ff84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1788fec1db04f39a1b3cf5767e55062e

SHA1
913f86108607679f316a832b1fbc13ddaae26d78

SHA256
201b23a247f591b3abc492df9e82257d744560fd42cf9f8e433c3085e2cd3287

SHA512
25cedb355b3b6c71e9c1f35564ac197ef3e8729a3e703beda71375c08481f0445b98359219eee927fe481eafbb232199ed7c28e64ea74c4b4a96b18387930d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c122965e7f0742cfdcc310e220c3cda9

SHA1
9828604ed8f6995b32f2ea9f6002211db12a06fc

SHA256
786b60ed95f7f5ca2d1397da424e91e09889694d8b0c0bf8e2688ce8a15de0c5

SHA512
3f209fd732e61b59359d68c5d61ca6997e09f519bbc364dd00f391a3ede09895168da13eb7339f3f7ff3df40873a2f8f85b52b1e2a45edcf59786184b7287c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9fdea16c2a58480140db7a4615a8175

SHA1
6438d19bbf46cc7ab5a90f93e5ef5581825631aa

SHA256
6de52e560e6acd84cf962beb9511fbc0628e8473fbcc4d5854cb2591d4fc679a

SHA512
23ca8b58fe61d2dcc933c4f8e366f1dda1cab15f1769c89b97b1b9d75208cf29579dc25f21346e79715ce475f3c706186ad4401b5b7fa9f4d38b2c1e924bf123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b29313bc7bb0582a7235997f3e18fe56

SHA1
48ce221194af14af37433d7a867b5b56f01d5d50

SHA256
651cd39df16bcc87edfe280ff01d5965d6c7f64c9a3f703fa7ba00b6e83c7205

SHA512
1c7268c632d7cb5de44a8ff480d3027c5df8323249b6f7a5b5558ad29a0e00103cf2c24a81502408b3b2970fc600f37f1516f6899030936f1433830e50141e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
32a937eba082fd692b457f34508e5f6d

SHA1
5621bbde46a055042b936efb84b11b34e75c510d

SHA256
0e5b9b6605c54bcaabffbe5c8974d334713e91bd23a89dc88a634ead1e9e9007

SHA512
be516f358ea7281906cedb6a47b317ca3ab2627a268cdb2a78ae51b41eb1bbefb5d8f79e9fd5a06a221fa587e4cd28d9a463f45683e671d57d7d613d751003f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
2ce7e0d2e28a184b6791e82ef48bb525

SHA1
f66f09083389d5fe2d6c65021732c6872b597264

SHA256
f2a215a0f8765c0f7416f3249046dbf796a00400bec5646f88576995d70929c0

SHA512
1a8f463b29eb429618386041c4dbf3fa5720a45146390f5d98b2ac7ce99a32712bb7a3fff8db32640a3448127fe3595687a1fe0d577d597129a01a7410e4495b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
f1a0b48af97253176b057a5148fb5410

SHA1
71e14d5b953e3a9c4ce6c6ecf43132b0b11718d7

SHA256
76d81fd9bc52c4ba728fe250bdda06b0471b7ddd57ffb84cdec1de210a8bc4c2

SHA512
a0535f2965f155998fa8fe32d3585c788f307bae4a92200b8808afc5724cbd89961202818f4303facf21755e8b267c9ee7681fa0f13b7e87a95e2fa8d6d477a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
58783902f07e8b63ca23ca07b259afd1

SHA1
660533eaaac21790ce59635841e80a842713b71b

SHA256
79aad4051737e22eea756145d042d12ab73f1448a7b6a98ef8c94638297463b8

SHA512
e9cc1dce20bf92cb9be265b1092f4b36f09926bf2e5bee8bfcfec6718b49c7eafde87ebf4d7ff7fbd73c7916075db26bc93857e03e8c18e081d08b237802c92a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
425586f7b264706ac327b904cb746680

SHA1
2b3d8a8e2f2b2dd79cfedf8947f89197afae83a0

SHA256
20dad2931ab080559ff90b1e609b5f1286cddd50667c9107cd576c3e1c8504f2

SHA512
3aaede45ee0f70a9db05fa4fd29cab97fb6bac934964f75e816c44f51db384a3c7b2a49bac96649e08b686766886490324971cd08697f739c15e281ad52ee0ba

Download Submit
memory/1760-61-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-76-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-48-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-47-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-49-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-52-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-53-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-51-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-50-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-55-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-56-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-57-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-60-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-63-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-62-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-69-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/1760-68-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-70-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-67-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-66-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-65-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-45-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-59-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-58-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-72-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-71-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-75-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-80-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-79-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-78-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-77-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-46-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-74-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-73-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-81-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-82-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-83-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-86-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-85-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-84-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-87-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-88-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-89-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-92-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-94-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/1760-93-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-91-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-96-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-90-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-44-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-43-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1760-42-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/1760-38-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-36-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-37-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-35-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-34-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-33-0x0000000009860000-0x0000000009870000-memory.dmp

Filesize
64KB

Download
memory/1760-31-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-29-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-30-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-32-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1760-99-0x0000000009950000-0x0000000009960000-memory.dmp

Filesize
64KB

Download
memory/1760-98-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads