Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Vat.N0.20260804142245.exe
- Size 3.5MB
- Sample260804-pdasjsag37
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\B: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\E: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\G: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\S: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Y: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\H: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\I: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\J: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\K: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\L: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\M: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\O: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Q: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\N: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\R: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\T: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\U: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\V: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\W: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\X: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Z: MicrosoftEdgeComRegisterShellARM64.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 api.ipify.org 33 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3284 tasklist.exe 472 tasklist.exe 2944 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 2972 MicrosoftEdgeComRegisterShellARM64.exe 3844 MicrosoftEdgeComRegisterShellARM64.exe - Loads dropped DLL 2 IoCs
pid Process 2972 MicrosoftEdgeComRegisterShellARM64.exe 3844 MicrosoftEdgeComRegisterShellARM64.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4840 cmd.exe 2324 cmd.exe 2904 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2352 3844 WerFault.exe 101 - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.N0.20260804142245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1396 timeout.exe 3912 timeout.exe 3012 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 3980 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-2358622821-2061873118-3879005965-3129/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe" Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings Vat.N0.20260804142245.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 3980 taskkill.exe Token: SeDebugPrivilege 472 tasklist.exe Token: SeDebugPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateTokenPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAssignPrimaryTokenPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLockMemoryPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncreaseQuotaPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeMachineAccountPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSecurityPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemProfilePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemtimePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeProfSingleProcessPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePagefilePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePermanentPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeBackupPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRestorePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeShutdownPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAuditPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemEnvironmentPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeChangeNotifyPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRemoteShutdownPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeUndockPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSyncAgentPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeEnableDelegationPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeManageVolumePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeImpersonatePrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateGlobalPrivilege 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: 31 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: 32 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: 33 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: 34 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: 35 2972 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 2944 tasklist.exe Token: SeDebugPrivilege 3284 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4848 Vat.N0.20260804142245.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 2972 MicrosoftEdgeComRegisterShellARM64.exe 3844 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4848 wrote to memory of 4840 4848 Vat.N0.20260804142245.exe 86 PID 4840 wrote to memory of 4192 4840 cmd.exe 88 PID 4192 wrote to memory of 2972 4192 ComputerDefaults.exe 89 PID 2972 wrote to memory of 3980 2972 MicrosoftEdgeComRegisterShellARM64.exe 90 PID 2972 wrote to memory of 2324 2972 MicrosoftEdgeComRegisterShellARM64.exe 93 PID 2324 wrote to memory of 2904 2324 cmd.exe 95 PID 2904 wrote to memory of 472 2904 cmd.exe 96 PID 2904 wrote to memory of 2488 2904 cmd.exe 97 PID 2904 wrote to memory of 3912 2904 cmd.exe 98 PID 2904 wrote to memory of 2944 2904 cmd.exe 111 PID 2904 wrote to memory of 4420 2904 cmd.exe 112 PID 2904 wrote to memory of 3012 2904 cmd.exe 113 PID 2904 wrote to memory of 3284 2904 cmd.exe 115 PID 2904 wrote to memory of 4756 2904 cmd.exe 116 PID 2904 wrote to memory of 1396 2904 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\ProgramData\S-1-5-21-2358622821-2061873118-3879005965-3129\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe"MicrosoftEdgeComRegisterShellARM64.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:472
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3912
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4420
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3012
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4756
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1396
-
-
-
-
-
-
-
C:\ProgramData\S-1-5-21-2358622821-2061873118-3879005965-3129\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exeC:\ProgramData\S-1-5-21-2358622821-2061873118-3879005965-3129\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 12122⤵
- Program crash
PID:2352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3844 -ip 38441⤵PID:4384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-2358622821-2061873118-3879005965-3129\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-2358622821-2061873118-3879005965-3129\SystemAppData\PDFCore8.dll
- Size 3.8MB
- SHA256 3807ef43f7cbed1b210b64ddf532f9646482d4f4366b060a692c8598ab01e3aa
- MD5 828d56db8d6ecb84f456a588a0d46852
- SHA1 1961fb46cb27c5012669d997e736d100627f4ece
- SHA512 86df535dbabdff8a8c7113c92c6beb1e81ce4456832a69c31d48d2df860980b8eb9b40a99361cfced028c433fd33d3f3797c4e53b91d713696e9096fdd9f2388
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxnArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxnArDMxLkfIsEs
- TLSH T12D06D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
- MD5 932203a782310a1857131c0e61d2a8c6
- SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
- SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
- TLSH T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
- MD5 2b5a8554c5d49029302e9f94d82f4f89
- SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
- SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
- TLSH T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 727B
- SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
- MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
- SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
- SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
- TLSH T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
- MD5 a791979dcf39c58caa0d0e7b1d6e230d
- SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
- SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
- TLSH T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 727B
- SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
- MD5 520b189a6d3e6f328898d98bb7105d6f
- SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
- SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
- TLSH T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 a069bfd6bba825d66bb0f296358959ce87ff1ba8faa5875243120872055ca0ae
- MD5 fbff1c9c88f6b880f6ef7a03daf5e4ed
- SHA1 c7fd0edac26fe67bb8b9507ff7de8aac08101ae8
- SHA512 1dc77aa58afae928492084a513d24c7adbe6cca6cdc54c7ebdcda9931bb12897dea8f0f47fe088bbab72c697d61a8c891c2889d00c80db1fa0033d182eb1242c
- TLSH T1A5E0C6281EF7043DF3ABCABA4BC2F4526829F186A800CBB10F90090C9B08F000E524B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 37de4b1228ab620907c0adc7d955a48e5f9bac5b5d17d1172073e26420ab6fa3
- MD5 372295caabeb8855c9b95d00d8a65f13
- SHA1 b4932545c2fe6894d9c7d3f8f42024f1fc458af0
- SHA512 0886602c27c6a863115b32d7e120e053c967f3b616bf05c7b5972d8f6015c82e3d9b5df0f9804829924fabf6ce795d76412bcb0eb91cfef7dbc5eb6ab016bc43
- TLSH T17CE0262037FB602FF1B89F7803DAD09AAF26F1136C5656BF1F92543D991AA414DA2C30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 404B
- SHA256 dd03a777bd7bc6a1ca170ebfb1a7f4ce578ddbcaf43bbadc24e747a039df7d11
- MD5 113d716060a54da8024abbf1c9b18549
- SHA1 1eb199eee16943969cf3c172d754406a3b3b558c
- SHA512 1512a6903fa9998b8bec0995153bebfbd41740afafc91474267040d4a7d4ee2d79b00acf1889547fb883ff3baa7899598cc2efbf091899f912eb5b551dd0ba07
- TLSH T194E02D3032FE052DF5F4E8380AFAEE22697EF20F0406C3AE26140B25AB00B004CA2131
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 f6f049246168b40d1a277654dd6144c2fedfa85260a7e3847392be45b255136d
- MD5 cf3997218be18839f9d31b9ea0077e41
- SHA1 a90adea1ed55ec4bf2a701ebbbb030e2bd62da3a
- SHA512 dff869b9c72eca3aaf6c9e0fa7187f1a56cc37c67e0262fe64177493712ff892fe58a694c2d818c7d0ffb667fe996bf8566bb57bad8dbfc17e79f082814f5578
- TLSH T182E0C03935EF740EF050CC354AFAA1762D49F3011404977D0BD00308B70AF009D109F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 416B
- SHA256 5b406043a6355198179608c5810d0b3fe9a3d2c7d8ceb7d225830611b30b3c03
- MD5 8f2024c64559a4079d22d5f75dd8b7c5
- SHA1 7b4a871b9611c6a5c20b322a1954df6cc94cc5fd
- SHA512 e6e2c0b5ab977f421ed07554ccdd2c666eb7300de4c86a70e8e83f49e6de3e694638605f38e04452510a0514c209457e2588883cab3d640ca7e1d37a9abed84d
- TLSH T18AE0D82812BEA61EF064DD3547F9A9356D58F315141482B906D147986B17F015C11AB5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD
- Size 1KB
- SHA256 f63645ebc5dd903871371a2cc2f91fe5d709805e4f6b22337c0d3d7028c52bab
- MD5 aefa2875d987e3759bfa5cf6c8e93219
- SHA1 f7a5771404eedf1732f4c5ec449970958fdbe993
- SHA512 7b35b6be53abb3d793d0fccded1d62bb934e0857f2b89a3de557c1e2adc981fd11bc939302ba8d8b37ac803c25f31a88dcc0a58c4b98472c523e5a57b24e7af5
- TLSH T162314E8EC4474E1D435502DF274ADCAAC680F48BFD8431D0B2EC5FC02382A8E48A6BED
- MD5 SHA1 SHA512 TLSH