Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Vat.N0.20260804142245.exe
- Size 3.5MB
- Sample260804-pdasjsag42
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\R: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\S: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Y: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\I: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\K: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\P: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\W: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\J: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\N: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\O: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\U: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\X: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Z: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\L: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\M: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\T: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\V: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\B: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\E: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\G: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\H: MicrosoftEdgeComRegisterShellARM64.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org 14 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3820 tasklist.exe 1580 tasklist.exe 1828 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 4576 MicrosoftEdgeComRegisterShellARM64.exe 2496 MicrosoftEdgeComRegisterShellARM64.exe - Loads dropped DLL 2 IoCs
pid Process 4576 MicrosoftEdgeComRegisterShellARM64.exe 2496 MicrosoftEdgeComRegisterShellARM64.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1348 cmd.exe 1864 cmd.exe 3788 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1680 2496 WerFault.exe 100 - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.N0.20260804142245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe - Delays execution with timeout.exe 3 IoCs
pid Process 2588 timeout.exe 4256 timeout.exe 2568 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2124 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-2969103771-3109696404-3892790346-2130/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe" Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings Vat.N0.20260804142245.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 2124 taskkill.exe Token: SeDebugPrivilege 3820 tasklist.exe Token: SeDebugPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateTokenPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAssignPrimaryTokenPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLockMemoryPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncreaseQuotaPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeMachineAccountPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSecurityPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemProfilePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemtimePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeProfSingleProcessPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePagefilePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePermanentPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeBackupPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRestorePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeShutdownPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAuditPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemEnvironmentPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeChangeNotifyPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRemoteShutdownPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeUndockPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSyncAgentPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeEnableDelegationPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeManageVolumePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeImpersonatePrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateGlobalPrivilege 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: 31 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: 32 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: 33 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: 34 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: 35 4576 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 1580 tasklist.exe Token: SeDebugPrivilege 1828 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4180 Vat.N0.20260804142245.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 4576 MicrosoftEdgeComRegisterShellARM64.exe 2496 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1348 4180 Vat.N0.20260804142245.exe 85 PID 1348 wrote to memory of 1868 1348 cmd.exe 87 PID 1868 wrote to memory of 4576 1868 ComputerDefaults.exe 88 PID 4576 wrote to memory of 2124 4576 MicrosoftEdgeComRegisterShellARM64.exe 89 PID 4576 wrote to memory of 1864 4576 MicrosoftEdgeComRegisterShellARM64.exe 93 PID 1864 wrote to memory of 3788 1864 cmd.exe 95 PID 3788 wrote to memory of 3820 3788 cmd.exe 96 PID 3788 wrote to memory of 1444 3788 cmd.exe 97 PID 3788 wrote to memory of 2568 3788 cmd.exe 98 PID 3788 wrote to memory of 1580 3788 cmd.exe 105 PID 3788 wrote to memory of 3208 3788 cmd.exe 106 PID 3788 wrote to memory of 2588 3788 cmd.exe 107 PID 3788 wrote to memory of 1828 3788 cmd.exe 114 PID 3788 wrote to memory of 4688 3788 cmd.exe 115 PID 3788 wrote to memory of 4256 3788 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\ProgramData\S-1-5-21-2969103771-3109696404-3892790346-2130\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe"MicrosoftEdgeComRegisterShellARM64.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1444
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2568
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3208
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2588
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4688
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4256
-
-
-
-
-
-
-
C:\ProgramData\S-1-5-21-2969103771-3109696404-3892790346-2130\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exeC:\ProgramData\S-1-5-21-2969103771-3109696404-3892790346-2130\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 2042⤵
- Program crash
PID:1680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2496 -ip 24961⤵PID:3444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-2969103771-3109696404-3892790346-2130\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-2969103771-3109696404-3892790346-2130\SystemAppData\pdfCORe8.dLL
- Size 3.8MB
- SHA256 3807ef43f7cbed1b210b64ddf532f9646482d4f4366b060a692c8598ab01e3aa
- MD5 828d56db8d6ecb84f456a588a0d46852
- SHA1 1961fb46cb27c5012669d997e736d100627f4ece
- SHA512 86df535dbabdff8a8c7113c92c6beb1e81ce4456832a69c31d48d2df860980b8eb9b40a99361cfced028c433fd33d3f3797c4e53b91d713696e9096fdd9f2388
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxnArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxnArDMxLkfIsEs
- TLSH T12D06D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
- MD5 932203a782310a1857131c0e61d2a8c6
- SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
- SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
- TLSH T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
- MD5 2b5a8554c5d49029302e9f94d82f4f89
- SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
- SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
- TLSH T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 727B
- SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
- MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
- SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
- SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
- TLSH T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
- MD5 a791979dcf39c58caa0d0e7b1d6e230d
- SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
- SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
- TLSH T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 727B
- SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
- MD5 520b189a6d3e6f328898d98bb7105d6f
- SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
- SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
- TLSH T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 591e9d3a2c4018c9ef1a733c7af382ea7ee67406e21990e3284ce6a88f327e8b
- MD5 63dfe1f2a057fc481f2376116bed780f
- SHA1 80e0c3103a2a9a5b04bde7b733b3b8b6d74a4424
- SHA512 c95fff79d127d618a68ffb954b147b7398cc0bdee2d36e423cd4d81005fbe6fb6c4efb0ce8b839390d5c8666bb67dd8ae55c2a7a373fb47e1df4c1acbf3df9f1
- TLSH T1CAE026281EF6047EF3AACBB94BD6F5569819F156A860CBB50E905A4C9B09F000E524B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 2decae01b93613bf7ffe45115f5f163de4bc32ada6e7f9d53b5b7435fb58af1e
- MD5 1ba7313adc38b55e9a4e5dab68065933
- SHA1 57e665d41117ee706919a25da1b79eebcbeed099
- SHA512 27ec4e8d052b6e4f39ca3c39a88fc7c322a80de033f905e21c34432286c4e7e72d8ee8edc61bed01047ca5de8c331fb6f4c1e827e0e6656e55ce012f9887df53
- TLSH T151E0D82026FA502FF5685B7802DA90955B25F1162C5557AE1F91143D591DA014D66830
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 404B
- SHA256 413063b4f377c8f8c1eed3606cbb88010923224a106d7fd5eb0db484d7bf0b6d
- MD5 f6229b88a55a3db90eb192fd4077693d
- SHA1 44f5dd4cf75e49c46874f6969131772ff167e89a
- SHA512 55b7283344b72118458cedeb238997e014e767173a02f21183c208fa5caf4f726af01410fcbadf58294480bca88d14a3b28e73fc05411134e0c2ecf0f341ef2e
- TLSH T198E02D3032FE091DF1F4E8380BFAAC22587AF10B1407C7E90A044726AB24B008CA6131
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 9e7827e599f73d24ed7521fbfe6b2b900ebf8de6ffaa671fe71fb0b0a630e703
- MD5 ea2da40517557ba8532ce2110003be8f
- SHA1 dfd4b5bdc1c6536008bb4d2d10f7caac87ff4a35
- SHA512 e3ac2769273359e00a82578825261132d4eda3fb6720addf0955427904d4d4093e85afee55a606cc04dfc899ffedbce88fddb87e7d19ae120182337a7b88d634
- TLSH T1C8E0682921AFB40EF090CC354AF9A1762D49F201240487780AD00308A70AF005C109F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 416B
- SHA256 4af821a947d7f81bca9c26833ad046497528826c98e9b6311b903ef6364bf850
- MD5 799628782d273b7b0430e43951458b57
- SHA1 2e345c8cd8bcc7ddf61d4883f2afb9cbb6713b93
- SHA512 9a19e1937956343ecac03930b290c91f73bda048556a8434a1619aef89c4fb86beb4ffa2bf7389ee9992a671bc7129d343cc94338175e4550aed3e681620c7ad
- TLSH T1DFE0D82812BEB51EF060DD3547F9A9755D58F305141482B916D1475C7B17F009C15AF5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD
- Size 1KB
- SHA256 75dbb02badf74fb3553fbf4d7d963659dd7670365900a17e32f722674d811335
- MD5 ecca2c4dbf0ddf4b2b4e7d22bd7d80a3
- SHA1 1e36c82ef93b55ef6d96af89c8c33e95e80a3424
- SHA512 6018ba518302fd83b1180900d97c9ea6fb4220940f6a006cb04c2cfc4a9f0f2066c9abffdcaddff6850c96bde5823469fb5042faa74bf4711a37c1a4ee54a0b0
- TLSH T1C431445EC4074E1D435442DF5746CC5BCA50F487FD8431C0B2AC5B802386A8D48E6BFD
- MD5 SHA1 SHA512 TLSH