Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Vat.N0.20260804142245.exe
- Size 3.5MB
- Sample260804-pdasjsag43
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\H: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\I: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\N: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\R: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\V: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\P: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\T: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Z: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\D: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\G: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\K: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\L: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\M: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\O: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Q: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\W: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\J: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\S: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\U: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\X: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Y: MicrosoftEdgeComRegisterShellARM64.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 12 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2372 tasklist.exe 2536 tasklist.exe 2532 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 2848 MicrosoftEdgeComRegisterShellARM64.exe 4188 MicrosoftEdgeComRegisterShellARM64.exe - Loads dropped DLL 2 IoCs
pid Process 2848 MicrosoftEdgeComRegisterShellARM64.exe 4188 MicrosoftEdgeComRegisterShellARM64.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3004 cmd.exe 2976 cmd.exe 3500 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1820 4188 WerFault.exe 103 - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.N0.20260804142245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1256 timeout.exe 5604 timeout.exe 5848 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 4608 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ԁ" Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-3292077229-2660849199-1866092067-2647/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe" Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 4608 taskkill.exe Token: SeDebugPrivilege 2372 tasklist.exe Token: SeDebugPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateTokenPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAssignPrimaryTokenPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLockMemoryPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncreaseQuotaPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeMachineAccountPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSecurityPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemProfilePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemtimePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeProfSingleProcessPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePagefilePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePermanentPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeBackupPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRestorePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeShutdownPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAuditPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemEnvironmentPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeChangeNotifyPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRemoteShutdownPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeUndockPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSyncAgentPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeEnableDelegationPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeManageVolumePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeImpersonatePrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateGlobalPrivilege 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: 31 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: 32 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: 33 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: 34 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: 35 2848 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 2536 tasklist.exe Token: SeDebugPrivilege 2532 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 6004 Vat.N0.20260804142245.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 2848 MicrosoftEdgeComRegisterShellARM64.exe 4188 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 6004 wrote to memory of 2976 6004 Vat.N0.20260804142245.exe 89 PID 2976 wrote to memory of 1496 2976 cmd.exe 91 PID 1496 wrote to memory of 2848 1496 ComputerDefaults.exe 92 PID 2848 wrote to memory of 4608 2848 MicrosoftEdgeComRegisterShellARM64.exe 93 PID 2848 wrote to memory of 3500 2848 MicrosoftEdgeComRegisterShellARM64.exe 96 PID 3500 wrote to memory of 3004 3500 cmd.exe 98 PID 3004 wrote to memory of 2372 3004 cmd.exe 99 PID 3004 wrote to memory of 6056 3004 cmd.exe 100 PID 3004 wrote to memory of 1256 3004 cmd.exe 101 PID 3004 wrote to memory of 2536 3004 cmd.exe 108 PID 3004 wrote to memory of 4756 3004 cmd.exe 109 PID 3004 wrote to memory of 5604 3004 cmd.exe 110 PID 3004 wrote to memory of 2532 3004 cmd.exe 111 PID 3004 wrote to memory of 4780 3004 cmd.exe 112 PID 3004 wrote to memory of 5848 3004 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\ProgramData\S-1-5-21-3292077229-2660849199-1866092067-2647\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe"MicrosoftEdgeComRegisterShellARM64.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:6056
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1256
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4756
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5604
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4780
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5848
-
-
-
-
-
-
-
C:\ProgramData\S-1-5-21-3292077229-2660849199-1866092067-2647\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exeC:\ProgramData\S-1-5-21-3292077229-2660849199-1866092067-2647\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7482⤵
- Program crash
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4188 -ip 41881⤵PID:1992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-3292077229-2660849199-1866092067-2647\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-3292077229-2660849199-1866092067-2647\SystemAppData\pdfCORe8.dLL
- Size 3.8MB
- SHA256 3807ef43f7cbed1b210b64ddf532f9646482d4f4366b060a692c8598ab01e3aa
- MD5 828d56db8d6ecb84f456a588a0d46852
- SHA1 1961fb46cb27c5012669d997e736d100627f4ece
- SHA512 86df535dbabdff8a8c7113c92c6beb1e81ce4456832a69c31d48d2df860980b8eb9b40a99361cfced028c433fd33d3f3797c4e53b91d713696e9096fdd9f2388
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxnArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxnArDMxLkfIsEs
- TLSH T12D06D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
- MD5 932203a782310a1857131c0e61d2a8c6
- SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
- SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
- TLSH T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
- MD5 2b5a8554c5d49029302e9f94d82f4f89
- SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
- SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
- TLSH T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 727B
- SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
- MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
- SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
- SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
- TLSH T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
- MD5 a791979dcf39c58caa0d0e7b1d6e230d
- SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
- SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
- TLSH T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 727B
- SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
- MD5 520b189a6d3e6f328898d98bb7105d6f
- SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
- SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
- TLSH T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 2e82fbdaa3a8cd7564c02030ba2df69d120846d38f506234470796c09c5141ce
- MD5 663235b552fa8ec3eae16008e939f9f5
- SHA1 856c831f44cc4e60fda1ca7d6f6455b8e7ab5f4f
- SHA512 0225a5ee134164639e69168ccb9bcd37d460d2415d2a9bfc3131b4adc86f0475856c223a88cf7ab79fd68f2b4b5470ddcee1db9425a94045da2a590ee397521e
- TLSH T18DE026281EF6047DF3ABCABA4BD2F956981AF1569850CFB50E90594C9A09F004E924B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 25ce608d97c024610ffc49d51eeebee8d94cda360141210d30033e580a786215
- MD5 987588b7fd7f4c91479c5ac0cfd88a48
- SHA1 f26dd34864956fc130466a84d8d352c5f8dc95fc
- SHA512 9070ba69765e08d3ade23cd1139208d9b4e96aeb015504d06b7e877b851d55e51108e364995a8dd580e91d0fe075dd97dc7f67c5d9853290f23a949d2f61e973
- TLSH T1B3E0202027FE503FF1785B7403DAD0995F25F1132C5557BE1F91553D5919D414C62C30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 404B
- SHA256 e7a0515537dca2738b6c4163bd5b10a687661e0d81fac95b43d8e36ab5d25d32
- MD5 0a9d6c0325798aaeccbe412be9ff062f
- SHA1 6dc3712f1edb33bd47f68e99a681177a13534407
- SHA512 d8d82386ce082fc2d5c600a0559a61e481667e89c12bfebc16f48c1b90e3df305f54c1233476259238b5aac2fc10068dd293566f649077a406992241ebcd13ce
- TLSH T180E0283431FE011DF1F4D43406EDAC215979F10B0507D3BC05040725E700B404CA1131
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 122d43f3481c3b5cfc98ee77b4fc25be12680313b20fe87fe2ea725d9f92087c
- MD5 47fff0c05c89cdba8ada122f6a3cefc4
- SHA1 acfd350fc605abd31a6419b008a0ee89157990d2
- SHA512 b10eee2c9c9a9d4a772cc8e16c96ba81225531883a520b02c5689dd9361b42f2ed3c9f44948f10fe3414a7d132f0fdf4b746f80a9c3793eb04e9ca55b9633b24
- TLSH T184E06F2932AFB44EF0A08C324AFAA1722E89E2012804A7B90AD00308AB0AF045C10AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 416B
- SHA256 4b339c5500a08b8f47916575557d306c2588f8b66f7e7ab6932fda8add1f54c2
- MD5 ae5c21f76d8d5bae80181b9d5cb578e9
- SHA1 8846149a3275b734e258b1f3e913252bf15640b7
- SHA512 90328df54944e51668f3fd1fd63ba7cd6c1c2fe8d9b4446dcbb59c6928cc6464497a5d60dc80bafc553f8b0c876ebcc6322981a3681ea9f1815da9d0b2a58c8d
- TLSH T1B7E0D82822BEA51EF060DE7547F9A9355E48F305141493B906D147486F57E405C11AF5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD
- Size 1KB
- SHA256 995608024575e1c9890ed2d33f78b42886a0f9fae4df1a254c78e339f9c703ae
- MD5 258477b6b3e44cbcf53269a6254c0b75
- SHA1 070cc86eeb75c85cacda3e9a4bfffb2d3de44e41
- SHA512 c50b0805739b48a23db617811b3bfd66998c4f1e58487a176030345ad80ad38985c406a61d759e5916b33ddb70e9061dc1aebee6d7a5988517ff3d0e09ef1e69
- TLSH T199314E8EC8174E1D431442EF134ADC6BCA80F44BFD8431C0B2AC5B802382E8D09A6BEE
- MD5 SHA1 SHA512 TLSH