Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Vat.N0.20260804142245.exe
- Size 3.5MB
- Sample260804-pdasjszbqc
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\H: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\L: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\W: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\B: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\E: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\J: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\O: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\S: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\T: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\U: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\M: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\P: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\V: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Z: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\R: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\I: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\K: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\N: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Q: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\X: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Y: MicrosoftEdgeComRegisterShellARM64.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 api.ipify.org 26 api.ipify.org 39 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4228 tasklist.exe 3980 tasklist.exe 4460 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 1644 MicrosoftEdgeComRegisterShellARM64.exe 5056 MicrosoftEdgeComRegisterShellARM64.exe - Loads dropped DLL 2 IoCs
pid Process 1644 MicrosoftEdgeComRegisterShellARM64.exe 5056 MicrosoftEdgeComRegisterShellARM64.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4144 cmd.exe 3708 cmd.exe 4172 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 692 5056 WerFault.exe 99 - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.N0.20260804142245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 2748 timeout.exe 2800 timeout.exe 3872 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 3400 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-2845624759-1224049303-3242343322-2221/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe" Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 3400 taskkill.exe Token: SeDebugPrivilege 4228 tasklist.exe Token: SeDebugPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateTokenPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAssignPrimaryTokenPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLockMemoryPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncreaseQuotaPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeMachineAccountPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSecurityPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemProfilePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemtimePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeProfSingleProcessPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePagefilePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePermanentPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeBackupPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRestorePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeShutdownPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAuditPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemEnvironmentPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeChangeNotifyPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRemoteShutdownPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeUndockPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSyncAgentPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeEnableDelegationPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeManageVolumePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeImpersonatePrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateGlobalPrivilege 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: 31 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: 32 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: 33 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: 34 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: 35 1644 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 3980 tasklist.exe Token: SeDebugPrivilege 4460 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3352 Vat.N0.20260804142245.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 1644 MicrosoftEdgeComRegisterShellARM64.exe 5056 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4144 3352 Vat.N0.20260804142245.exe 85 PID 4144 wrote to memory of 2624 4144 cmd.exe 87 PID 2624 wrote to memory of 1644 2624 ComputerDefaults.exe 88 PID 1644 wrote to memory of 3400 1644 MicrosoftEdgeComRegisterShellARM64.exe 89 PID 1644 wrote to memory of 3708 1644 MicrosoftEdgeComRegisterShellARM64.exe 92 PID 3708 wrote to memory of 4172 3708 cmd.exe 94 PID 4172 wrote to memory of 4228 4172 cmd.exe 95 PID 4172 wrote to memory of 3616 4172 cmd.exe 96 PID 4172 wrote to memory of 2748 4172 cmd.exe 97 PID 4172 wrote to memory of 3980 4172 cmd.exe 110 PID 4172 wrote to memory of 3976 4172 cmd.exe 111 PID 4172 wrote to memory of 2800 4172 cmd.exe 112 PID 4172 wrote to memory of 4460 4172 cmd.exe 114 PID 4172 wrote to memory of 4904 4172 cmd.exe 115 PID 4172 wrote to memory of 3872 4172 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\ProgramData\S-1-5-21-2845624759-1224049303-3242343322-2221\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe"MicrosoftEdgeComRegisterShellARM64.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3616
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3976
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2800
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3872
-
-
-
-
-
-
-
C:\ProgramData\S-1-5-21-2845624759-1224049303-3242343322-2221\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exeC:\ProgramData\S-1-5-21-2845624759-1224049303-3242343322-2221\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 6402⤵
- Program crash
PID:692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 50561⤵PID:116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-2845624759-1224049303-3242343322-2221\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-2845624759-1224049303-3242343322-2221\SystemAppData\PDFCore8.dll
- Size 3.8MB
- SHA256 3807ef43f7cbed1b210b64ddf532f9646482d4f4366b060a692c8598ab01e3aa
- MD5 828d56db8d6ecb84f456a588a0d46852
- SHA1 1961fb46cb27c5012669d997e736d100627f4ece
- SHA512 86df535dbabdff8a8c7113c92c6beb1e81ce4456832a69c31d48d2df860980b8eb9b40a99361cfced028c433fd33d3f3797c4e53b91d713696e9096fdd9f2388
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxnArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxnArDMxLkfIsEs
- TLSH T12D06D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
- MD5 932203a782310a1857131c0e61d2a8c6
- SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
- SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
- TLSH T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
- MD5 2b5a8554c5d49029302e9f94d82f4f89
- SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
- SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
- TLSH T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 727B
- SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
- MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
- SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
- SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
- TLSH T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
- MD5 a791979dcf39c58caa0d0e7b1d6e230d
- SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
- SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
- TLSH T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 727B
- SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
- MD5 520b189a6d3e6f328898d98bb7105d6f
- SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
- SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
- TLSH T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 770852a4338468a570ad5901a5a6de3cd99b89c895db9d85fa153cae800439cc
- MD5 eb1295ef6261cacd3d36d9f04a7259f8
- SHA1 a57cb810919c7a1a35708b12643f6cded69f6f29
- SHA512 64e61d397988b1062194da24ecc25ea312f39bd447deaa0336074828d4a071552da8d988afb2ff59e64bb608b479ad4e0be939e77930edd186575b4a1aa71140
- TLSH T123E0C62C1EF6083EF3AACBB94BC2F552681AF182A800CBB10E900A489B08F000E524B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 953292eb98eb4dd285fe378f2c7a675b6822667e30b68bef0c8a6134d6d342b0
- MD5 6753691e1621a102cfb19875b8a47a05
- SHA1 2e74b3e7feafdf81fbda77e2728b16432d7c3e33
- SHA512 95d489a7b525c5e972041a7c711c3fd4908ed4a42c225b24c8298ba0c3b83d03cd692258601dd2ae6a9d7442b16734d6656f54b57930aabd0b00a828e17cb235
- TLSH T110E0203027FE502FF1785B7403DAD0D56F26F1132C5557BE1F91153D99199014C62C30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 404B
- SHA256 4357d4c4b9ad45ee16d3b4902a2329e68d1258249c0ad7a93c754817496993db
- MD5 0a4c14c3efb776f65762447fec88519e
- SHA1 a90e3fada2c10e94b33ef2f268bc81da63d4e210
- SHA512 762fc8ea72308a28d3bbf6a367f271fc2eb9cb2dccd81f3e2c99196308a06798de84e9d707120f6c8070a6cf3db31804d10d579e29a3955a1e7e5482a485a772
- TLSH T145E02D3432FE052DF1F4E8380BFAAC2258BEF11B0406D3E916080765AB04B004CE2231
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 4070f3095504c5c6d2e47f18adcf51b27a2e1da46d4a70baa199ba800d3aba97
- MD5 9562c37982d367456fec7e9194e79965
- SHA1 e8bd5f3208b57ff8b72aa95a6c58744031cb6f72
- SHA512 8f5292180c54e9638aa7006a9f50be277a68c38c1645130e695aaf6433b8e086f08f3d8310a5c095e11f363b077fa7df889192a23c92ec686d6c7600128e54d2
- TLSH T18FE0D82925AFB51EF1509C754AF9A1761D59F205144496791AD04318AB5AF005D119F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 416B
- SHA256 9de59e2ef3028e447d78082836668d5a832935d3da8f377ac43f31cb6b93800d
- MD5 0dd3fa6d827b1fa9a4e8ced1ece3f28d
- SHA1 761847bd7613f679ef42b991bcaa81301b1c6a59
- SHA512 53b498e7ebbdc8b3ec6fdb9daf55317f0046f7b36e8833fedd1b33bbfef6a6d6148c2bd8d9529c5273c17aea593b89254eaec86819387d37fbe1a3902ba09e37
- TLSH T103E0683822BEA51EF060DE3003FAA8315E08F305040482B806C1439CAB07F015C12AB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8A3CCDFB49407F49CCA.CMD
- Size 1KB
- SHA256 eeff8d2cf2e7e12dbde8ed225ba2f9b3855b094dd7ade08916850dae2ce9e040
- MD5 36e6386d6d1c3226ebff8c62ccc27d7f
- SHA1 c756d0addf9ec130ea16f3d623ae95673453ecd5
- SHA512 85d98b9f15c5a71abe9f8254ff3e8490014aa334d85b4ceec8edf6a1b7a7842dcd94c58474af5cf2b96f10c35416686fc215a5b1d81ad1674adbb1a4e5f193a8
- TLSH T1FF31448EC40B4E1D431501DF1746CC5FC681E487FD8471D0B2AC5B802382A8D08B6BED
- MD5 SHA1 SHA512 TLSH