Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
PdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vat.N0.20260804142245.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vat.N0.20260804142245.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Vat.N0.20260804142245.exe
- Size 3.5MB
- Sample260804-pdk9aaag66
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\U: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Y: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\K: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\P: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\S: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\V: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Z: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\H: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\O: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\R: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\W: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\B: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\G: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\I: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\L: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\M: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\N: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\X: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\E: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\J: MicrosoftEdgeComRegisterShellARM64.exe File opened (read-only) \??\Q: MicrosoftEdgeComRegisterShellARM64.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.ipify.org 18 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4992 tasklist.exe 3160 tasklist.exe 1052 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 4976 MicrosoftEdgeComRegisterShellARM64.exe 3184 MicrosoftEdgeComRegisterShellARM64.exe - Loads dropped DLL 2 IoCs
pid Process 4976 MicrosoftEdgeComRegisterShellARM64.exe 3184 MicrosoftEdgeComRegisterShellARM64.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4952 cmd.exe 4736 cmd.exe 3064 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4372 3184 WerFault.exe 101 - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.N0.20260804142245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeComRegisterShellARM64.exe - Delays execution with timeout.exe 3 IoCs
pid Process 2056 timeout.exe 4532 timeout.exe 1432 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 4376 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell Vat.N0.20260804142245.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open Vat.N0.20260804142245.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-757879449-600011321-1973780656-5784/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe" Vat.N0.20260804142245.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\Shell\open\command Vat.N0.20260804142245.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 4376 taskkill.exe Token: SeDebugPrivilege 4992 tasklist.exe Token: SeDebugPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateTokenPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAssignPrimaryTokenPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLockMemoryPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncreaseQuotaPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeMachineAccountPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTcbPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSecurityPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeTakeOwnershipPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeLoadDriverPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemProfilePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemtimePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeProfSingleProcessPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeIncBasePriorityPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePagefilePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreatePermanentPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeBackupPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRestorePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeShutdownPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeAuditPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSystemEnvironmentPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeChangeNotifyPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeRemoteShutdownPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeUndockPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeSyncAgentPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeEnableDelegationPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeManageVolumePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeImpersonatePrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeCreateGlobalPrivilege 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: 31 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: 32 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: 33 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: 34 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: 35 4976 MicrosoftEdgeComRegisterShellARM64.exe Token: SeDebugPrivilege 3160 tasklist.exe Token: SeDebugPrivilege 1052 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2204 Vat.N0.20260804142245.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 4976 MicrosoftEdgeComRegisterShellARM64.exe 3184 MicrosoftEdgeComRegisterShellARM64.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2204 wrote to memory of 3064 2204 Vat.N0.20260804142245.exe 85 PID 3064 wrote to memory of 3116 3064 cmd.exe 87 PID 3116 wrote to memory of 4976 3116 ComputerDefaults.exe 88 PID 4976 wrote to memory of 4376 4976 MicrosoftEdgeComRegisterShellARM64.exe 89 PID 4976 wrote to memory of 4952 4976 MicrosoftEdgeComRegisterShellARM64.exe 92 PID 4952 wrote to memory of 4736 4952 cmd.exe 94 PID 4736 wrote to memory of 4992 4736 cmd.exe 95 PID 4736 wrote to memory of 572 4736 cmd.exe 96 PID 4736 wrote to memory of 1432 4736 cmd.exe 97 PID 4736 wrote to memory of 3160 4736 cmd.exe 111 PID 4736 wrote to memory of 3444 4736 cmd.exe 112 PID 4736 wrote to memory of 2056 4736 cmd.exe 113 PID 4736 wrote to memory of 1052 4736 cmd.exe 114 PID 4736 wrote to memory of 1268 4736 cmd.exe 115 PID 4736 wrote to memory of 4532 4736 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\ProgramData\S-1-5-21-757879449-600011321-1973780656-5784\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe"MicrosoftEdgeComRegisterShellARM64.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:572
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1432
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3444
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\SysWOW64\find.exeFIND /I "MicrosoftEdgeComRegisterShellARM64.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1268
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4532
-
-
-
-
-
-
-
C:\ProgramData\S-1-5-21-757879449-600011321-1973780656-5784\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exeC:\ProgramData\S-1-5-21-757879449-600011321-1973780656-5784\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 14002⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3184 -ip 31841⤵PID:3012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-757879449-600011321-1973780656-5784\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-757879449-600011321-1973780656-5784\SystemAppData\PDFCore8.dll
- Size 3.8MB
- SHA256 62b4dab833c0ea54fe9d4a65ecb1e705791bfe47b61398c0ea155d2445fffce5
- MD5 12ad6745dc4d16f4f8e28ab0594f9420
- SHA1 85bd848bb5c4375f711fd43fdcfd542708c018bb
- SHA512 99046d16d500acf36bdc6fdced7a63cbfa46cc023f104c709e49eea46ff8596425c47bc227c0195337b8a1e53b7cb6df9dea3880a04606df19739ad0a1b388de
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxxArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxxArDMxLkfIsEs
- TLSH T1F006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
- MD5 932203a782310a1857131c0e61d2a8c6
- SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
- SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
- TLSH T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
- MD5 2b5a8554c5d49029302e9f94d82f4f89
- SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
- SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
- TLSH T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 727B
- SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
- MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
- SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
- SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
- TLSH T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
- MD5 a791979dcf39c58caa0d0e7b1d6e230d
- SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
- SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
- TLSH T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 727B
- SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
- MD5 520b189a6d3e6f328898d98bb7105d6f
- SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
- SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
- TLSH T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 11db1e44136d1e14ef39fae43511ecc995a6312389eb3a2cfb92d3706e8b8d60
- MD5 4a0c09b7245d84b6d268f1aa20b8cb0e
- SHA1 9fab982be07df5d918da07e94b19a72297a60098
- SHA512 ba5ac445c1072d00ad9e2c2a2f7dfa835bd08b5ddddc917413086b20b3cead65e9628fdab43b9cb1f87a4a23236ae3eeb1d9f037fa08eb92e65c01d01f1acf84
- TLSH T113E026281EF6047DF3ABCAB94FD1F956581AF1969850CBB90E90094C9B49F004E924B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 2c479405ea883993b10eda145da0d70bd068f08b14909a710f6d95df6f923f80
- MD5 16eaf287ff6da5a818e9bea8645af69c
- SHA1 929abb28202deb1c1eb2199d131c8c2bb0edcb26
- SHA512 c95f535e7ef1bb8ebd0c8906e1c8aff16eac66102e8ab0ef33a527739b5af5f6598aa855beaae9d4204b48487f9427ed93c94856342fdc734b1aaf180577ffcd
- TLSH T1FCE0203027FB602FF1689B7403D9D1D5AF25F1172C5556BE1F91143D59199014CE2D31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
- Size 404B
- SHA256 83d78b87517a18f31ca07ee4d13696806eacbf338a6e1e067f079c5f708fb782
- MD5 8d0118a7240d16278191e75f2bfbf3bc
- SHA1 d991ff8fdd0d771924640395f4243fa63dc21125
- SHA512 2ca670e88848a6555ebcf3d49bf3f40df74ae36cc4cc0281806b1bd0f80c2137b9e7d8fe3e150f6b1d457bf528ddf6814b7deb8af6d72075802d7e1be95b232b
- TLSH T113E02D3032FE011EF2F9E4380AEBBC32A87AF20B0506C3A806040B29AB11B004CA2139
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 32950acc8c13e51774c26e950f38df3a3684c911cb57bb1231dad0b093f9bec5
- MD5 e7116b2e053363a44f3b0761feaee725
- SHA1 d0f618b40874d00673b59d9e6218fb51cb25a36a
- SHA512 052c012a7133468fa1d422acc2d89c41753d367b1ef0d60ccbc831649aadff85e56d10fec209f8583592d40f363271fb5096da42186eb63e1562dfb2bf397c7a
- TLSH T1DDE06F2926AFB44EF190D8324AFAA1721E89E201240483BD1AD00308AB0AE005C10AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
- Size 416B
- SHA256 875c1ff4332b55646c2ca568a2c822199f291e5d85a1f6d7cd0e1bd6c4f0e210
- MD5 b93c47e14fedc7fc2f6696a75c524b6a
- SHA1 4b8df06d782312bc7865b900801286eca04ec53a
- SHA512 0d52d4abd434fb72e9b37978cc48c2a95a38c5f8cc2ebeb6c0a653b3bd0a4a4d8cba4308a9e6bce1eb2e7cb4f6477057d695846825426432baa7c386a53914ba
- TLSH T164E0D82822FEA51EF060DD3547F9A9365E4CF305181492B906D1478C6B5BE005C11AB5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD
- Size 1KB
- SHA256 5fd1af17c5f426e4d15fdf3c39cf3295b27c738e4f6ec3073d105324af4745d9
- MD5 c1659b5a1a45cb1f05e008d47855d031
- SHA1 fff34bb15cdd981051e280746d0371d2820b9d83
- SHA512 36482cb28c68457169a709ab1b9f6df387d2273406406ab29b556eeb7da62802c74f19fa9c6a89b0099fa6cbea1c71166dc61cfd7cd9ef74484449fb54b3d67f
- TLSH T15431445EC4074E0D435442DF5356CC5BC641E44BFD8431C0B1EC9B801383A8D09A6BED
- MD5 SHA1 SHA512 TLSH