Analysis
-
max time kernel
130s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2023, 01:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe
Resource
win10v2004-20230221-en
General
-
Target
https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ad8a860a-7416-40cd-b6e0-4a2b6fd91eb7.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230401031220.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d93b5b04e245d901 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EF8D7B4F-D03A-11ED-8227-CEBAE7FD2CA5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{11A41CF1-2025-45DA-8351-1782926A06A5}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000 iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 497619.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2080 msedge.exe 2080 msedge.exe 772 identity_helper.exe 772 identity_helper.exe 5904 msedge.exe 5904 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 2788 iexplore.exe 2788 iexplore.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2788 iexplore.exe 2788 iexplore.exe 4544 IEXPLORE.EXE 4544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 4544 2788 iexplore.exe 86 PID 2788 wrote to memory of 4544 2788 iexplore.exe 86 PID 2788 wrote to memory of 4544 2788 iexplore.exe 86 PID 2080 wrote to memory of 2020 2080 msedge.exe 96 PID 2080 wrote to memory of 2020 2080 msedge.exe 96 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 1560 2080 msedge.exe 97 PID 2080 wrote to memory of 2368 2080 msedge.exe 98 PID 2080 wrote to memory of 2368 2080 msedge.exe 98 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100 PID 2080 wrote to memory of 1776 2080 msedge.exe 100
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffcaef746f8,0x7ffcaef74708,0x7ffcaef747182⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:1632 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7a9665460,0x7ff7a9665470,0x7ff7a96654803⤵PID:716
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:5460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6164 /prefetch:82⤵PID:5788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:12⤵PID:5832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6436 /prefetch:82⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:12⤵PID:6128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:22⤵PID:3976
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5268
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5568
-
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"1⤵PID:4924
-
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"1⤵PID:5760
-
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"1⤵PID:5784
-
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"1⤵PID:5808
-
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"1⤵PID:3816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55a10efe23009825eadc90c37a38d9401
SHA1fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0
SHA25605e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5
SHA51289416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7
-
Filesize
152B
MD5c1a3c45dc07f766430f7feaa3000fb18
SHA1698a0485bcf0ab2a9283d4ebd31ade980b0661d1
SHA256adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48
SHA5129fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5425b7f5046ba8e407ea3cbe5db0b45df
SHA1becb346f5fd7593d9db066b3eb2ef35016aaae4b
SHA2560ee57b4e447bff9fb52ac9af994ae20545424b296fc0e630736cd09e11f6eb2c
SHA512e4d09c0196d61fbf93ff29d1f364f8c7081e7d1ddddd9893c4a4279abcfa719ce42c4690571cac8817abe293598ae2ecb8e8265ec2abc81b7954118f75aeda25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5bab95e89eeb73598fe6798b62177b731
SHA19e3830c7641bc9fd2198bcd55868f117a84152c2
SHA25677cb23f7d459b83414a5bc2b5dab78d83d180936667fc04c4583839f585f4c67
SHA512d5bf75b06440defea57a4ff774cb5fa1f26ccc5a2e0dc69d7a27e36060d56fe21bdc082761aea9306f0c003c1f8524ca60ab8fb6a155c55ca8b123585f880f48
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD559d74b08d07f0dd34511e0df7bfada35
SHA1b9acfa315955a8f0a18c2c11e8f7aa7aedb8f8bf
SHA256c6b789008b9a672d958d4819c7bffcc2a8e27a4a2b3ae9d6cff1a116c15dd5dd
SHA5125434cad25bf3c2034b79da86a75e4a21c34ff7c2b123520431e7154e5168ab25753b1f430e27a1f6d7ffd1a04a4bba5632bb8f59155951bec11d5e5b524df135
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
3KB
MD53dbcb070118209c6c5abfcb46a8a1884
SHA1a992fddc9b4e230f51e13220ad421d20deec04fc
SHA256d8f7d436609576188067ed90832eadba95b68bc92f1c3d2fe2ee3c3314b0eb80
SHA51221cd6a064c5e90c47e1595c99d4e079fc5052f813241c94b3533191ce63a7aa5f3201d0d841c600930e48dea639fecd6bbac6f8707e403ab90c98a5aa3928395
-
Filesize
5KB
MD53cd2cdbc00842daf48a827e278afa5f8
SHA197957081c20d802c5742e35ff61989d4fb416b40
SHA25618f0427a6aada54585e9d01073e92c298ea277b915c4374df471d15720ec99a6
SHA512975064f33c79d54900214e3206c19cf41ceedfe657321d2ff00858e7a2eaf22e639bca6eab11615f4bb0a68af626f4feedf67defdd05a1af6e1f0f7795a0740a
-
Filesize
6KB
MD5533c2d4f1933dbe511869195d8031c21
SHA13d9148c06c166f38e2a91517288eab6a59b697ee
SHA25672a23e8020b06a4ffcb493084fb6db76a92c485f2bc7312e5181493acd395ebb
SHA512b18f7cb0c91ab08fa090a6e85d4d543e33e41deba9b8306250891ec057f49745c16944d4750a3a57ecc0834eff5ead55517ae93fa6ceb2f5dec0d8d673cb184b
-
Filesize
7KB
MD5d90e9b575472e156cd918725fff52589
SHA17aefaa2277ec075843c429930fb434397224d660
SHA256263ea0c1e7504f57072c2ea8ae2cb77985688e0e4266e12e3ec599f06fbd0768
SHA512b4153d836c0c2132238ee1813ad3750019464ff30bd944a7b4ac5b5f7477e28ee6c7a2692346c800ce838f42942b6b65457339fc5390cc91a7bc3f4503f13d75
-
Filesize
4KB
MD59d4c56f268a130b9f2e7679396c06387
SHA15574d748680ca3fcfd6575844b529dfeff4d09b4
SHA256c6aaa4e60515dd18688fb16bd5bacfbf5c32cdf4d2249209274ca17aacd6d159
SHA5126ae34515f9832eebfea86266d87c99ffd13927153341585fc5ba495513d33188514d7dffc3e1682e6a6b1a822f5e03cc0210d24ce83c064ab13eb8edfb759cec
-
Filesize
7KB
MD50085da6a52673ee8acbc21b093d69f55
SHA15992e4f9ca44f77c7b0241aba4b6c6f7a01df9cf
SHA25688947a81e1adf3044721cc32549baae52e438aee98db6dc9905ef5bf66f7a87e
SHA51201e28869307e182df1c4369bc651d1793af6a592e0843ec238ba95367193a61c490c4b8305f3b0cea11585f3d8a4da200eeb6ed1f9f6efc6e1f88c402a8b73f1
-
Filesize
24KB
MD55edab6d3ffbeee247ccb4423f929a323
SHA1a4ad201d149d59392a2a3163bd86ee900e20f3d9
SHA256460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933
SHA512263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index
Filesize72B
MD59f142036934b2494f30be250270800f4
SHA1146e7a93f3e5320fa64f0a96fc4e203db8685b57
SHA2560813f2d21e49bd5f944b869ecd1bde168a44651632a0482dafaea7a4decf5b22
SHA5127315b1bef7cd62d73f009e2f8d96c577fbe58bc6dc937475555a044e291b5390605cec82c7e058f696221462340307055ebeb74e14956f26d1ceab328d0fc19f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index~RFe5783d6.TMP
Filesize48B
MD5570c5b00766153b2b56af140f95157f5
SHA16e8ea02e09ccadabc679c53cae8e3f29dc2210cf
SHA256fd1acaaa872e64a6f856790eea0279f807926d156d994640d872a1cdf72d8859
SHA512e02334b7d73373e98542ad53dbd89820d6e741d6da67f848d69c9868631d95f1f6263817347cd968783ae773fd1f3d9eba64bc68688de7a99d4ae1b0e6c63614
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt
Filesize85B
MD58e0c4275e4451726bf673c5c2adeda3a
SHA1b401225378f1d9e0bac2df51649c465dd0991580
SHA25683dd4a00c5c254c467e4e2fba1424d63ace73136dc6f6695575a83ab6f87961b
SHA512d082ab7c9f5509c42f83d66023070042266cfc9bf84913e30539beb3a9696921abdafae075ac5c8d9e5841abe3059bff7c4b46d80e785bb7ac4719cd577ce8c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt
Filesize80B
MD52fd0ee19ed4d4ea9008f6733b16a23ed
SHA104b3787e0a39a3a3728fafe954f1d3f524ac110f
SHA256131814891349869bf9eca8d417679de264b32e336eaf47332ca46f923d68d742
SHA512c476364b12399c1267eefc9a7040c6fe2aaa4f3b938b8f0e412b583a99c40923e2304558d1549a6b69b2ebc002716981b3cc99f66758b7ad09b1f8f0ecd2100e
-
Filesize
875B
MD5816064523e7135487b26f1acc0e9e4ad
SHA1189b23fbddb3db9f032bbd7419e46e51557575d1
SHA256aca52e5a50eaed34ec12893c395c744c382d0431689bf630d431c11d7a6e9206
SHA512444ebf6663a2ce1919ec6820b672d7b0e16bd31eb156867b38c85d4c8439b4cfb8f1341c53bee76042af132b9bab737730ba7d6b3d7a374e3c6a01f7295a18b1
-
Filesize
539B
MD59268773314dca7cbe31926d979ebcb84
SHA1b74f98ad436861aa35033dcad57a8ff719484ca3
SHA2565dabdee42a369b23aa8c721e04621f7de570425bb31a9a65a674b1ed1bc1603e
SHA5126ca8f4e5262d1afa3e5ed667f8b9b99be62cbf9a3f4ece8d8704216ccb6713bb9031618074eb07c4970df7badcffa42c0ff1bd70011ae7bc0479a12fde371d93
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
9KB
MD5173791cdc0b7f86b8d88c18acacea69a
SHA15529d716b3ba04af6cd7a8eebf89d4ff94bed613
SHA256e3de45a443da2b846af878b23cbbc0e33bf9100263cedcd2c478126c75f2cb44
SHA512bb79ae3c073b51b978bc90d7f77c874b76b7c4ae99ce9ac777f46ecc18a0b34ca35f920a677ff8fdba3cf78e0ce9a4142567384bb392143bfecb2421092ef30f
-
Filesize
12KB
MD56079689e6904e262b5465f0332405a49
SHA1ec034855a6a5fe646aa2ea6634812fd9962bf8a6
SHA256e8cb2324c65ca76e15eec6ca20332e806d8266f8c822ae9482eff7c154b94654
SHA512a2570747ddccb1cbdd8f2eac29e2be96466b34744b9fdbd154a6e6f8ed29506ff952ed63f366afb8256a512228cc4b285fc9b1611dc3d69f93ce519efef8b4f2
-
Filesize
12KB
MD5e949628ea6d8c919acfddb5ec3ba4d9e
SHA146b75d91ed69a6c04c38adccf704251ceb82e104
SHA2568e3a3a05c88708388bfd2abd313994f181f591f01715b1a9c9ac966efde87939
SHA5125be23d86126ce15e435cea3c1836a2998279f56d1f50d54dc04f4c747e1336837009a4010af0c56c8a6c2c14c7326378a1c1f31dd0d6c7968ae1d8aec8868870
-
Filesize
12KB
MD588bac66da10ff610e835859e08416e1a
SHA11c61b63403a572a87671f1be1a1fdea285b1f8e3
SHA256708c6b24ea30310f254d7d8625ac5ba06de7ad98123151c034ef6a6b4feb98e2
SHA512524d64b88b33b71a4c2904d8ed12276638e6dc28f763e37fffd4932d86775b08320486399e41c71d742bfb6462b4467414ff7f21f53c95f4d6ca3a94d0a7e473
-
Filesize
13KB
MD5ad89f926d88598be67d5ab1f89142bed
SHA1d5be735005a943861926e869aaac7519c98b4b54
SHA2562ededc7acc82b00d6c818043ad2d2725abcd42fd39212280335f034bf1568e02
SHA5128b8f64fce4181b82901ca01d104ae29189a5e6e1f9ee0b12207a403b2a370c98fdc89bf401b74c1c126e159dc5e916242c1b58a97e15ea45795588d16386f8b7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5f77f18fb595c6a79be877eaa56f6c6c3
SHA166f3eea46c28b266636b9c5f160164aab0407b39
SHA2563ea974b8ad587cf29906985c2d669551b5ca0b319f917aeacfd1215f308d8049
SHA51263f7dcd28ce1b26d6b0f77144078506cf4cd8fa5acfe98c7a70a47548582aa8cc217586802f02dc14d6e54ff56236b74060ebb570bac9cc4260ed231dc8cefe1
-
Filesize
1.6MB
MD5a7a5c04005c17d1fa983f835cffbd183
SHA1c79fb9d8fdbead904459bd9d1ffadf6ce43c9374
SHA2563494f9352c5bd48f55caddbbb63515f8058763e28f8e5f8fa5411a5de835ca8e
SHA5129a7aa97489f376c2cb4864c2d4f6a41978a25a5f0171c30077ceb4302fd58e5823f199f0dcf89f57ec48d31ebfbb01a8d258a1e7d0b391b7ac613bba6f2a1cee
-
Filesize
9.7MB
MD55a0901dfdb36813e50f9a779a6841d1f
SHA1385087aa72b713cc19190c7d364062020dc976d8
SHA256c1eab41cfdb38cb9e3c7dab2bcaa8f80aeeb7a1d17485853c6d9624ef6a44185
SHA512be4d7cccca684f7e45be473f23d7f42bf9bb1c110250207aabbc50abbb204ce7758e3cc732215f6c9f9ef20d60ed05605f8e6afe923390aa31b288dcd55e1642