Overview
overview
5Static
static
3Lunar Clie....3.exe
windows7-x64
4Lunar Clie....3.exe
windows10-2004-x64
4$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...nt.exe
windows7-x64
4$R0/Uninst...nt.exe
windows10-2004-x64
5$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
Lunar Client v3.2.3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Lunar Client v3.2.3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
$R0/Uninstall Lunar Client.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$R0/Uninstall Lunar Client.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
General
-
Target
$R0/Uninstall Lunar Client.exe
-
Size
404KB
-
MD5
227c1f9fe7c7f6fb24a451a5ca84e722
-
SHA1
9c34be548c0b2affd930d05c1b315a5cbe9bca45
-
SHA256
bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a
-
SHA512
1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66
-
SSDEEP
3072:Wn77v00hEoDEtauTsqBGeQIfxqxAjDsksbfVl1snhl+l2L0Sa9/l7a4vZAzLmDVH:W740IEa+J+Rql1DKs2t0EyL+ya2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Un_A.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation Un_A.exe -
Executes dropped EXE 1 IoCs
Processes:
Un_A.exepid process 4524 Un_A.exe -
Loads dropped DLL 6 IoCs
Processes:
Un_A.exepid process 4524 Un_A.exe 4524 Un_A.exe 4524 Un_A.exe 4524 Un_A.exe 4524 Un_A.exe 4524 Un_A.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Un_A.exetasklist.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4524 Un_A.exe 4524 Un_A.exe 2064 tasklist.exe 2064 tasklist.exe 4888 msedge.exe 4888 msedge.exe 3788 msedge.exe 3788 msedge.exe 3796 identity_helper.exe 3796 identity_helper.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tasklist.exedescription pid process Token: SeDebugPrivilege 2064 tasklist.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Uninstall Lunar Client.exeUn_A.execmd.exemsedge.exedescription pid process target process PID 1896 wrote to memory of 4524 1896 Uninstall Lunar Client.exe Un_A.exe PID 1896 wrote to memory of 4524 1896 Uninstall Lunar Client.exe Un_A.exe PID 1896 wrote to memory of 4524 1896 Uninstall Lunar Client.exe Un_A.exe PID 4524 wrote to memory of 4504 4524 Un_A.exe cmd.exe PID 4524 wrote to memory of 4504 4524 Un_A.exe cmd.exe PID 4524 wrote to memory of 4504 4524 Un_A.exe cmd.exe PID 4504 wrote to memory of 2064 4504 cmd.exe tasklist.exe PID 4504 wrote to memory of 2064 4504 cmd.exe tasklist.exe PID 4504 wrote to memory of 2064 4504 cmd.exe tasklist.exe PID 4504 wrote to memory of 2768 4504 cmd.exe find.exe PID 4504 wrote to memory of 2768 4504 cmd.exe find.exe PID 4504 wrote to memory of 2768 4504 cmd.exe find.exe PID 4524 wrote to memory of 3788 4524 Un_A.exe msedge.exe PID 4524 wrote to memory of 3788 4524 Un_A.exe msedge.exe PID 3788 wrote to memory of 3044 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 3044 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 1916 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4888 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4888 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe PID 3788 wrote to memory of 4244 3788 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"4⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064 -
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Lunar Client.exe"4⤵PID:2768
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lunarclient.com/uninstaller/?installId=unknown3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e9fc46f8,0x7ff9e9fc4708,0x7ff9e9fc47184⤵PID:3044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:24⤵PID:1916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:84⤵PID:4244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:14⤵PID:4584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:14⤵PID:1168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:14⤵PID:3244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:14⤵PID:1880
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:84⤵PID:3056
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:14⤵PID:1176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:14⤵PID:2004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:14⤵PID:4368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:14⤵PID:4796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8348010637413317660,5757695281708607634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e71d66ce903fcba6050e4b99b624fa7
SHA1139d274762405b422eab698da8cc85f405922de5
SHA25653b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
SHA51217e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize672B
MD5f52b47cc8c15d6a0667a6e974a23a417
SHA12a7f4721c807da0216788302c654ea2aa6567b21
SHA2562a97816534461ce22ee401992443f1c513335a3889b066cabf29ecf0ae082f24
SHA5125855e8fc40a865d4bdd355997596758a153ecac5e2fb883d7e845d2f46ebad114997f7f9588a976d283cddd50e81412cea2e7d26813f05e2d937c4e3723ac878
-
Filesize
2KB
MD5ec1650f13b7f9c5303a3e8e50c02d8e4
SHA17fc2d618ffb3c44e3ffce71975a468c24723b3a9
SHA256b324352dcb704ca72e69ed319a20bcc426410b1b5ad8035fe5c51f81afc25278
SHA51284a2753374627520c3dd5a08c394e5f272b0c2cbda707808a9669727f05275bcee03a427e5cc5c53fb48f0025be4b2008caa90d86ca1587d6b02bfa5d50dccde
-
Filesize
6KB
MD5e4cb6f35b9d6d7abd0dc72e02dc47122
SHA1158deac3dcba24dc9cfa826fa04202e5111d3569
SHA256f6641b674cad0e6b4b0930e64f01e7c65fe4775220dae0b90fc909314d1971e7
SHA512f45c189063ab6ee6cce8e9c7b99934887340d623ba6bf47d7812bbabe740a774ac4cc00020f4f5407c0e99c05a45e27e195ca564470ea6cd064e1176634a6c09
-
Filesize
5KB
MD571ed16637662603b2ed3fa719d1149b9
SHA1afc7bf87c3c9cc95b18ae5a9303903433b41fb6e
SHA2561ea429a42b6640bb5d0eda151bda8dee903e0ba6b23a090b60fe863920ee90ac
SHA512176ca2c0380f9c3cab530b6725143e7e66079ae75741ccfea7eed65dea777d6b836d5d35042eb660339c5fa9f0bbe64b1ee105bbe52fbce75afb423554e469a7
-
Filesize
24KB
MD51b1b142e24215f033793d1311e24f6e6
SHA174e23cffbf03f3f0c430e6f4481e740c55a48587
SHA2563dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
SHA512a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD57460856310978e912a2dd98864b57117
SHA10126bb8a4b5f0b6265ddcce1334d517edd1064f7
SHA256afd16c8edb1fcc3efdd6c1826062f51b2a0998809955ddbbd8607d8d47e846ba
SHA512704611e43a72f7ba59475cbe9103813690eb9531367e05c3a5307fcac1be7622044922e7607db801407d3f6c3c0f5f4ef33eab308df65d40ae7dda0395e4b0a2
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
404KB
MD5227c1f9fe7c7f6fb24a451a5ca84e722
SHA19c34be548c0b2affd930d05c1b315a5cbe9bca45
SHA256bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a
SHA5121fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e