Overview
overview
7Static
static
3d618921099...a0.exe
windows7-x64
7d618921099...a0.exe
windows10-2004-x64
7$APPDATA/�...�!.lnk
windows7-x64
3$APPDATA/�...�!.lnk
windows10-2004-x64
3$APPDATA/�...�!.lnk
windows7-x64
3$APPDATA/�...�!.lnk
windows10-2004-x64
3$DESKTOP/�...�!.lnk
windows7-x64
3$DESKTOP/�...�!.lnk
windows10-2004-x64
3$FAVORITES...�!.url
windows7-x64
1$FAVORITES...�!.url
windows10-2004-x64
1$PLUGINSDI...RL.dll
windows7-x64
3$PLUGINSDI...RL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$SMPROGRAM...վ.lnk
windows7-x64
3$SMPROGRAM...վ.lnk
windows10-2004-x64
3$SMPROGRAM...�!.lnk
windows7-x64
3$SMPROGRAM...�!.lnk
windows10-2004-x64
3$SMPROGRAM...�!.lnk
windows7-x64
3$SMPROGRAM...�!.lnk
windows10-2004-x64
3155�...վ.lnk
windows7-x64
3155�...վ.lnk
windows10-2004-x64
3CI4.exe
windows7-x64
1CI4.exe
windows10-2004-x64
1bass.dll
windows7-x64
1bass.dll
windows10-2004-x64
1gamedone.html
windows7-x64
1gamedone.html
windows10-2004-x64
1newgames.html
windows7-x64
1newgames.html
windows10-2004-x64
1order.html
windows7-x64
1order.html
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
d618921099f3913b985beb1550eeb3a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d618921099f3913b985beb1550eeb3a0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$APPDATA/ȫַ!.lnk
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$APPDATA/ȫַ!.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$APPDATA/Ա-!.lnk
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$APPDATA/Ա-!.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$DESKTOP/Ա-!.lnk
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$DESKTOP/Ա-!.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$FAVORITES/Ա-!.url
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$FAVORITES/Ա-!.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$SMPROGRAMS/Chicken Invaders 4 Ultimate Omelette/155ɫվ.lnk
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$SMPROGRAMS/Chicken Invaders 4 Ultimate Omelette/155ɫվ.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$SMPROGRAMS/ȫַ!.lnk
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$SMPROGRAMS/ȫַ!.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$SMPROGRAMS/Ա-!.lnk
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$SMPROGRAMS/Ա-!.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
155ɫվ.lnk
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
155ɫվ.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
CI4.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
CI4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
bass.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
bass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
gamedone.html
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
gamedone.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
newgames.html
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
newgames.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
order.html
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
order.html
Resource
win10v2004-20231215-en
General
-
Target
$DESKTOP/Ա-!.lnk
-
Size
500B
-
MD5
6d5e090f3cf01999d9921ae2f9ed5b1b
-
SHA1
43bd9e6cb19fdbe394f982ee64d5585c1b4b3d87
-
SHA256
22ef9ca32e153a7093377dd10be2fa2f6eb5367113866a71fcbda6d3bb6aba1a
-
SHA512
f6b0757fe9f7135137be9718384655562f59122413fafd486a51aacd21433de3f55dfec2465f331c802821ffeb3c61fee63cb355c2a9fd93976b930fe981b683
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3552 msedge.exe 3552 msedge.exe 3872 msedge.exe 3872 msedge.exe 3524 identity_helper.exe 3524 identity_helper.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe 3872 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3872 2180 cmd.exe 92 PID 2180 wrote to memory of 3872 2180 cmd.exe 92 PID 3872 wrote to memory of 1704 3872 msedge.exe 94 PID 3872 wrote to memory of 1704 3872 msedge.exe 94 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 4332 3872 msedge.exe 95 PID 3872 wrote to memory of 3552 3872 msedge.exe 96 PID 3872 wrote to memory of 3552 3872 msedge.exe 96 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97 PID 3872 wrote to memory of 2644 3872 msedge.exe 97
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$DESKTOP\Ա-!.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pindao.huoban.taobao.com/tms/channel/channelcode.htm?pid=mm_10066594_338505_8836640&eventid=1013292⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb407346f8,0x7ffb40734708,0x7ffb407347183⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:23⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:83⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:13⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:13⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:13⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:13⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:83⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:13⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:13⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:13⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:13⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:13⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:13⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,6245861563305314076,7456502675470505450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5592 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57740a919423ddc469647f8fdd981324d
SHA1c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA256bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
SHA5127ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
-
Filesize
152B
MD59f44d6f922f830d04d7463189045a5a3
SHA12e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA2560ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
SHA5127c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
-
Filesize
6KB
MD5ffc42b0d09c01a60d2780d402dc2ba01
SHA1687b9130b4aa492051108cde0ee7d4b4ea2b7bf8
SHA2568e2147dfe1d67f354070c7376ae0e8efc660ae9ae95526b27026c9de445e33b3
SHA512949ea6ee3558351cc6b99424a7b4863028ac2af424c5328b341ea8edb9d9ce04273eef98a4573f8978ee255379e33f3c256b84cf6975ce04c41f744e1b2df9e7
-
Filesize
6KB
MD5f5048b902566c793d4113f20dbb61497
SHA15dcd1efb326ec0e53f6025d7a6076a6772d14e50
SHA256bb2e7b896a92f4a6a3e995d9f7159d02321ab9603395673ec4af95dd86024f42
SHA512b6da3e856673a230c4697f54142ee1de629a6228e47aaf226f93a8afc43a30ca863049da1b57871e10e61cc885defed25f8881518d01fb9d1359ad9d9217a1b5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5cfaf741ac71ab17907ca954743c05448
SHA1de1fb8d785b7bac54551fd66eabd74c1e7219643
SHA256df6e65499bb5643f9bd77d94ee4c830f909b75057e16ba08b18f00aa9e343cd7
SHA5121819fec66325aea43b50547c03f25eb90d5a0c2c3dc203d904d3e39d20118b2cff9859169a495e79ffe7db2f09680187d106dddf08d0ae00dd8a9df6c3b4ebbc