Analysis
-
max time kernel
99s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
CustomRP.1.17.22.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CustomRP.1.17.22.exe
Resource
win10v2004-20240419-en
General
-
Target
CustomRP.1.17.22.exe
-
Size
6.3MB
-
MD5
fe6ac7ec692ea6a41c12a5b96de2b5a6
-
SHA1
8a1bfd9276b1838cc859dfd443a3ae8c63c7ddbc
-
SHA256
99a13b46fc5ec89169132f3ec365c77eabcb31ea07efab203c7795da948b1774
-
SHA512
cff9b7918e3f98b5709f8fdbc87e9ed12b026360b231e8772512e66c67f28826e7e3cad23fa16d8baeb42821464b26015f63737a8982128fbd49aecfc75ccb27
-
SSDEEP
196608:O1TeFQbXLA+GHUe/gVyikWTAgO5KtTHCx7h2:cTbcBH74VyikvgOot1
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CustomRP.lnk CustomRP.exe -
Executes dropped EXE 2 IoCs
pid Process 868 CustomRP.1.17.22.tmp 4212 CustomRP.exe -
Loads dropped DLL 25 IoCs
pid Process 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe 4212 CustomRP.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 26 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp\OpenWithProgids CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications CustomRP.1.17.22.tmp Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open\command CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe CustomRP.1.17.22.tmp Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" CustomRP.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\ = "CustomRP Preset" CustomRP.1.17.22.tmp Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\CustomRP\\CustomRP.exe\" \"%1\"" CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\DefaultIcon CustomRP.1.17.22.tmp Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\CustomRP\\CustomRP.exe,1" CustomRP.1.17.22.tmp Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" CustomRP.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell\open CustomRP.1.17.22.tmp Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe\SupportedTypes\.crp CustomRP.1.17.22.tmp Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" CustomRP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ CustomRP.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\.crp\OpenWithProgids\CustomRP.crp CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 CustomRP.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" CustomRP.exe Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 CustomRP.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CustomRP.crp\shell CustomRP.1.17.22.tmp Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Applications\CustomRP.exe\SupportedTypes CustomRP.1.17.22.tmp Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 CustomRP.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 868 CustomRP.1.17.22.tmp 868 CustomRP.1.17.22.tmp 960 msedge.exe 960 msedge.exe 1928 msedge.exe 1928 msedge.exe 2996 identity_helper.exe 2996 identity_helper.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4212 CustomRP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4212 CustomRP.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 868 CustomRP.1.17.22.tmp 4212 CustomRP.exe 4212 CustomRP.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 4212 CustomRP.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 4212 CustomRP.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 4212 CustomRP.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4212 CustomRP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 868 4892 CustomRP.1.17.22.exe 85 PID 4892 wrote to memory of 868 4892 CustomRP.1.17.22.exe 85 PID 4892 wrote to memory of 868 4892 CustomRP.1.17.22.exe 85 PID 868 wrote to memory of 4212 868 CustomRP.1.17.22.tmp 90 PID 868 wrote to memory of 4212 868 CustomRP.1.17.22.tmp 90 PID 868 wrote to memory of 4212 868 CustomRP.1.17.22.tmp 90 PID 1928 wrote to memory of 3552 1928 msedge.exe 103 PID 1928 wrote to memory of 3552 1928 msedge.exe 103 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 752 1928 msedge.exe 104 PID 1928 wrote to memory of 960 1928 msedge.exe 105 PID 1928 wrote to memory of 960 1928 msedge.exe 105 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106 PID 1928 wrote to memory of 1052 1928 msedge.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe"C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\is-ETD7S.tmp\CustomRP.1.17.22.tmp"C:\Users\Admin\AppData\Local\Temp\is-ETD7S.tmp\CustomRP.1.17.22.tmp" /SL5="$F0060,5486258,1081856,C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.22.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe"C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4212
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ff985c446f8,0x7ff985c44708,0x7ff985c447182⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:12⤵PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,7395974196921804020,8530999183146388952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:2368
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
6KB
MD5a9f3d539c9d8ef56c9d56c281207c520
SHA11bb2848d712fb41d59e5f206e7cfd9c8f5ead12b
SHA2562824934da6d468017e047099be87a40bfbe9c8584d41a0b9c5e98eb0f2267913
SHA512d3d37c39c5964d856355dc78fdf5ea1017bcece0f8335632ab65a0d0e586df966ba9aa4c79b127b4ecd2017105da305db965a10b7b768abfde9130b4104c2cff
-
Filesize
6KB
MD5d0140d44ad4a8964ddb6d9643998e3fe
SHA1dfc653fcf3f2820f657eaa8a28835456a9f17ab5
SHA25640de60bedbb00a783c6380cc1c780c38d3ab1a76328b5248efe57dbd41cfaf6a
SHA512d3b1fe326987ff8590048f948b5f5be731cc6deee6181de0652c2e3cee6e1787bbdf48f0b010f8d322b2a4726f1b42745717c9d89491a2ebd4e9a9dc0285341d
-
Filesize
6KB
MD56285f0db590b7844811cded949cf63dc
SHA1d4bf2080ee854148ee5104bfd434168e5c533901
SHA25684f5599a7311714cdd68904a4588c14a3c2d7f83751e1b6e760a9756706a6831
SHA512b95c29c81c843ea3f5af57a9d84ba8aaa83a58a42c773eabd70c78b7c63c7a1c2600da1f28f69874b9a3c68613e2b79f31f97b9cd403e16926eef2dfcf67f167
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5fddeb5083332a17d1fc09cf6894344df
SHA18cbd987ee0c9fd3c617146bd7a352c1cb59d9608
SHA2560e74f0255517ca7175d2ad7526cd53e1ffa2722fc53af276fc45830f9e8b5695
SHA512f1d1b49f76a916763e78d7201932498004f0f897071847cf7d1bbb35d5062f381e0914930e2016f360ba9be8228e2c00f08b0ffc524aef7ceeecc166b904c165
-
Filesize
8KB
MD57e889f15b3f844a031b98d1311af4157
SHA16c3a266a98fc6dd8f1dfb3a1ca06ca32aadfa609
SHA2563da1814969d2d1860adae86f94ab4b5eab6327db33416131adacbe53b39dc601
SHA512f69912e61278be82b6cf7a562dd0d4991e5f254716ad2ed0e1a86c1fc5844087912fe579ef83868a1961d561161363a6defe5d15be4cb7002c2c0a2460207fa6
-
Filesize
3.3MB
MD54c84ad73c9fd6c0d8590e40be75a7117
SHA18285d51da90a963e5e6002e3d2fc1b735a9cdf83
SHA256a656e1ba87b2fcc64dbbb9fabf4c486ed85162187b529587bdefd5e37fca6a51
SHA512e996e4f718ddbbfdb225e643a028d13ff0a6272da12570ef76cc30f5051007ac2b4084702170215bff37c28e1288340bf7752553d00a143fd9182ea0e3c431a7
-
C:\Users\Admin\AppData\Local\maximmax42\CustomRP.exe_Url_r15q51hssngmokjllmk3xsx1r0qzuwow\1.0.0.0\user.config
Filesize453B
MD55e29d3432a03230ff4221c385be12138
SHA1591c0e6bb41588dcebe7b94b82fcccfd1126e661
SHA256fbdf3ca7933fdbac1bb082bacfb043f3b7b2669babbcdd33176ca60877ca29ea
SHA512472f4bcd76e6d69c219a3ccca2f21ee522c7c98685361a7e77324b18a5adb8a9b7814781c1b2f2da68032b025d71a22987bc758c9487b1f18c5f68309b8cce50
-
C:\Users\Admin\AppData\Local\maximmax42\CustomRP.exe_Url_r15q51hssngmokjllmk3xsx1r0qzuwow\1.0.0.0\user.config
Filesize957B
MD58b6ef5ae2a9f025e086a656e1971b0d1
SHA14387cb230ce1963a4347d9b603e633c6abca633b
SHA256a15c7acdd7c4545e238b1ec6e9aa8ddc7f3ef82cbf14bf878ac08ae90f3c1a20
SHA51252a85406c63415f46630ae9845a20fd49477566bd27bbf819d822b44ef71f4ff7d8421e163ab4e4eaea1f4eeea1a9c0587e7c69c18b355fd47f5d86620bf07bf
-
Filesize
147KB
MD5e39cd45b2e0390c91b34651c7dd0f7d7
SHA1172a00f49e8ddb413ade56d46d10c59830ce9c69
SHA25647c9f22684bae6afd08cdcca386edf8b47fa5e2a749faeb6499dc4b3ca6e5642
SHA512fd25a41efc0e301049b8b19a7b3fc6122cf187045a32514396603a9ba4305a74c115041583fe86b2b581b2523107b2bd440c9a0e3a1b4d96b22ef632d607ae1d
-
Filesize
1.1MB
MD5ba03dc0b6e56851842b80b223e54e671
SHA1917eb9d5d7ffde4674b12dcaf25d305b3112a927
SHA256333b7d4280c0e6cb139c1d4d1e5dd1b7038540dab7d7f2750bb531605a958290
SHA51250419c331538c023be0a4f3b659e8dc808ffa94b34a24ffc52aa08020c57427581999133d014b37fb526227756f753011d523d75a2d35751eab9d9eec7fd0aa2
-
Filesize
4KB
MD5b496e0b64ad960a0b13327a350ed89dd
SHA1d84f215a7c6766c60bb27fc59bddafa6069830e1
SHA2564691bf30db39d0cb27f0608e1c01de7865b9e7175667899c0dabc57b91908afb
SHA512b548343b0188adb3c75557722c35d086365ac0a091bef8164a1ee3e52bf7455edbc17fe1d3297e8da117527afa8639de19aa10c875cacd644b5c13725d0727a7
-
Filesize
82KB
MD52e9f2a132f59cde7f3a888f5fa674cfc
SHA1441271e6e1c2a65eb43ac8a76be8d7bf5f0b9a00
SHA25684ef313d2525da8006167fdd8b78556f5038bf1571e3201e619b3d956fe6d842
SHA512dd420ed1cfebb181c5706ebda1f88c267a40a158b5d22a6bea54710add2cee395a6dd67e9e04c96b387db791aea84ea3b124db5e424d8b3a2d5f1b807856534d
-
Filesize
25KB
MD54f0eeea40634e091b149e22d098f0084
SHA18426f3f5a89dd8a32e07c54362a523825cdd4361
SHA25629ce7dd433293977386ae132e3a72b60bf32559f5b56b555166b78953212743e
SHA512415fe0ee2a36ae51420f11afb9d127bc41fba899274be097674059e5b50fc2a5ee206779160191c3cfb2a24f0c4c8799072ab013adae6a557754883066ad847d
-
Filesize
52KB
MD51fb364c1d622905aebd6e57500c169d1
SHA15423fb63ab28a24e1fdef3616e5e0e3301dbbc5f
SHA25607125de19eb06c67010039448e898c7bb954d25cf0a77b05d95329ed575f24e2
SHA512ae724010f049989ec006ce71990073834f8d58ebf1133a589ec3de839acde1c07b136deaf9e237c3b5a3d216ea9dbbc5aaaf482df1b549ee786a7a2e27d6bff8
-
Filesize
145KB
MD5885481ebbec08fa817ada9a5f7a527ad
SHA1c9390ecd62766338584a0ff45c71d6abd64db379
SHA25682e14d7bada761bf353929163bde2cf5c12e41727937ae5f0c7314fcee8be029
SHA5129b2a24f9d30886321e5961d5bd59377a4500bc5f9de23c5a217e94087a8f8742e3754cfaae8d93c6d3bdf7d6b1fa578a103bc6e98571bd201e1dc9564d38ed39
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
1.3MB
MD53348408f1304e3527c7cdbb21194bdfb
SHA14a90269be013d2bd5bb9fbee5ab4cc5bb21dce51
SHA256609fe5f2d8fb3ee6ccec30c5d355f4d97e89ec3d285b3ae7912d0d1477368a8e
SHA51283afe8465948e448bd9f938610718d762d5eb3793035ceb5f3bc6348107bf0313cc43ff563016e205e2f976962fa3fa7eca71fe8c1d6c880ae812ddf84028d45
-
Filesize
11KB
MD559e7b8c38944a8d591363fb5874dc971
SHA1fdfe99922a4e9aba60ed6b1859ed331bc5940faa
SHA2564ed2707cc2644d63bbd27cf39840aaa4a8617b6b275008f031e16d3a76c75e4b
SHA5125d2d3e138588352267ee8f21d02f7ee6dc9353ce4a22e9fcac56e0016bfcb52ffeb4c530dbd5c6d8d1e2fe0855a50fa909c0b3129eb4fb8e13376f4bfc684f9e
-
Filesize
49KB
MD55e45fcc43a6a54b13e1d384c3c6c6e85
SHA16b54a3602f37ec3b3204914c58fa53f6453ccd3f
SHA256f424dc7b2ac7172e3041ac567603a0cea940fbfded8a2a8df53b2aa22d445da5
SHA5120bb27e39263b2cac625761aeb0db80e4cf43b10573cd8126b250620f82be8508cda948f4dc23693956b39db0af4628f11abd5e28b5b8c6d7a024cf5b30fc7b3f
-
Filesize
63KB
MD5359189a6345d70dcb4703cd4b75b5be4
SHA1afb93196574037c1c84a16892e57766097d579e4
SHA256408749d563fcea1d444ffc35069cc0f9db4c7d10636e08c522b06368e90b5834
SHA5129f729288d4953413abff0884cb88944b579adbb2ea43d49eeae560d0992ee71e9ef072c872e7edf22235e924ad4fbf41ddc063ad4858704cff4cb3166b7c7a22
-
Filesize
138KB
MD5f09441a1ee47fb3e6571a3a448e05baf
SHA13c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA256bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
SHA5120199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
-
Filesize
16KB
MD5da04a75ddc22118ed24e0b53e474805a
SHA12d68c648a6a6371b6046e6c3af09128230e0ad32
SHA25666409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
SHA51226af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
-
Filesize
1.2MB
MD5e52a4a0a6f61ec95aa51d8ffd682b72e
SHA16a3529c7ac873131a766415879b20925ff404b64
SHA2567dd2e2923e9a988866d969bb5a76a9d3448a11a0f225b83c734161977db564a5
SHA5120e91687ba8b36cc0a7019ba1bd819f538cd55649914319a074669b7a04fdc9a195d36ba1fd5eeeb6149bffdf46e6dccc6e8d4b8e1cce62aa13463f9410423883
-
Filesize
983B
MD5af507d37923dbc97d36923c9001c4e5e
SHA1049e3ef2aeef473f8746a18e9af72a03b3e26af0
SHA256caf697fa842cac3a13ef716efcd44f4c7c1dd54596f2a113f15436fb18f5d43a
SHA512d228f065c5ac60200fea49f657185a745d48245735c37b64ed9fd035435d3d9b4b8cde59d0585ffceec00e2f88c17f99df0e99eb014016347d193010c54e7229