Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe
Resource
win7-20240419-en
General
-
Target
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe
-
Size
2.5MB
-
MD5
2f265f6b8a721b41ad2ef2bd1c530365
-
SHA1
0b7d8c41a38562dca60f5cb837c1bf994fae06d5
-
SHA256
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0
-
SHA512
50ca22ca062bb69d1e420f448a31dfa1d15980156a08b779206a25ef1ad5be5fe8ed17a5f6f7b803e3fe9cda4b6eec990b78ea404fd6704813ab50b0fa5e835b
-
SSDEEP
24576:gNBYdvTgBJ0o9kTdjKq8M2XKdDrGnrdEROGHOhkkQJCtHYX6kC/hRJHOh8Ck:gNBvq8KdDqnroHOHQhKJHOvk
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exedescription ioc process File opened (read-only) \??\L: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\N: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\R: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\W: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\E: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\G: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\V: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\X: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\K: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\P: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\J: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\T: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\H: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\I: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\M: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\O: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\Q: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\S: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\A: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\B: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\Z: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\U: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe File opened (read-only) \??\Y: 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1520 msedge.exe 1520 msedge.exe 4692 msedge.exe 4692 msedge.exe 2760 identity_helper.exe 2760 identity_helper.exe 5196 msedge.exe 5196 msedge.exe 5196 msedge.exe 5196 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exemsedge.exedescription pid process target process PID 2328 wrote to memory of 2572 2328 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe PID 2328 wrote to memory of 2572 2328 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe PID 2328 wrote to memory of 2572 2328 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe PID 2572 wrote to memory of 4692 2572 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe msedge.exe PID 2572 wrote to memory of 4692 2572 8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe msedge.exe PID 4692 wrote to memory of 3464 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 3464 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 4104 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 1520 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 1520 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe PID 4692 wrote to memory of 2032 4692 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe"C:\Users\Admin\AppData\Local\Temp\8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe"C:\Users\Admin\AppData\Local\Temp\8d4be3efb5f21804ca91a82c85dfcd79294e4ef90e6be71c1b4daae56c90d0f0.exe" Master2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.35my.com/3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe890c46f8,0x7ffe890c4708,0x7ffe890c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8132279148326450022,8439383126050404373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD5c27c36e0e53a5d463d45fb0d85a2eef5
SHA16b4fcd0b4ecca6b88085f6164a4940fc2aa73053
SHA256fcfffa36c46d98a801a73be7fb54ef096d383ee53b6ea8e62422ad6fa39d5044
SHA512e19264046b61cdcacaf876071c9ea1994dcd2927827ddf5f9bb420e4dcacdf985013a21608835eaadb5bd542d971b4067a1dcd9e700fcc308f56fb72fb3e1f11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
250B
MD5207b1fabd04f8212bc8990d2797e8a06
SHA186ecc9a76b68eb38481f1a153c492929c48f7594
SHA2561f162a52c464e59a250c3c29255619616bbb1ca71889dc8139a8907c9bbb2cf2
SHA5126247a2382c5f68f1dbad2ea6317f6b086f7aaf451b85abbbaefe91333198f70c402970fa5af9e8e868c07d5d6fe1108c7bd60a6a5dc462507fc53f37ce32dd82
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD59f797deeb3e55ecba0151e2434e0bf1c
SHA192926aa742afa99223ca4673f2ae42b4fe3e2ee6
SHA256d497110175da2928864f2ea848f1e3bca01804c2c3d0c61ba307d01d8e1267e8
SHA5124e56b2efa415709c9346cda57ef430776f22c8e77609e815e79052f0674bd9661b7d8e5bcff3de2d18b140910679a35137c5dcab48ec0d19752760f6e67e29f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5b38426b862495421d37613660bc64f47
SHA189d8cf845165011b90b68b1f1dd4912ff29dd808
SHA2568861f87cab9cb62a066ff5838f579f6c0b386345def0f1aad5298f8ef63ac042
SHA512c8cd9e8e2fc7eb488a9272b3d08ed6f4a2c5764e964b7e7ae9bdc6e26755e998e8fd6220a94327f66d0b917f1faf1c9d7fc5ee21a396381d3b9e7b6b0ba72843
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5375f266373115e5842270c6dc970207f
SHA1a7cbe3c1bd192cc0e1bff75519d4e1f2285944e0
SHA256cef7bffb25e7d8ab80918181ef63e584c0d2415701aa374fe2c6146bf0853b3b
SHA5128e4f8d64835154d367d17a57d086e2576c3a1dd850d45154cb7c09cc1d13d19d3c863d8ab571dfc486d97dd00dcf6621e34c3837066b6c0f03d51ec6a3f7978b
-
\??\pipe\LOCAL\crashpad_4692_EIWQFNNNOVZYEDLMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2328-0-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/2328-1-0x0000000000400000-0x0000000000691000-memory.dmpFilesize
2.6MB
-
memory/2572-4-0x0000000000400000-0x0000000000691000-memory.dmpFilesize
2.6MB
-
memory/2572-3-0x0000000000400000-0x0000000000691000-memory.dmpFilesize
2.6MB
-
memory/2572-2-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB