Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
-
Target
c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe
-
Size
131KB
-
MD5
9ebb6422ed10fb799b45e4c9bd7eb41f
-
SHA1
1f8925ddffbf932d421bc1bfd7b45f46c154bb02
-
SHA256
c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746
-
SHA512
c294a9d363dc9dd360d7838bb9662c560990bbd08e5b9166d099ff4ad5323c0d673472d092727909f046c118810841be79d42875bd4dc6a024f9e2276d41f684
-
SSDEEP
1536:/BFsrz8VuJlMXaDuiNbR8Bftg+9t/p4QAILJuCOPdvX/ZWOtnGWxlP:/Bo8ulMXaKvvgmJAIlwPxX/ZWOFrb
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1288 Logo1_.exe 4672 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe File created C:\Windows\Logo1_.exe c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe 1288 Logo1_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4672 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 4672 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3000 wrote to memory of 220 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 90 PID 3000 wrote to memory of 220 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 90 PID 3000 wrote to memory of 220 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 90 PID 220 wrote to memory of 3212 220 net.exe 92 PID 220 wrote to memory of 3212 220 net.exe 92 PID 220 wrote to memory of 3212 220 net.exe 92 PID 3000 wrote to memory of 1060 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 96 PID 3000 wrote to memory of 1060 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 96 PID 3000 wrote to memory of 1060 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 96 PID 3000 wrote to memory of 1288 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 98 PID 3000 wrote to memory of 1288 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 98 PID 3000 wrote to memory of 1288 3000 c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe 98 PID 1288 wrote to memory of 3812 1288 Logo1_.exe 99 PID 1288 wrote to memory of 3812 1288 Logo1_.exe 99 PID 1288 wrote to memory of 3812 1288 Logo1_.exe 99 PID 1060 wrote to memory of 4672 1060 cmd.exe 101 PID 1060 wrote to memory of 4672 1060 cmd.exe 101 PID 1060 wrote to memory of 4672 1060 cmd.exe 101 PID 3812 wrote to memory of 396 3812 net.exe 102 PID 3812 wrote to memory of 396 3812 net.exe 102 PID 3812 wrote to memory of 396 3812 net.exe 102 PID 1288 wrote to memory of 3236 1288 Logo1_.exe 107 PID 1288 wrote to memory of 3236 1288 Logo1_.exe 107 PID 1288 wrote to memory of 3236 1288 Logo1_.exe 107 PID 3236 wrote to memory of 556 3236 net.exe 109 PID 3236 wrote to memory of 556 3236 net.exe 109 PID 3236 wrote to memory of 556 3236 net.exe 109 PID 1288 wrote to memory of 3520 1288 Logo1_.exe 56 PID 1288 wrote to memory of 3520 1288 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe"C:\Users\Admin\AppData\Local\Temp\c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED9C.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe"C:\Users\Admin\AppData\Local\Temp\c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4672
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:396
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:556
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:81⤵PID:4272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD502569885e9369db7f7e10caf1b50ba83
SHA110a6f75e80a9f81aa4c6143a31eb419ff252c667
SHA256f9fbd769b3a8bcc2a77241fa76adb574009dd443f0ebe5913450e2e9f21d87da
SHA512d18ea18d470cde35ac5f775b8f51d9d0bbaeea64312a30ea4ed7261174cdc3c8ac60e8f205004bcac90c937fa732851d3f5bdf5dde3417b624f1ee24e87640c3
-
Filesize
577KB
MD59cbfb2d8b810369151a70b6dafc00e6c
SHA1a2bf7f5855a85a1695ec368dbf3df646e56830a4
SHA2567e6e527caead164cd59d42d0efd2ef46f1b4836cc1eee682ce73a996cf086619
SHA512761e3dd7f8b80a0ccf0380a9f875b8334249ad7fec9d44930079bce193c489dee7f8130d578f987eeb98c3ab38757d12f0e61c532c7d83af1e60981f88e4b018
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD511e0853d537d2721ecc655c1fc527e91
SHA1c8e23d103e93073ba7c93374878ae9a9f926c944
SHA256f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30
SHA5123e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2
-
Filesize
722B
MD5bf0e8bd1e4305858caec244db11e65d4
SHA1fd3f59e06bc019672761a08c7a24e374698fea63
SHA25653592dd68c271cc73f53fe6e20160e14d2b411f71109a5dbc76484bffca5d124
SHA51257121e0dd9857358c56a459c3e07638868a289ab289eddc7e5fb87626950bf07e90a328771e3cc6b3680af3ba01100ead8899568ecf957a689e144d1a2965a05
-
C:\Users\Admin\AppData\Local\Temp\c764b532fe0ec439306cfc1f9d9b9e8a8fd98c16fe44808290660eab63975746.exe.exe
Filesize97KB
MD5713a30695b671b6e3b19b7d09f9d8409
SHA183916537c86d7dc1043c752f195f04fa42813afe
SHA2566b42e2e9822b99f5f13a6d1f639fa64cc93001266ceb7a7d342da1bce84d5c08
SHA512a450c691e0c8d16519b418b366a260360a57e8511c6975f2e3029c41f30a68d83448126c3d57c9fb36b3a44e839d4bbcaa73e0adfe305a71e04def2fd990cbf7
-
Filesize
33KB
MD5e88b528305eba2eaa41bd67d5be2f3e9
SHA146ab8f327b9ad592d6b6e2786ff0c5a5735acbfb
SHA2568549f3ecbe5d5d917c87472123a8ffc41b19b52c94b1fbc7089a971436dfe5ae
SHA5128437f856ced59ed9edb400139bcc5bb083164c52fd843d058d94bd40243b3314af75e3fd18380708561a00a80c7160153a40e768c493f08ea4afc102357252e7
-
Filesize
9B
MD5e850d9ceb7ebcc619d731dc2f1377b2b
SHA1a45553c9057075c02e28f90d5e8ea57a0dddbacc
SHA256b682a6e85069777ca22f84b99607acd09640eaa80029d74363c0a5aabddead4c
SHA512be92bd8393d0fe69559ec55e1068fcd77ccc699361a9cb98d467bd51a029c371852b7a1196ad53fa8865e956582e6a4d35f6ac6fea3832058b7a427133b0048c