Overview
overview
10Static
static
3#!~#0PeN_5...re.dll
windows7-x64
1#!~#0PeN_5...re.dll
windows10-2004-x64
1#!~#0PeN_5...rk.dll
windows7-x64
1#!~#0PeN_5...rk.dll
windows10-2004-x64
1#!~#0PeN_5...up.exe
windows7-x64
7#!~#0PeN_5...up.exe
windows10-2004-x64
10#!~#0PeN_5...te.ppt
windows7-x64
1#!~#0PeN_5...te.ppt
windows10-2004-x64
1#!~#0PeN_5...64.dll
windows7-x64
1#!~#0PeN_5...64.dll
windows10-2004-x64
1#!~#0PeN_5...64.dll
windows7-x64
1#!~#0PeN_5...64.dll
windows10-2004-x64
1#!~#0PeN_5...40.dll
windows7-x64
1#!~#0PeN_5...40.dll
windows10-2004-x64
1#!~#0PeN_5..._1.dll
windows7-x64
1#!~#0PeN_5..._1.dll
windows10-2004-x64
1#!~#0PeN_5...se.htm
windows7-x64
1#!~#0PeN_5...se.htm
windows10-2004-x64
1#!~#0PeN_5...64.dll
windows7-x64
1#!~#0PeN_5...64.dll
windows10-2004-x64
1#!~#0PeN_5...40.dll
windows7-x64
1#!~#0PeN_5...40.dll
windows10-2004-x64
1#!~#0PeN_5..._1.dll
windows7-x64
1#!~#0PeN_5..._1.dll
windows10-2004-x64
1#!~#0PeN_5...ib.dll
windows7-x64
1#!~#0PeN_5...ib.dll
windows10-2004-x64
1#!~#0PeN_5...er.exe
windows7-x64
1#!~#0PeN_5...er.exe
windows10-2004-x64
1#!~#0PeN_5...or.exe
windows7-x64
1#!~#0PeN_5...or.exe
windows10-2004-x64
1#!~#0PeN_5...1].exe
windows7-x64
1#!~#0PeN_5...1].exe
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Qt5Core.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Qt5Core.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Qt5Network.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Qt5Network.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Setup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/Setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/borate.ppt
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/borate.ppt
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/libcrypto-1_1-x64.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/libcrypto-1_1-x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/libssl-1_1-x64.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/libssl-1_1-x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/msvcp140.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/msvcp140.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/msvcp140_1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/msvcp140_1.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/peptidase.htm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/peptidase.htm
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/steam_api64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/steam_api64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral22
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140_1.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140_1.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/AzureKeyVaultDgssLib.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral26
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/AzureKeyVaultDgssLib.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/BugReporter.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/BugReporter.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/ComExtractor.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/ComExtractor.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/HDHelper_[0MB]_[1].exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
#!~#0PeN_5098_Pa$$WOrd~!$/x64/HDHelper_[0MB]_[1].exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target #!~#0PeN_5098_Pa$$WOrd~!$/peptidase.htm
- Size 78KB
- Sample240603-1pcxtsab71
- SHA256 c8d313b1c520714895de27beff9100c783d6eed0f1a9e3d5f1ff8443d919a520
- MD5 5f6216146725ba101337f9a969335088
- SHA1 5a46fe4b781f37ae927635e537a75e079e80702c
- SHA512 5df926008cb0ae646e93f5c4e7c6ce1fcd972a2e8ddc4c6eefc7da2d5828adc4613dd8b4fb3eae2503743117c8f077734f52a5da9f0011ff1e520b796f703d16
- SSDEEP 1536:sf6392XTuorOl14PbX/WpDMlN21URz88iq:7N2XTukOlmPbeeP2Kh8k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 2720 msedge.exe 2720 msedge.exe 2272 identity_helper.exe 2272 identity_helper.exe 4708 msedge.exe 4708 msedge.exe 4708 msedge.exe 4708 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3760 2720 msedge.exe 82 PID 2720 wrote to memory of 3760 2720 msedge.exe 82 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4736 2720 msedge.exe 83 PID 2720 wrote to memory of 4484 2720 msedge.exe 84 PID 2720 wrote to memory of 4484 2720 msedge.exe 84 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85 PID 2720 wrote to memory of 2408 2720 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_5098_Pa$$WOrd~!$\peptidase.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe730346f8,0x7ffe73034708,0x7ffe730347182⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6859947646002330395,8028744292519130872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 fd63fc769653d031f02b51aaf467a80dadef21e15773c4e7dc51a9f9358c79dc
- MD5 3d381c5961359666e9ec58683da85e9c
- SHA1 44df38d8ce3b4d7f1f88f21c1106c027751710f8
- SHA512 12b553087882a1350ae7e3cfc796727512cffcdacae0cfa4f777a426a1689bd506bc94bcf3520e68a1d1da9c162598d2370cb5d1057745b9734a0af09c916165
- SSDEEP 96:nNAkMW1E33XwpvWMoiVmdeHp1kBbUWQyV+VDCziEwb:nNAk3SnXGWMXpAbro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 eb2aa87e11366b114b575fa49c334377660c44f855a0e3d53844312f081e481c
- MD5 f08396debc3e33694895654e5005df87
- SHA1 2a4c3a5de022073d52cd03af870d5ee5dd9dd53c
- SHA512 a00ea53c4694ad1437532543fdccd6cba6acd0663190a80e9abf7c346e0ebe9cf0e99197a2543821cb47ef78c383748d6ddd088c2c91eddb87cafc601841ec25
- SSDEEP 96:nNAk3W1E33XwpvWMoiVmdeHp1kBbUWQyV+VD7AiEwb:nNAkGSnXGWMXpAbrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 7469130fc9964157faed74a6f5fd0186a0a96f771603c483ef8c2ccfcc289a52
- MD5 616cdfff58f572f82a63dda894f91182
- SHA1 bb0d6862e6f262ac81dada7cb18b04fec4de2dfd
- SHA512 fbbd8064dd49455da9e66dcbebd022e9908df2cc92c4564a03e1dfc4bc007cc9950a222dace271311169815d2fcc90cc1fe2e5e057376f8fcae764367e91d3b6
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR7Ye2RUAo503z2OMDCRHqs:A9iIxuERzA83h09RZxYRia0aOMWRHqlC
- MD5 SHA1 SHA512 SSDEEP