agenttesla | 94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
Size 858KB
Sample240617-bj5m8a1fpq
SHA256 94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18
MD5 c8244e3dff6290672df69a3515edef77
SHA1 34c65364d87ebda3b8b3a1ec3fd0aba79e7e7fd0
SHA512 d1eebe452c36146566a7296dbe7107c82561e2c0008b7eab6aef9d33c4200697356c39f610a556dccf02c0f1a7bb2d99a1c98e66bd8f45c4cf5197afd3c22a0a
SSDEEP 24576:/EN973phvt8tmUdkw1xG8fFjGMaOnO+pwFL9N09PPA:/EN973PvEL2wHBODLcPo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral2/memory/4336-1-0x0000000000400000-0x000000000045E000-memory.dmp	family_agenttesla
behavioral2/memory/392-97-0x0000000000360000-0x00000000003BE000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	mighost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	mighost.exe

Executes dropped EXE 4 IoCs

pid	Process
3164	mighost.exe
392	mighost.exe
3436	mighost.exe
2804	mighost.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/212-0-0x00000000005E0000-0x000000000077E000-memory.dmp	upx
behavioral2/memory/4336-7-0x00000000005E0000-0x000000000077E000-memory.dmp	upx
behavioral2/memory/212-32-0x00000000005E0000-0x000000000077E000-memory.dmp	upx
behavioral2/memory/212-49-0x00000000005E0000-0x000000000077E000-memory.dmp	upx
behavioral2/files/0x000800000002340a-94.dat	upx
behavioral2/memory/3164-95-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/392-103-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3164-129-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3164-141-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3436-191-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3436-228-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3436-235-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	upx

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/212-32-0x00000000005E0000-0x000000000077E000-memory.dmp	autoit_exe
behavioral2/memory/212-49-0x00000000005E0000-0x000000000077E000-memory.dmp	autoit_exe
behavioral2/memory/3164-129-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	autoit_exe
behavioral2/memory/3164-141-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	autoit_exe
behavioral2/memory/3436-228-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	autoit_exe
behavioral2/memory/3436-235-0x0000000000AF0000-0x0000000000C8E000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 3164 set thread context of 392	3164	mighost.exe	116
PID 3436 set thread context of 2804	3436	mighost.exe	136

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1336	schtasks.exe
4400	schtasks.exe
1416	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
2108	msedge.exe
2108	msedge.exe
4472	identity_helper.exe
4472	identity_helper.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
3164	mighost.exe
3164	mighost.exe
3164	mighost.exe
3436	mighost.exe
3436	mighost.exe
3436	mighost.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
3164	mighost.exe
3164	mighost.exe
3164	mighost.exe
3436	mighost.exe
3436	mighost.exe
3436	mighost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 212 wrote to memory of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 212 wrote to memory of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 212 wrote to memory of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 212 wrote to memory of 4336	212	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	84
PID 4336 wrote to memory of 2108	4336	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	87
PID 4336 wrote to memory of 2108	4336	94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe	87
PID 2108 wrote to memory of 1208	2108	msedge.exe	88
PID 2108 wrote to memory of 1208	2108	msedge.exe	88
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 4280	2108	msedge.exe	89
PID 2108 wrote to memory of 1624	2108	msedge.exe	90
PID 2108 wrote to memory of 1624	2108	msedge.exe	90
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91
PID 2108 wrote to memory of 5008	2108	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
"C:\Users\Admin\AppData\Local\Temp\94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe
  "C:\Users\Admin\AppData\Local\Temp\94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4056 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10905314677269947189,12115585739727836446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=94ddb1a648a957a154e8a844170ed635c0994a74c202757162b6f5d7cea50d18.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:2920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3164
- C:\Users\Admin\cdp\mighost.exe
  "C:\Users\Admin\cdp\mighost.exe"
  2⤵
  - Executes dropped EXE
  PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:4356
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4400

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3436
- C:\Users\Admin\cdp\mighost.exe
  "C:\Users\Admin\cdp\mighost.exe"
  2⤵
  - Executes dropped EXE
  PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae92846f8,0x7ffae9284708,0x7ffae9284718
      4⤵
      PID:3012
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 063858d0f004e50e52d7ea4a4e8a5e4ddcb0061c3b72cd88700b698a18952b19
MD5 b0f44e185ef9ec9e4e3e2d7bf5235064
SHA1 c83660e2358f600e6423115639ca5944d0030fc3
SHA512 a37d72709b1205fdc6603dc9d720b5b5b2e85bd5eb7e1d6d1c73ca7c325614a17ac953368b040d9c143ce350e7d5be5f19e219469cc9e7aa8533a401fa056408
SSDEEP 96:n0SkGEo1S1wpvWMoiVmdeHBrzVOULUWQyV+VDCziEwb:n0SkdoA1GWMX3OULro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0e0786d7779bcc749227e97654527eab5d0c61c8dcec0c6601c4460ad3118d0b
MD5 c4b8d94a9b197f68027ae558c8433995
SHA1 18e898ac6a8c2a3e9d19aed25c4c8c03fe2705fb
SHA512 df0de2fd2434c0bb52ad89940b8ecdba2248d9d1354c1c1388c6fc38c68b01d91da6df38bc36d7309c59c8fe51b6f645a3242408094a146244aea5beb97c2ae1
SSDEEP 96:n0SkGEo1y1wpvWMoiVmdeHBrzVOULUWQyV+VD7AiEwb:n0Skdo01GWMX3OULrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 504d8265d64262514facde26461584d240492ff2b127e352621fac959dce228f
MD5 9209250e1027abab0a2db2f5744e4a35
SHA1 974a66bdce6bdfa8b7b06a3a6ccbcb2d8b3449d3
SHA512 f8d62473f8b0ac250ddecc221d7d6f01a63f4edcdd98cc62659b708e0088551d5855e05d8861b06084f4723ab56604e20a32adf0eb4cca4f5ed2ff3369091c1a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsH0be2RUyBk/Mj2xo:A9iIxuERzA83h09RZxYsHM6EyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mighost.exe

Path C:\Users\Admin\cdp\mighost.exe
Size 858KB
SHA256 c0e5e2f839675a769ed230631b9afc6e30cebef524d3ed4c003e68612df08b35
MD5 cf40c844152c69f8edfc07797f1475fd
SHA1 3b470e6a00307759a5eba1b7369458508a81af13
SHA512 82ed14232dc0a422744814baad7e3de16e59b07d815cd6016ce8856afd7a49e4ec3f97b523984a34f294ae3c69df7033ed3b7d77a7a4b2a4ed1e7ae6413ece81
SSDEEP 24576:/EN973phvt8tmUdkw1xG8fFjGMaOnO+pwFL9N09PPP:/EN973PvEL2wHBODLcPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-32-0x00000000005E0000-0x000000000077E000-memory.dmp

Download

memory/212-49-0x00000000005E0000-0x000000000077E000-memory.dmp

Download

memory/212-0-0x00000000005E0000-0x000000000077E000-memory.dmp

Download

memory/212-6-0x0000000001800000-0x0000000001801000-memory.dmp

Download

memory/392-103-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/392-97-0x0000000000360000-0x00000000003BE000-memory.dmp

Download

memory/3164-95-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/3164-129-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/3164-141-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/3436-191-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/3436-228-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/3436-235-0x0000000000AF0000-0x0000000000C8E000-memory.dmp

Download

memory/4336-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4336-7-0x00000000005E0000-0x000000000077E000-memory.dmp

Download