Overview
overview
1Static
static
1ChangeHope...er.vbs
windows7-x64
1ChangeHope...er.vbs
windows10-2004-x64
1ChangeHope...in.vbs
windows7-x64
1ChangeHope...in.vbs
windows10-2004-x64
1ChangeHope...er.vbs
windows7-x64
1ChangeHope...er.vbs
windows10-2004-x64
1ChangeHope...og.vbs
windows7-x64
1ChangeHope...og.vbs
windows10-2004-x64
1ChangeHope...ot.htm
windows7-x64
1ChangeHope...ot.htm
windows10-2004-x64
1ChangeHope...js.htm
windows7-x64
1ChangeHope...js.htm
windows10-2004-x64
1ChangeHope...nt.htm
windows7-x64
1ChangeHope...nt.htm
windows10-2004-x64
1ChangeHope...js.htm
windows7-x64
1ChangeHope...js.htm
windows10-2004-x64
1ChangeHope...ks.htm
windows7-x64
1ChangeHope...ks.htm
windows10-2004-x64
1ChangeHope...js.htm
windows7-x64
1ChangeHope...js.htm
windows10-2004-x64
1ChangeHope...op.htm
windows7-x64
1ChangeHope...op.htm
windows10-2004-x64
1ChangeHope...js.htm
windows7-x64
1ChangeHope...js.htm
windows10-2004-x64
1ChangeHope...ad.vbs
windows7-x64
1ChangeHope...ad.vbs
windows10-2004-x64
1ChangeHope...in.vbs
windows7-x64
1ChangeHope...in.vbs
windows10-2004-x64
1ChangeHope...in.vbs
windows7-x64
1ChangeHope...in.vbs
windows10-2004-x64
1ChangeHope...in.vbs
windows7-x64
1ChangeHope...in.vbs
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 21:27
Static task
static1
Behavioral task
behavioral1
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/AjaxServer.vbs
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/AjaxServer.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/Login.vbs
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/Login.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/PhotoPlayer.vbs
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/PhotoPlayer.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/activeblog.vbs
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/activeblog.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userbot.htm
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userbot.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userbotjs.htm
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userbotjs.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usercomment.htm
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usercomment.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usercommentjs.htm
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usercommentjs.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userlinks.htm
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userlinks.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userlinksjs.htm
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_userlinksjs.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usertop.htm
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usertop.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usertopjs.htm
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usertopjs.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_ad.vbs
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_ad.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_addsysskin.vbs
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_addsysskin.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_adduserskin.vbs
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_adduserskin.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_admin.vbs
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/admin/admin_admin.vbs
Resource
win10v2004-20240709-en
General
-
Target
ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usertopjs.htm
-
Size
1B
-
MD5
7215ee9c7d9dc229d2921a40e899ec5f
-
SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6
-
SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
-
SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1928 msedge.exe 1928 msedge.exe 1380 msedge.exe 1380 msedge.exe 2172 identity_helper.exe 2172 identity_helper.exe 1336 msedge.exe 1336 msedge.exe 1336 msedge.exe 1336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1380 wrote to memory of 2984 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2984 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 2548 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 1928 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 1928 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe PID 1380 wrote to memory of 3068 1380 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ChangeHope_B2B_Free_V2.3\ChangeHope_B2B_Free_V2.3\Blog\ad\ad_usertopjs.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4d0b46f8,0x7ffd4d0b4708,0x7ffd4d0b47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2316,4249994118876479321,18216640481512207538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\361ca21e-3cce-4f89-9486-baaaafdfc38e.tmpFilesize
11KB
MD537948de26f7ee2867c4a2ab02856c81c
SHA1bff9b049b09dfbc49ebb1318c133671c17f2a1b0
SHA256af52ccd3e0653d5cc7abbb5b6faec50f58de573fa1a0f75d9636c9f5d7808c76
SHA5124e17a12a819351bc1a7898e00e78a35043e6177e7ee59dadbcf57962c31824df36e4912bbb4e605f21ff052ee7fc61e8181e9bc08ce9ec37c869d39fe5c363b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD541b7521cb53a388221e67e9ada2c37f7
SHA1441da40ebd6bdb93fb427740c2bf710a6564affc
SHA256452623c4044bce83fc8441dac495de394c12de4ea0dc6458cf3676a1f0711280
SHA5126a38de545497aab9c01380150721de7d44c2de5e66e17c2f6b4cc5c1e4117d5001de7dc7b7b165e8fa26398d4fa0b5fb53661fe17a91a820277ce7a26efcadcc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a58722690415d36ef96b4ab1c56d0a94
SHA1d89c260c720f7a755d8b9e37c68661747948dede
SHA256919da4f598399536e9d7bfdd8d0911b17c5846007cdb57c080ea53cc5acea35c
SHA5124a42ba015009ea040ef177cebcee959ef1dfb8f67becf56daef15a7220f99a42ca6e6b52fa3fdc8f36468bf603fbad78c448a2aa6b2be008aa0d67f7cad1cf75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
\??\pipe\LOCAL\crashpad_1380_CQUJRBLFHDWWRNRKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e