Overview
overview
10Static
static
10002.7z
windows10-2004-x64
301c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows10-2004-x64
1de8054e71...a1.exe
windows10-2004-x64
91e56efa724...ba.exe
windows10-2004-x64
31e754e1c7e...44.exe
windows10-2004-x64
31e8e39da21...bc.exe
windows10-2004-x64
1e9e575dd3...86.exe
windows10-2004-x64
31eb6de09f5...69.exe
windows10-2004-x64
41f0daca3fc...d9.exe
windows10-2004-x64
61f0efbc182...be.exe
windows10-2004-x64
1fd42d07b4...6e.exe
windows10-2004-x64
102a02608130...a1.exe
windows10-2004-x64
32a05ac3c43...e4.exe
windows10-2004-x64
102a32c84488...95.exe
windows10-2004-x64
102a6c920bfb...dc.exe
windows10-2004-x64
32aebddfd22...c8.exe
windows10-2004-x64
32b245f773b...bb.exe
windows10-2004-x64
102b331aa02a...b7.exe
windows10-2004-x64
10Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 04:49
Static task
static1
Behavioral task
behavioral1
Sample
002.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
Resource
win10v2004-20240802-en
General
-
Target
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
-
Size
179KB
-
MD5
c2fea37aa19c947614c20fe2ad3aeef2
-
SHA1
16834915e3db38b5b954c2099d77bcb700428588
-
SHA256
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
-
SHA512
e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
-
SSDEEP
3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe" 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imagewPYTCHgZsewjvBTdzzwGrdNBHPBg0O.jpg" 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exeNOTEPAD.EXEcmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
msedge.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673071051792030" msedge.exe -
Modifies registry class 3 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exemsedge.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{854A4286-C3FA-46F9-872B-2CF078796E07} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription pid Process Token: SeDebugPrivilege 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exepid Process 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exepid Process 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.execmd.exemsedge.exedescription pid Process procid_target PID 1984 wrote to memory of 2916 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 92 PID 1984 wrote to memory of 2916 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 92 PID 1984 wrote to memory of 2916 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 92 PID 1984 wrote to memory of 4828 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 93 PID 1984 wrote to memory of 4828 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 93 PID 1984 wrote to memory of 4828 1984 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 93 PID 4828 wrote to memory of 4792 4828 cmd.exe 95 PID 4828 wrote to memory of 4792 4828 cmd.exe 95 PID 4904 wrote to memory of 4340 4904 msedge.exe 108 PID 4904 wrote to memory of 4340 4904 msedge.exe 108 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3500 4904 msedge.exe 110 PID 4904 wrote to memory of 3992 4904 msedge.exe 111 PID 4904 wrote to memory of 3992 4904 msedge.exe 111 PID 4904 wrote to memory of 1188 4904 msedge.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt2⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://github.com/temon_69 & start https://github.com/temon_692⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/temon_693⤵PID:4792
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4796,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:11⤵PID:2816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4184,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:11⤵PID:372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5416,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:81⤵PID:4640
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5444,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:81⤵PID:3368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5744,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:81⤵PID:1636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffbb653d198,0x7ffbb653d1a4,0x7ffbb653d1b02⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3176,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:22⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1860,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:32⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2184,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:82⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4516,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:82⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4516,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:82⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4104,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --field-trial-handle=5092,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --field-trial-handle=4688,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5532,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5560,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4712,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=120,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:82⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4820,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:82⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2480,i,10853811013562089230,8592497893618455751,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:82⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"1⤵PID:2256
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Read Me First!.txt1⤵PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
1KB
MD564e1c81753a97afb70e7f8170a644c9c
SHA1c0a40a19db4403b0779516383fcfc04bf8315fe0
SHA256990651e9d405b3a5d52a4b9b4fcf5df28d6acbfe88f57be94693930a57a5796e
SHA512899830ae27ad54d37ba43e3007d6a13e42830e21b703027863f221cf366678de5ef4b61028cb2d266a47e7a95a3a1309afe40eb9f1ef19bcd3c87e57d50929b0
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
11KB
MD5712ac2ccd9e0c7505cfb8698e681c456
SHA1e6db9be9daca2c99768a9d11dc5f47c6045891ac
SHA25613522f99a9cdebefcadce13cbbd26b2ece8dac77e65ad2346ece4a595d2ad794
SHA512da2b4a60fddaa63896363699702805b08cfeae4ac8c6abb1776decf3f1f2af8af4e1b1972de78690f18a570a6a1c3d7e1d5f0e127928c5671a019cb24b2f3598
-
Filesize
52KB
MD5bc15bde0789f9ec5c9310e48135186f1
SHA15c36be7f3e53ef176fc9cd87981df9fb721d4b17
SHA2569aa15529be9bb8b7a3f28611cdcd026aff29c488106fe1524789dc8611a93310
SHA512184cdd96fe56fb3744ed2a16130916ff5705981a71b3256ae6324f1b24d1e6d451fb4f9a96ed896b9e0448c288844c265d8f5f0f0e2ae7fa2181029987ad52dd
-
Filesize
52KB
MD5b475dc2543d205ea4e9db74314df3112
SHA185a4096d5441d17c77717f499dbb29379a4f1549
SHA2569fccad70c950bb1be5217f3f49f5263a919ce1af68f79eb17e1b79371e20d506
SHA512f63565bc8ced7ffe67399132b5b995f177369ae9c8e42341fe088e65e448f4d97ca525dee01d695c6b2fd71e027eebfbabd756b357d389dfb1bb61f12ef50f6e
-
Filesize
268B
MD5bc7ee9dffb2cf55f5fca0b0602a5f933
SHA17d7def061aa3ae9c0467cf5f126fa76b7b167482
SHA256b2b02392520557f11412437591845f013382f25a7df3c5528045ac2ba400d711
SHA5122d7bb4718a22669cbe96db6ec712c958c2154ef18c3d339262a89ca81868921df14698669f1c8fdbfbeb908b37784887c0383cb7663d3cbd6a6d4594597b3ed5
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e