Overview
overview
7Static
static
3Zorara.zip
windows11-21h2-x64
7Microsoft....re.dll
windows11-21h2-x64
1Microsoft....ms.dll
windows11-21h2-x64
1Microsoft....pf.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Zorara.dll
windows11-21h2-x64
5ZoraraUI.exe
windows11-21h2-x64
1ZoraraUI.exe
windows11-21h2-x64
6bin/Monaco/index.html
windows11-21h2-x64
6bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco...lua.js
windows11-21h2-x64
3bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco....de.js
windows11-21h2-x64
3bin/Monaco....es.js
windows11-21h2-x64
3bin/Monaco....fr.js
windows11-21h2-x64
3bin/Monaco....it.js
windows11-21h2-x64
3bin/Monaco....ja.js
windows11-21h2-x64
3bin/Monaco...nls.js
windows11-21h2-x64
3bin/Monaco....ko.js
windows11-21h2-x64
3bin/Monaco....ru.js
windows11-21h2-x64
3bin/Monaco...-cn.js
windows11-21h2-x64
3bin/Monaco...-tw.js
windows11-21h2-x64
3bin/Monaco...der.js
windows11-21h2-x64
3bin/editor.js
windows11-21h2-x64
3libcrypto-3-x64.dll
windows11-21h2-x64
1libssl-3-x64.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
3scripts/IY.js
windows11-21h2-x64
3scripts/UNCTest.js
windows11-21h2-x64
3scripts/unnamedesp.js
windows11-21h2-x64
3Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/11/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
Zorara.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Zorara.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
bin/Monaco/index.html
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
bin/Monaco/vs/editor/editor.main.nls.js
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
bin/Monaco/vs/editor/editor.main.nls.ko.js
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
bin/Monaco/vs/editor/editor.main.nls.ru.js
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
Resource
win11-20241023-en
Behavioral task
behavioral23
Sample
bin/Monaco/vs/loader.js
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
bin/editor.js
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
libcrypto-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
libssl-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
runtimes/win-arm64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
scripts/IY.js
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
scripts/UNCTest.js
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
scripts/unnamedesp.js
Resource
win11-20241007-en
General
-
Target
ZoraraUI.exe
-
Size
254KB
-
MD5
aeb703ddf25377135af6e4675793a1c9
-
SHA1
e9f43283ba04a9c30d045ca064d2935d053114ba
-
SHA256
6b9da80d8877b04e5aa3a04790d3cbed8cf47cad2871997755f198ba674aa026
-
SHA512
191de5176cf7efbc0a8cf1b0f79c49754874ce48d7415615d484e9c7ba26d3184580309afd013cc437b239885f2c2a758846e27bec2d59a542a9647bcd7cd739
-
SSDEEP
3072:hhK4Uay3XrQ8habqgp9pC9Z6p5uf3CzA0xuZ04ntfxehBuRmYwSKgIwe:hhK4XycqgpfCup5sKxuZ04mhARN
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 discord.com 10 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3587106988-279496464-3440778474-1000\{1F6784A9-6FB4-44D6-9468-F1BDDA7E1AA8} msedge.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2296 msedge.exe 2296 msedge.exe 1008 msedge.exe 1008 msedge.exe 4148 msedge.exe 4148 msedge.exe 2656 identity_helper.exe 2656 identity_helper.exe 3168 msedge.exe 3168 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3904 wrote to memory of 1008 3904 ZoraraUI.exe 77 PID 3904 wrote to memory of 1008 3904 ZoraraUI.exe 77 PID 1008 wrote to memory of 2700 1008 msedge.exe 78 PID 1008 wrote to memory of 2700 1008 msedge.exe 78 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 4484 1008 msedge.exe 79 PID 1008 wrote to memory of 2296 1008 msedge.exe 80 PID 1008 wrote to memory of 2296 1008 msedge.exe 80 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81 PID 1008 wrote to memory of 4140 1008 msedge.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe"C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/realzorara2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe18383cb8,0x7ffe18383cc8,0x7ffe18383cd83⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1784 /prefetch:23⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:83⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:13⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:13⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3976 /prefetch:83⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3980 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:13⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:13⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:13⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:13⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,7677162978546567951,7069087794946066550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5692 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fdee96b970080ef7f5bfa5964075575e
SHA12c821998dc2674d291bfa83a4df46814f0c29ab4
SHA256a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0
SHA51220875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff
-
Filesize
152B
MD546e6ad711a84b5dc7b30b75297d64875
SHA18ca343bfab1e2c04e67b9b16b8e06ba463b4f485
SHA25677b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f
SHA5128472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize480B
MD570a756aa3450376753154f84f7e4b707
SHA1929b5cbe83c098e0fdf723a7f9c460b20ba2eace
SHA256b2d916d99709acc09d83056f01cefbb6c36a371ff5c09673dadf13ccf12e26e3
SHA5122b2f0e87a20889a1c38e13a140d0dba3ea6357230869e9a4d939166ed1349eba4cbfeaef68fd3d3a45717b4c6a1e7c1c92bb6a7e77db8d6813c1aa36ecbaaa5d
-
Filesize
323B
MD574c9e7193b0cb61e692095d8d9e01ae8
SHA12f60d0b754e400d545d5f3829ae3b0a0b990d821
SHA256b51c6699b167d0179b11f965336dd9133829945e8992fb391043536d336d9baf
SHA512e3abb8a66b88de18aa084934f2d481d7f10060d35b0426a12b7dc1e7a3a8199261be181e889a4054c5d108884a16eb304a7e1b575de21820bd97acb48c13d747
-
Filesize
5KB
MD5acd678b2ed377dd30a3623e19846dc39
SHA15f985f20db342e360437d3f7bb79734bdfdac771
SHA2560f4abb5643aa0ba751c57f2d14980fa1282563b122db1567d9a250661d4a621f
SHA51283a1cdd8748d42b1346a679aa1e19031a38a5f89b8360891174d70ee9b337b5caf946a004292e9df1b3cb03bfb2575bf070f372d8a3e9a328e41428b56ff62ac
-
Filesize
6KB
MD5854cffacb6f180475536286831a722f6
SHA197654fc37192a7436d717c605a1050327a5d7ddb
SHA2569bbf81132bea79e8cdcca2f843a163494a379f45809440dd5017bb7eba14af96
SHA512e86455b5f687b09128d0f5e9bc524b699f38dd6740b673d6c3af2aabd203890051f8a0eeb228c8f94baaa461740647a01e195426a33ccc150370fe91b2240528
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD50fa2fc57d2c56f9c32f49599930513d2
SHA1afe5448ad2a1726a6945391615404398b1d0e88f
SHA256c636fe19fea52bd98be94f5c36929a856c7b1078a50463b1bb9ee904dd505cc0
SHA512bfa4ac9fe308164d7045465890e0395299e0cc5cd8f1cdd12c57d00e045e67ab27ed4312f9ceb42cef69b697008a4c21e00d12a13c8b4d4f12a7bc70d049c69c