Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 12:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=yR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DyR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA%22%7D%7D&flowContextData=gfxCwswHRn_uaTP4C5WMNaQ7wlBS6h7MUirr6WWN6LNlplWo8Sx2n-9ZnrI0v-DThYc0rp-_aZNeEaYafpJUo7WcYq46see4DcVKI6AOFL5tV878_IAQGJLrDbYtX-WAoZqmoV1fOg1Mi2uqipWFJosb0f-a339nDZyteiIZ0t6ixQFqsnGhtHKdXOY__J5Lq-LJ8fEIQed_EhjHu7-xOTQ9T1Bo87yvhqqlNceWs3S4edjz0Br8MYhVWTF8erSN9PIeeZPFdEF4GmSbF8HnkhBwJKAufk_2gW2u9bWd2nC0AETe&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=3beab26b-a071-11ef-aeed-a1b80873a180&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=3beab26b-a071-11ef-aeed-a1b80873a180&calc=f3325547396d8&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.292.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin
Resource
win10v2004-20241007-en
General
-
Target
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=yR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DyR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA%22%7D%7D&flowContextData=gfxCwswHRn_uaTP4C5WMNaQ7wlBS6h7MUirr6WWN6LNlplWo8Sx2n-9ZnrI0v-DThYc0rp-_aZNeEaYafpJUo7WcYq46see4DcVKI6AOFL5tV878_IAQGJLrDbYtX-WAoZqmoV1fOg1Mi2uqipWFJosb0f-a339nDZyteiIZ0t6ixQFqsnGhtHKdXOY__J5Lq-LJ8fEIQed_EhjHu7-xOTQ9T1Bo87yvhqqlNceWs3S4edjz0Br8MYhVWTF8erSN9PIeeZPFdEF4GmSbF8HnkhBwJKAufk_2gW2u9bWd2nC0AETe&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=3beab26b-a071-11ef-aeed-a1b80873a180&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=3beab26b-a071-11ef-aeed-a1b80873a180&calc=f3325547396d8&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.292.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{4048CEED-48A9-49C8-AE3A-37D11AB06F99} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 892 msedge.exe 892 msedge.exe 2088 msedge.exe 2088 msedge.exe 4600 msedge.exe 4600 msedge.exe 1780 identity_helper.exe 1780 identity_helper.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 428 2088 msedge.exe 83 PID 2088 wrote to memory of 428 2088 msedge.exe 83 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 4320 2088 msedge.exe 84 PID 2088 wrote to memory of 892 2088 msedge.exe 85 PID 2088 wrote to memory of 892 2088 msedge.exe 85 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86 PID 2088 wrote to memory of 2536 2088 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=yR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-8Y11935579558521D%2FU-0XW582482W155942C%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DyR3Bw-yk8CnOVdGOUW3j.YyY6TmEXB7QDKFVxA%22%7D%7D&flowContextData=gfxCwswHRn_uaTP4C5WMNaQ7wlBS6h7MUirr6WWN6LNlplWo8Sx2n-9ZnrI0v-DThYc0rp-_aZNeEaYafpJUo7WcYq46see4DcVKI6AOFL5tV878_IAQGJLrDbYtX-WAoZqmoV1fOg1Mi2uqipWFJosb0f-a339nDZyteiIZ0t6ixQFqsnGhtHKdXOY__J5Lq-LJ8fEIQed_EhjHu7-xOTQ9T1Bo87yvhqqlNceWs3S4edjz0Br8MYhVWTF8erSN9PIeeZPFdEF4GmSbF8HnkhBwJKAufk_2gW2u9bWd2nC0AETe&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=3beab26b-a071-11ef-aeed-a1b80873a180&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=3beab26b-a071-11ef-aeed-a1b80873a180&calc=f3325547396d8&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.292.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff094d46f8,0x7fff094d4708,0x7fff094d47182⤵PID:428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8199270715405607407,16405300207895477793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize936B
MD5a81c05d1bf4863c858b96b3550b072da
SHA176416da5e1a0361865fd63d4f308b23ce5103d81
SHA2561727ef41fa077c3576d4b777d2e700f465bf3c09499b10db35d05bf6ad7bbd3a
SHA5124449051fc1004d486abc73b91124b7f4685923c6e60260b7a453e04d7f2992a7921eb3ced0809da2100cc217c5eae045f7061b6db4be83bd9c41314c4da9a514
-
Filesize
1KB
MD5325990e843ff68fa4bb1e2ef60609090
SHA18b1bd0b6f82f43a24f5264278b9c17398cf66033
SHA25692a49ddb0952f08bbbb9d5a982af16babb684532edd3a99374b868adec1f1e19
SHA512f4bf7cf5870cbb2a839c5fa11cceffb665c0a4e5c576c0df8066b8f09b4397154e9e2b5d45fc3eb4bfabbda50754ea7e763c2132a4d946cc1c9eb5e7890a5ea9
-
Filesize
6KB
MD50bf0597738d8f194cc8972ab1eae1c3d
SHA16c2b4198dfdd64869f1e72babdfc505216dcab6a
SHA2565df2ba917572b88f410a68dfdda57a014f65ff60f043e81041ec47ff16e27315
SHA5128b93b903ce0b2e092fbfaa01bfc5662a12e9629100e44aa8d26ecb9280da76c946a7909a55d07757acec6915a7436700a0fe3588b3aaf7c946d5074c973baf9e
-
Filesize
5KB
MD5df9265023732b52e2ddc14a4eb49823d
SHA12c5be43110c39ee1c127fb40a799cc82614b0e7f
SHA256999e2af478611d05e7c56d434d791bb9a7d6d71a87f80b769588803af44eae32
SHA512ea6fe86ddca791c0a4d0cacf383798a352292d57df4bd5cf98dbad5205e2811a46821776ea04b8b7cbdfdd12628fec1844c1dd125d294db9c973f826937254a5
-
Filesize
1KB
MD56fc4ddecab902b657462d116cd411238
SHA1e2cc7169ca909710a9fc86667bcfcf28cbb8a83e
SHA256df9728afe45b987f5c3dee1ca6117a86af02b7490b3858ccdacff322aed3027d
SHA512078655a068f8928abd03e09f1c98afa4ba98161b40c27f5972dcab8e91f681ad51460b6cc1f1953e93f4eefce43c755fb5c0822ef4dc5beb170b5f11eb46c9a8
-
Filesize
1KB
MD5a829e87670c2c0748e7cefc671c1a653
SHA17fa18485aca0b4a7977226052e545ca0d11b834b
SHA256116ff58e3662b53836bff05a191d648f93bb73ab6fcfef9041b5b554375422c4
SHA512e7fa414962a54db839780ec663e29ea7621aea49899988a6ee8c4f9c89ebab3e79331c2871d09466a67fd633e0d989a048bbfb57bb45ce1f1cc8101736725d53
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5dc5594b5d67aeaa6048a629a2168355a
SHA10c0745226311411eddf7f2bc0daa1ae91f52e419
SHA25675354032f8ff455af8c6c99481181dd0bf10d789fda7b9f0c432d5e132267b02
SHA51288299a7123e6436b57c2dc2ad79553ae1093a6bed4830bc8873d559a68ae4832422676ebc4b543bd82e209b9e653fc8bfdfb636a8aedf84a90172155682b8ed5