Overview
overview
10Static
static
10windows.zip
windows11-21h2-x64
8windows/cf...ch.vbs
windows11-21h2-x64
3windows/idc/ida.js
windows11-21h2-x64
3windows/li...le.dll
windows11-21h2-x64
8windows/libclang.dll
windows11-21h2-x64
8windows/libdwarf.dll
windows11-21h2-x64
8windows/li...le.dll
windows11-21h2-x64
8windows/libz3.dll
windows11-21h2-x64
8windows/lo...if.dll
windows11-21h2-x64
3windows/lo...ga.dll
windows11-21h2-x64
3windows/lo...of.dll
windows11-21h2-x64
3windows/lo...ut.dll
windows11-21h2-x64
8windows/lo...tar.py
windows11-21h2-x64
3windows/lo...ip.dll
windows11-21h2-x64
8windows/lo...ldr.py
windows11-21h2-x64
8windows/lo...age.py
windows11-21h2-x64
8windows/lo...rc.dll
windows11-21h2-x64
8windows/lo...ff.dll
windows11-21h2-x64
8windows/lo...x_m.py
windows11-21h2-x64
3windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
3windows/lo...lod.py
windows11-21h2-x64
3windows/lo...mp.dll
windows11-21h2-x64
8windows/lo...lf.dll
windows11-21h2-x64
8windows/lo...oc.dll
windows11-21h2-x64
windows/lo...esp.py
windows11-21h2-x64
3windows/lo...ad.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
8windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...om.dll
windows11-21h2-x64
windows/lo...mf.dll
windows11-21h2-x64
3windows/lo...dr.dll
windows11-21h2-x64
8Analysis
-
max time kernel
880s -
max time network
907s -
platform
windows11-21h2_x64 -
resource
win11-20250207-en -
resource tags
arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/02/2025, 15:25
Behavioral task
behavioral1
Sample
windows.zip
Resource
win11-20250207-en
Behavioral task
behavioral2
Sample
windows/cfg/gdb_arch.vbs
Resource
win11-20250207-en
Behavioral task
behavioral3
Sample
windows/idc/ida.js
Resource
win11-20250207-en
Behavioral task
behavioral4
Sample
windows/libSwiftDemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral5
Sample
windows/libclang.dll
Resource
win11-20250207-en
Behavioral task
behavioral6
Sample
windows/libdwarf.dll
Resource
win11-20250207-en
Behavioral task
behavioral7
Sample
windows/librustdemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral8
Sample
windows/libz3.dll
Resource
win11-20250207-en
Behavioral task
behavioral9
Sample
windows/loaders/aif.dll
Resource
win11-20250207-en
Behavioral task
behavioral10
Sample
windows/loaders/amiga.dll
Resource
win11-20250207-en
Behavioral task
behavioral11
Sample
windows/loaders/aof.dll
Resource
win11-20250207-en
Behavioral task
behavioral12
Sample
windows/loaders/aout.dll
Resource
win11-20250207-en
Behavioral task
behavioral13
Sample
windows/loaders/archldr_tar.py
Resource
win11-20250207-en
Behavioral task
behavioral14
Sample
windows/loaders/archldr_zip.dll
Resource
win11-20250207-en
Behavioral task
behavioral15
Sample
windows/loaders/bfltldr.py
Resource
win11-20250207-en
Behavioral task
behavioral16
Sample
windows/loaders/bios_image.py
Resource
win11-20250207-en
Behavioral task
behavioral17
Sample
windows/loaders/bochsrc.dll
Resource
win11-20250207-en
Behavioral task
behavioral18
Sample
windows/loaders/coff.dll
Resource
win11-20250207-en
Behavioral task
behavioral19
Sample
windows/loaders/cortex_m.py
Resource
win11-20250207-en
Behavioral task
behavioral20
Sample
windows/loaders/dex.dll
Resource
win11-20250207-en
Behavioral task
behavioral21
Sample
windows/loaders/dos.dll
Resource
win11-20250207-en
Behavioral task
behavioral22
Sample
windows/loaders/dsp_lod.py
Resource
win11-20250207-en
Behavioral task
behavioral23
Sample
windows/loaders/dump.dll
Resource
win11-20250207-en
Behavioral task
behavioral24
Sample
windows/loaders/elf.dll
Resource
win11-20250207-en
Behavioral task
behavioral25
Sample
windows/loaders/epoc.dll
Resource
win11-20250207-en
Behavioral task
behavioral26
Sample
windows/loaders/esp.py
Resource
win11-20250207-en
Behavioral task
behavioral27
Sample
windows/loaders/expload.dll
Resource
win11-20250207-en
Behavioral task
behavioral28
Sample
windows/loaders/geos.dll
Resource
win11-20250207-en
Behavioral task
behavioral29
Sample
windows/loaders/hex.dll
Resource
win11-20250207-en
Behavioral task
behavioral30
Sample
windows/loaders/hpsom.dll
Resource
win11-20250207-en
Behavioral task
behavioral31
Sample
windows/loaders/intelomf.dll
Resource
win11-20250207-en
Behavioral task
behavioral32
Sample
windows/loaders/javaldr.dll
Resource
win11-20250207-en
General
-
Target
windows/loaders/aof.dll
-
Size
19KB
-
MD5
aed09a3b6714cf11f4d99926496f032a
-
SHA1
3cd41109af93d4ab320642ad3b6ae6c6ca7cbbf8
-
SHA256
95143d32cfe44fe3dc8d69b794780cbb2b69e980b64e947648047bf3e71c7ca1
-
SHA512
8fa73d4caadbc46b1c4ec22b22a8e245c1398a3c9bc12c6ed50cdb931cf70b48f16944ad8b4b3427a4637313a449538eddfb6bdae181c3a1745b7bb6a14767a9
-
SSDEEP
384:r94td79toypmEaRdBlrIV5eMrPCCjIiHHH0:rOboyR1Vrql
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 488 MicrosoftEdgeUpdate.exe 4588 MicrosoftEdgeUpdate.exe 2544 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4416 MicrosoftEdgeUpdate.exe 4416 MicrosoftEdgeUpdate.exe 4416 MicrosoftEdgeUpdate.exe 4416 MicrosoftEdgeUpdate.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4416 MicrosoftEdgeUpdate.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\windows\loaders\aof.dll,#11⤵PID:4756
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkE0OERDQjctQkQ0My00NUUwLTg0MjUtMUEzMTM4NEMwODJDfSIgdXNlcmlkPSJ7MTlDQ0NERjMtNDdEMS00RTEyLTg3NTQtRTUzMEJDQkI5NDBEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjlDQTVGMEYtOUQ2QS00MUYwLUE5OTgtNEJCRkE4OEE0NkVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NTM0NSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI3OTQzMzU2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NjU0MTQ2NTIiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:488
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5088" "1260" "1156" "1264" "0" "0" "0" "0" "0" "0" "0" "0"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:3252
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkE0OERDQjctQkQ0My00NUUwLTg0MjUtMUEzMTM4NEMwODJDfSIgdXNlcmlkPSJ7MTlDQ0NERjMtNDdEMS00RTEyLTg3NTQtRTUzMEJDQkI5NDBEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4Qjc5NzdFQy1BNTY1LTQ0MDYtQTZEMC0zOUUwOTg3NUJGOTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NDg2MCI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjQiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2ODE1MDg1NDgiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4588
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkE0OERDQjctQkQ0My00NUUwLTg0MjUtMUEzMTM4NEMwODJDfSIgdXNlcmlkPSJ7MTlDQ0NERjMtNDdEMS00RTEyLTg3NTQtRTUzMEJDQkI5NDBEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0NkI2NEZEMS03Nzk3LTQwREUtOURFNi02NzM4Mjk3MEU4NTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC45NCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins3MUVFRkRENy0zNTlBLTREOEQtQkNGNC04RkRCMDAzREZCREF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjEiIGNvaG9ydD0icnJmQDAuODciIG9vYmVfaW5zdGFsbF90aW1lPSIxODQ0Njc0NDA3MzcwOTU1MTYwNiIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzODM0MzA4NDY5MTI0MjUwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMiIgcj0iMiIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezk2RkY3RjA4LTIwQTQtNDM3NS04MzNDLUIyMDBFQURERUNGNn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBjb2hvcnQ9InJyZkAwLjUzIiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MkI1Qjg0NDktMDIxQS00QTc3LTlDNEUtNzMzNDNDM0Q3QjI1fSIvPjwvYXBwPjwvcmVxdWVzdD41⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4792,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:141⤵PID:2720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3876,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:141⤵PID:244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4076,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:141⤵PID:3720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3912,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:141⤵PID:1920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5332,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:141⤵PID:232
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4156,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:141⤵PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=760,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:141⤵PID:2324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4304,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:141⤵PID:1744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4964,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:141⤵PID:4528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2444,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:141⤵PID:5020
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5576,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:141⤵PID:4624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3812,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:141⤵PID:2560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5520,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:141⤵PID:2280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4824,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:141⤵PID:276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5628,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:141⤵PID:8
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5516,i,3145916790383377020,3832351671446480152,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:141⤵PID:4440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
415KB
MD5d409840055ce33d9e87d98b86dc69903
SHA1e63c6cbd9398ea648ade3d4b3f853efbf1209fd3
SHA256e20631c89cd198c344a2dc119844989bdaa967a374530534c81b6a1fa9190560
SHA512437b881afffe6767f0381628d84a0a1b8d716ba19f41ac8b7b7d43af741f54c14c73ab4116e43e09644c8ddfbc4fe27bd0741b110af2038de9472e2dc2854c66
-
Filesize
378KB
MD5e038e583d082281707a3a06ca197a35b
SHA139c964f8bae07839b259768a07b94a6dd440a4db
SHA2569766c79b3b7b299e6b9f23789d2a68ec61efcc5763aaad23ce3b6437c965c547
SHA5122b6d14d1c0f702d27f5a172b97b6aed8a35f408c6e803b94fa4f6e13f5c8731975fdcd688363e1131ec9bfd7b99669eca056c6fdcb0485a33111c032f0cbd717
-
Filesize
404KB
MD5d2fef377191ea4b88482ae33d22768c3
SHA1b6e1348e3d566484c409108af70797d21586ea09
SHA25696369b034e6f4bcf0eeed0998a1e3132c898fa395a6f2062992c6b7b27779c2f
SHA512b74af2612f641e93aa253c8d2b14ca591869c1d4d9e5c53673d43c58c6080cfe5636767c4af5321b18f6092fff84422b9e60f50bfa5b9e32ed7cc936f1bf2f37