Overview
overview
10Static
static
10PlutoReaperV2.rar
windows7-x64
3PlutoReaperV2.rar
windows10-2004-x64
1PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...n.html
windows7-x64
6PlutoReape...n.html
windows10-2004-x64
6PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...e.html
windows7-x64
3PlutoReape...e.html
windows10-2004-x64
3PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...n.html
windows7-x64
3PlutoReape...n.html
windows10-2004-x64
3PlutoReape...ics.js
windows7-x64
3PlutoReape...ics.js
windows10-2004-x64
3PlutoReape...rap.js
windows7-x64
3PlutoReape...rap.js
windows10-2004-x64
3PlutoReape...ery.js
windows7-x64
3PlutoReape...ery.js
windows10-2004-x64
3PlutoReape...002.js
windows7-x64
3PlutoReape...002.js
windows10-2004-x64
3PlutoReape...003.js
windows7-x64
3PlutoReape...003.js
windows10-2004-x64
3PlutoReape...004.js
windows7-x64
3PlutoReape...004.js
windows10-2004-x64
3PlutoReape...005.js
windows7-x64
3PlutoReape...005.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
05/03/2025, 20:06
Behavioral task
behavioral1
Sample
PlutoReaperV2.rar
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
PlutoReaperV2.rar
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/cryptocurrency/login.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/cryptocurrency/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/devianart/login.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/devianart/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/dropbox/login.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/dropbox/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/facebook/login.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/facebook/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/facebook/mobile.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/facebook/mobile.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/github/login.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/github/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/google/login.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/google/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/analytics.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral20
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/analytics.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/bootstrap.js
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral22
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/bootstrap.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_002.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_002.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_003.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_003.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_004.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_004.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_005.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/instafollowers/login_files/jquery_005.js
Resource
win10v2004-20250217-en
windows10-2004-x64
General
- Target PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/cryptocurrency/login.html
- Size 7KB
- Sample250305-yvmccaxvb1
- SHA256 0c8190be1be671249b9a516114121c232d1b90b44a383316f5ae3dc7d002ffe2
- MD5 4274f4194a8806dbce4b2596684aa498
- SHA1 b7e6a10ea693829861493dfe162bb7c3c1639c8a
- SHA512 6e1a6a21cb798c20ac9e1ee826b66468735f609808e41d43d71fde5903d4dcb2f0a555e10c26fc1fcf02f524438ec96bce81eb3e85e18787c438f2a01c1efc6f
- SSDEEP 96:mGe7ZNWrDrDFIbTIVxw1vw+Z1vcQJy/+OrQ/EYwvhGDIZ/+mQXOCnCZPCYC9Gi:Wx4cywMh7ZsX/CY9z
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1036 msedge.exe 1036 msedge.exe 2052 msedge.exe 2052 msedge.exe 4444 identity_helper.exe 4444 identity_helper.exe 4036 msedge.exe 4036 msedge.exe 4036 msedge.exe 4036 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2468 2052 msedge.exe 87 PID 2052 wrote to memory of 2468 2052 msedge.exe 87 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 4468 2052 msedge.exe 88 PID 2052 wrote to memory of 1036 2052 msedge.exe 89 PID 2052 wrote to memory of 1036 2052 msedge.exe 89 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90 PID 2052 wrote to memory of 3328 2052 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\PlutoReaper\PlutoReaperV2\PROGRAMS\PHISHING\cryptocurrency\login.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc474946f8,0x7ffc47494708,0x7ffc474947182⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1764289702868381197,10707291077693023259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3756
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3
- MD5 39c51e5592e99966d676c729e840107b
- SHA1 e2dd9be0ffe54508a904d314b3cf0782a9a508b7
- SHA512 b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04
- MD5 39e376ee2f541e6b1ed0bca701e8fb59
- SHA1 bfe3cc2eed8721339d433533aef6e18e0a13a9a3
- SHA512 a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 388cd4900132e6e2e848554133f055b324adb8d767186682fd171bb7c22dc1a1
- MD5 069d0d081801a92594f77da4d90c1412
- SHA1 8f0adc012a7f88f413840f7aa9885e178186eb51
- SHA512 6f54794bf83b4d9ab57d40ba1d8cea5deb7b77caea6f3acdf9890b0a0d291f660a29650947295b5b0907e795ce81119b898ed2410f176e968ff683adfe27273a
- SSDEEP 96:nrkj8ti10QQHwpvWMoiVmdeHdCGhfFUWQyV+VDCziEwb:nrkheQQHGWMXlfFro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 695327d62303e2d96ec2fcd5d2f1c1ee3363eba38d4faa8677ebaef1d8a5c830
- MD5 caacd4c1fd469fe85d56f82f52683649
- SHA1 1b1fd151fdd92b52a5e0326d0bfa218aa8b1f2fa
- SHA512 eff50cb168a193443ec2a8f670e04b1f3f1d1335b38e3e88a901c507fe81f99f959591b4a68faa5acaf1cb07109929c50f696be973ca265f330adb7dc31db259
- SSDEEP 96:nrkj8ti10gQHwpvWMoiVmdeHdCGhfFUWQyV+VD7AiEwb:nrkfegQHGWMXlfFrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 72163df1b4cde6f4db1455f53d9963abaf227a859e30efa5fca4dae0e55e85f7
- MD5 c5a844bbf804e4b267484982040c791f
- SHA1 5deb3fe6de374ec292947c5955ff76d9b5fde53b
- SHA512 76671070abe432944a4f111edf661039e20b3e928e1a0daaf13959004323915be1eb1aaf983e62e7043dbd170947b8cc2a7985ece818ec5b1a81737adef46381
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupD8e2RU55Y5SfIesGG3q/76:A9iIxuERzA83h09RZxYuWKavsGG3q/76
- MD5 SHA1 SHA512 SSDEEP