0bf5a6281cb785cb0370cf627ca7273dc0d7ee0197687702586305a624cd1f0b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
screendock.exe
Size 9.8MB
Sample260628-apd7saew5x
SHA256 0bf5a6281cb785cb0370cf627ca7273dc0d7ee0197687702586305a624cd1f0b
MD5 28661257a1e8f7df0446e046b9a23e49
SHA1 a65b716c640f0715120e793048225663a232960f
SHA512 d566ae5289d5bcffa99153da1f964854580adc202b54e8319bd900f3c3e85d3c6a395064a7314e708ede30b8fbff28d6dd318ff5b773e983dd106003c6c99ccf
SSDEEP 98304:Wr6avQqD7ln8o4BDmhR+jiPeLLSt8mJVrf94/WWmWTZEyxRB6Ms9Twq4:ONIqD7ln8o4BDmhR+jiPe6GQ4T
TLSH
T1D1A6F711BB5B996CD48BC4B4835B8A76493034CB0B35B9FF549492382F6EBF42F28359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScreenDock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\screendock.exe\" --startup"	screendock.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	screendock.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 43 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\LICENSE	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_707688903\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_707688903\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_707688903\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_707688903\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_2038443086\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Staging	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3892	msedgewebview2.exe
3892	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2996	msedgewebview2.exe
2996	msedgewebview2.exe
2996	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5760	screendock.exe
5760	screendock.exe
5760	screendock.exe
5760	screendock.exe
5760	screendock.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5760	screendock.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 2996	5760	screendock.exe	90
PID 2996 wrote to memory of 6736	2996	msedgewebview2.exe	91
PID 2996 wrote to memory of 4648	2996	msedgewebview2.exe	92
PID 2996 wrote to memory of 4648	2996	msedgewebview2.exe	92
PID 2996 wrote to memory of 4648	2996	msedgewebview2.exe	92
PID 2996 wrote to memory of 4648	2996	msedgewebview2.exe	92
PID 2996 wrote to memory of 6096	2996	msedgewebview2.exe	93
PID 2996 wrote to memory of 4492	2996	msedgewebview2.exe	94
PID 2996 wrote to memory of 4492	2996	msedgewebview2.exe	94
PID 2996 wrote to memory of 4492	2996	msedgewebview2.exe	94
PID 2996 wrote to memory of 2700	2996	msedgewebview2.exe	95
PID 2996 wrote to memory of 2700	2996	msedgewebview2.exe	95
PID 2996 wrote to memory of 2700	2996	msedgewebview2.exe	95
PID 2996 wrote to memory of 2700	2996	msedgewebview2.exe	95
PID 2996 wrote to memory of 2700	2996	msedgewebview2.exe	95
PID 2996 wrote to memory of 5172	2996	msedgewebview2.exe	96
PID 2996 wrote to memory of 5172	2996	msedgewebview2.exe	96
PID 2996 wrote to memory of 5172	2996	msedgewebview2.exe	96
PID 2996 wrote to memory of 5172	2996	msedgewebview2.exe	96
PID 2996 wrote to memory of 5172	2996	msedgewebview2.exe	96
PID 2996 wrote to memory of 7128	2996	msedgewebview2.exe	99
PID 2996 wrote to memory of 7128	2996	msedgewebview2.exe	99
PID 2996 wrote to memory of 7128	2996	msedgewebview2.exe	99
PID 2996 wrote to memory of 7128	2996	msedgewebview2.exe	99
PID 2996 wrote to memory of 7128	2996	msedgewebview2.exe	99
PID 2996 wrote to memory of 1716	2996	msedgewebview2.exe	102
PID 2996 wrote to memory of 1716	2996	msedgewebview2.exe	102
PID 2996 wrote to memory of 1716	2996	msedgewebview2.exe	102
PID 2996 wrote to memory of 6924	2996	msedgewebview2.exe	103
PID 2996 wrote to memory of 6924	2996	msedgewebview2.exe	103
PID 2996 wrote to memory of 6924	2996	msedgewebview2.exe	103
PID 2996 wrote to memory of 3892	2996	msedgewebview2.exe	104
PID 2996 wrote to memory of 3992	2996	msedgewebview2.exe	105
PID 2996 wrote to memory of 3992	2996	msedgewebview2.exe	105
PID 2996 wrote to memory of 3992	2996	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\screendock.exe
"C:\Users\Admin\AppData\Local\Temp\screendock.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5760.5772.5187724497014062520 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView /prefetch:4 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffef1db5fd8,0x7ffef1db5fe4,0x7ffef1db5ff0
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3320 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3996 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4168 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87 /prefetch:1
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4980 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:6924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4956 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView" --webview-exe-name=screendock.exe --webview-exe-version=0.4.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1760,i,13090363035844660751,6325432060820402005,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f9c0884b2958d7828755e56a7cf1148b04bd1e87
    3⤵
    PID:3992

C:\Users\Admin\AppData\Local\Temp\screendock.exe
"C:\Users\Admin\AppData\Local\Temp\screendock.exe" --startup
1⤵
PID:6344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 83c9cc01a528d3cc1112fbd19f86be2324a698aa84b1e8f452db10584c46f94d
MD5 61410e6ef0fb54f788f63323f12b2b10
SHA1 dc9dffed10b4c9699cc4c6593ef35736edd6ba47
SHA512 329a4af3587e4d3afb7ab3cfbce2500da811875f173360e9ae3f107b72fb12e1ce65f4d1a8019a2dc127179e1451138aa1f95eb25e270c8a7cdf6b73b47be79f
TLSH
T104D0241F33414134C41434730453F50C0440F10FC1054000743CFD1D3F044700D03D41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 695cd8d2302a8e98a80f04eb82268fd4b832da68c4f64ea89c79158130c14180
MD5 64aa00c72ce1a80176b5232e3d44652c
SHA1 38d6b9bcf7fc415053e1de1f63fc3c4e23ccc1f2
SHA512 37dcd2ac889d405d394ac742672f908e0c7521f0ce404229ebfe49a0aed792d58c75acc818fdec5356b9d8024e481f3259753bd1b1082656bd4c7b4c4924718a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b64a881aa6d2359b3804fd3c0b0839ab74f355e8ea13c1d3cd4e04500df219b1
MD5 2b0603c0fa50bb9ff1b7c3472a18f7b8
SHA1 0eb0d478c008e89768e082bdd897d3ea511ebf1c
SHA512 0fdfc685bbabd7b0400905785fd1c3be24902637376b95d572d9abae3b0707adc840bc28b195f1b33249315f2ee9927c9b74aee764ff43df410009473c715377
TLSH
T1ECB011E02A8080C3CA030BF820EC8CA233F23C20832F0802208CA83AE820382028A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d898.TMP

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d898.TMP
Size 48B
SHA256 d2167c459f5e1fb8241f33d2c49c2b6d9c6c0ed1212a9b2d17dd245fb87fb69b
MD5 d0d3627abc68ebaf4ba4223600231545
SHA1 89b93b17406c46543d4c7ac573d4669cdc77e358
SHA512 37bc9aa01b8c0f59a988199354d37f3e18dbad69ec2522e166f5018327e8526a4867b9bc757c9f921cdee12780b2eab30b290f5e141e75be02506679f7fd7065
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Network\Network Persistent State
Size 571B
SHA256 41a8d37861661c13122008e4b01bb63459111fb0798cdd553b44094be960ba3b
MD5 ebf93a8ca3f27aded87fa654502becdd
SHA1 014678ebd165b1dd9d70b6f4b7a762cb7607ccfd
SHA512 aaac35f5800580a85ab485600bdb35937f3f2593c619bc80b02bd7e307d0c1b4419ccb1543848da5d25c85c2020def882574045c084ad0f25ad951a13a7763e0
TLSH
T1A7F081E2C2E4C57E865116E457307513C53E4509971C3E26DDDFE7AA5BD1075D11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe599a23.TMP

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Network\Network Persistent State~RFe599a23.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 f7eb79a272c6def3efb2432837003945d95aacdcf5f864f84acbc2196aad5732
MD5 0e1136f187c9b93027d2690e9334c08d
SHA1 df45f04eddb6acb5e69bda216482986fa79c2229
SHA512 45a90341a7de13a55ef8221aeda01e47415e1a673357baa53bedd02bf8d73276f8200e614fcd0d7bca75f3d8775e0b542b13fe68bd0b34553dbc95d73c99165c
SSDEEP 96:st4/dja0BwGLb9Okro5h16Z0qs7/x+6MhmuecJQXOdjeTK+gLtAE28XM1C7K:stcoRMonqsV+FdQX2j1ldG6K
TLSH
T1E0D1B9036F24697B8CC7E219BA29BB13E2F560B265D01E5CEBFC465C05DB5CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ecb8f753-ccb9-43df-b129-232239ea1701.tmp

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Default\ecb8f753-ccb9-43df-b129-232239ea1701.tmp
Size 6KB
SHA256 3b5f429d1330e4f44bd026c693126757ae00580d1562d19afdf030baaae2ce41
MD5 71a605422955cf3dfdb7f8ea10688742
SHA1 1a22d5ee20b198f3e54eb3a64ab6edff614be91b
SHA512 874d9c0f6140350dd5f74359970b1a6c92f51e3794f52477eaf56c2ef498aff273a88757ca364aefc4b53423193c288ca080d86e4c6718dc030e10d79b7138a4
SSDEEP 96:st4/dja0BZLb9Okro5h16Z0qs7/x+6MhmuecJQXOdjeTK+gLIp28XM1C7K:stco3MonqsV+FdQX2j1luG6K
TLSH
T189D1B702AF24697B4CC6E209BA39BB07E2F560B271D11E58EBFC465C05DB6CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Local State
Size 2KB
SHA256 732f34b08fe38ba2cd8b6d8f03c1674bb527c5a5ef7391b6dbb9f5da140922f0
MD5 6b968681dd6f87268896087326969996
SHA1 15c2fd40b7a844d44a78cfa509ae1009ee52eae2
SHA512 4fc55b034b0df14f709dbf85614fb7e99b708b5216743106390a05b97184f5698a51ad5ac1da8729a40750228c02d7a2ed399252c015b62c52198911e17c575b
TLSH
T199519573A9105A3789E3D64C798BBB13CB755065AB921F58AACC0B4802D755C174BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Local State
Size 3KB
SHA256 d17e828a892dd97f3dfb39a55846b928dd751e15d0717ef1c4dc5277483981a3
MD5 69801c7903772f305cfa5c82351c05d8
SHA1 68e9b9106a01f9d74f3b71dbd822d72202763356
SHA512 3362cddf46d9b51a6f5a72aefb7413570a1b562fa317f9dfe1c9904cafdd14035774f88fc892e2c0d57d1f66ea88f48db621c8c4b3be3a504287cef536050faf
TLSH
T12F716676996099778DE3D60979866B16A7A15037E6C13F98E5DC0F0C02D729C1357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Local State
Size 15KB
SHA256 db94521e9f7194e046144355f4c033631b098c9b6218766fb797560956d3c826
MD5 88aaa3eff9c7603623d910061049426d
SHA1 58a833b5c08a707c806fa41d4194d4c4e96d5dfe
SHA512 3166142010c2ae91b194322700503c4de9359b99b107bd378c4633a21dbea0805524bb7317e65cab897b9b7a510ccf793def5d70459d1aea60b71b95a1cb0d64
SSDEEP 384:Msrv+89zHqlDNP9oidBNBSP22XvrASzyRk3dYNNN:3rv+4UNbdY26cSuRk3dANN
TLSH
T19C72AE33E6389A378DB3D549B44B6A077F7860D752C20AA4E9D95B8D42CB4D9230BD03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588538.TMP

Path C:\Users\Admin\AppData\Local\com.screendock.desktop\EBWebView\Local State~RFe588538.TMP
Size 1KB
SHA256 a3011f249adaaa4925c890139fe49d8277fc510192ccaf30a9e05bd39cc6b795
MD5 e07f2d5b007b037e6bc0d79508891194
SHA1 5b2e5c6271b7aa36984daf0d9417b78ae5705b00
SHA512 d2706d147ea0ccd1f6b5ff64a98c8e7b6e4e5ec57c64b016ea62f3658e0dd6a3d0ad8e9cff113809250c4960f5d8f44dcc2cf8238f83939f8cd0ab6457feab82
TLSH
T18C3152B2D9600F739C92E28A3697FB8B5F71407A93810E0875CD4B4816D715C966F832
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_628592600\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/1716-301-0x00007FFF145A0000-0x00007FFF145A1000-memory.dmp

Download

memory/1716-302-0x00007FFF14760000-0x00007FFF14761000-memory.dmp

Download

memory/2700-112-0x00007FFF13370000-0x00007FFF13371000-memory.dmp

Download

memory/2700-195-0x000001FDFF100000-0x000001FDFF216000-memory.dmp

Download

memory/3892-404-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-411-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-408-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-413-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-412-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-402-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-410-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/3892-409-0x000002A516A90000-0x000002A516A91000-memory.dmp

Download

memory/4648-256-0x000001B43AC60000-0x000001B43AD76000-memory.dmp

Download

memory/4648-240-0x000001B43AC60000-0x000001B43AD76000-memory.dmp

Download

memory/4648-194-0x000001B43AC60000-0x000001B43AD76000-memory.dmp

Download

memory/4648-24-0x00007FFF13370000-0x00007FFF13371000-memory.dmp

Download

memory/5172-196-0x0000012E43180000-0x0000012E43296000-memory.dmp

Download

memory/7128-199-0x0000011B78C90000-0x0000011B78DA6000-memory.dmp

Download