fbbef07e4cd324fdb18f01cf7ea24439f7a19a937a434f84a70b9e32a427163a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
md-preview.exe
Size 4.9MB
Sample260710-ext1eses41
SHA256 fbbef07e4cd324fdb18f01cf7ea24439f7a19a937a434f84a70b9e32a427163a
MD5 33f3d6afbad156f12525d22c91cd857b
SHA1 e546e7708dad1bb0e15d82dbd1312011785e33f8
SHA512 3719438a10905f91b933532c2bd6506f6472a0c970fafda045510a1bdf24d1f350cf76a0b2c5c21800c8a088092f14f5458c9da7a76a4127d0a8d557199f6d9f
SSDEEP 49152:bzj1oW5ETuyNyCx/4oXDZqbOB3NnbFb2bubfbmblK++ZPlcNGmaNNRlt8qDlnFRh:njqnndtPlcuHZyQN
TLSH
T12136AE9533D57479C26782F9947F2212A13B7C48A409D82DFBBCC5E32C6488A117BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md-preview.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_961476907\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_824178872\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_961476907\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_824178872\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_824178872\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-ZH	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_824178872\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_824178872\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1992741816\Part-NL	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.md\OpenWithProgids	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.md\OpenWithProgids\MDPreview.md	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\DefaultIcon	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\shell\open\command	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\SupportedTypes\.markdown	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.markdown\OpenWithProgids\MDPreview.md	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mkd\OpenWithProgids	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\shell\open	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mdown\OpenWithProgids\MDPreview.md	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\FriendlyTypeName = "Markdown Document"	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\shell	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\SupportedTypes	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\SupportedTypes\.mdown	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.markdown\OpenWithProgids	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mkd	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.md	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mdown	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\md-preview.exe\",0"	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\shell\open\command	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\SupportedTypes\.mkd	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\shell	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\shell\open	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\md-preview.exe\" \"%1\""	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.markdown	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mdown\OpenWithProgids	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.mkd\OpenWithProgids\MDPreview.md	md-preview.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\ = "Markdown Document"	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\MDPreview.md\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\md-preview.exe\" \"%1\""	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\FriendlyAppName = "MD Preview"	md-preview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Applications\md-preview.exe\SupportedTypes\.md	md-preview.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	msedgewebview2.exe
1844	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3440	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4184	md-preview.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3440	4184	md-preview.exe	86
PID 3440 wrote to memory of 3340	3440	msedgewebview2.exe	87
PID 3440 wrote to memory of 5216	3440	msedgewebview2.exe	88
PID 3440 wrote to memory of 5216	3440	msedgewebview2.exe	88
PID 3440 wrote to memory of 5216	3440	msedgewebview2.exe	88
PID 3440 wrote to memory of 5216	3440	msedgewebview2.exe	88
PID 3440 wrote to memory of 1564	3440	msedgewebview2.exe	89
PID 3440 wrote to memory of 2244	3440	msedgewebview2.exe	90
PID 3440 wrote to memory of 2244	3440	msedgewebview2.exe	90
PID 3440 wrote to memory of 2244	3440	msedgewebview2.exe	90
PID 3440 wrote to memory of 5596	3440	msedgewebview2.exe	91
PID 3440 wrote to memory of 5596	3440	msedgewebview2.exe	91
PID 3440 wrote to memory of 5596	3440	msedgewebview2.exe	91
PID 3440 wrote to memory of 5596	3440	msedgewebview2.exe	91
PID 3440 wrote to memory of 5596	3440	msedgewebview2.exe	91
PID 3440 wrote to memory of 4484	3440	msedgewebview2.exe	94
PID 3440 wrote to memory of 4484	3440	msedgewebview2.exe	94
PID 3440 wrote to memory of 4484	3440	msedgewebview2.exe	94
PID 3440 wrote to memory of 5236	3440	msedgewebview2.exe	95
PID 3440 wrote to memory of 5236	3440	msedgewebview2.exe	95
PID 3440 wrote to memory of 5236	3440	msedgewebview2.exe	95
PID 3440 wrote to memory of 1844	3440	msedgewebview2.exe	96
PID 3440 wrote to memory of 1848	3440	msedgewebview2.exe	97
PID 3440 wrote to memory of 1848	3440	msedgewebview2.exe	97
PID 3440 wrote to memory of 1848	3440	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\md-preview.exe
"C:\Users\Admin\AppData\Local\Temp\md-preview.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4184.2428.14979182379567115786 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView /prefetch:4 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcab065fd8,0x7ffcab065fe4,0x7ffcab065ff0
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1984 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3308 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4484 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView" --webview-exe-name=md-preview.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=1988,i,12468065550702449496,12649003381491837208,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:596fc4a87043c70dfadb6587a87529b85391c1ad
    3⤵
    PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9688d4dd22bcbdae6102300d5277fcdf4d49302d00c50df8e5cd8cb756651e80
MD5 c455309e7299c8459fe521dcdc03611e
SHA1 480d161322e702fa82971ebaf3d1b3ece55434f3
SHA512 7676afe627cd0539b930b2054aa69ae99f8854173d2e7747e04280ae505a6e1bcf6d2805b9ac32a52327a131fe3520cf081061adb538c84ab301ef0e00c40c88
TLSH
T10AD012133215013CD12030730902A2082802D61F410A8100553C869D1A140600902482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 61f8856c4d8c83da8d8d3c845920a7b2b31f0379c826f22590f49740a4a147a4
MD5 5e73063965d10198381f3e25499ef2af
SHA1 46b837c30be1db0ea3f6231c486fd52a95037024
SHA512 e207cb6de0a8c0dc1bb04e8e2dfdc9d119cf9bd93565e7e7a27e9c74331170c9dcbc023b389ef2be5443892b2a9e5167841ede057ded542e8591a62c976dbb41
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3fba.TMP

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a3fba.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

b266c999-d7ef-4d7f-839b-c35294533dd4.tmp

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\Network\b266c999-d7ef-4d7f-839b-c35294533dd4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 814166fab4717b661555cf57a3cd0547b9ba68d5cc564e23b6592b6c066799db
MD5 a5651b188d6e3193289520d02657e5f2
SHA1 e8f0db78c9a05827be05fdfc127ac2269fccda6a
SHA512 7e0f65d620dd79484b4d1061b4a78db818754a1658f009ef0fa9f630234f5d8b466f0f11590420909824860095b5549808660b594216a682b146b8671e1cf1df
SSDEEP 96:stu/dUKx+Gmub9Kk3Bo5h16ZZs7/x+6MhmuecmjeMK+ggkV28XM1C7K:st2m3Juo+sV+FijAaCG6K
TLSH
T117C175026E28697B4CC7E51CBA397B43E2F9603275951E58EBFC461C08EA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

adb4670d-b123-4fec-8348-1f4e1c87a91c.tmp

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\adb4670d-b123-4fec-8348-1f4e1c87a91c.tmp
Size 5KB
SHA256 5701a862985d7d6dae8a55705628604860a3993c49aef613a3e858e025c6cbfc
MD5 cb8288521e0ec6e0af500eefee027fa1
SHA1 2daf99f720739ed93ab1b22efa8bc98480d6ee2b
SHA512 b9c2e4f232c5889b4bd01bafaa05c281abdf393418942e7551b2e307957cfb07b8e093972efa04d0725c548a3ef81d1f4f226bda1b652110d4b623a37c79747b
SSDEEP 96:stu/dUKx/mub9Kk3Bo5h16ZZs7/x+6MhmuecmjeMK+ggkS28XM1C7K:st2mlJuo+sV+FijAaFG6K
TLSH
T1A9C197025E28A97B4CC6F50CBA357B47D2F5603275D51D58EBFC461C08DA5DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Local State
Size 15KB
SHA256 7c63960d46c7227b758628d54044d88d0bcb81e0d7b03779c1f6cf61188d6648
MD5 03eadbe0d3e2f86f990f87c783a63e4e
SHA1 f078e2c45cb288a37694c2fd52d0a4564d6ff334
SHA512 d0cd765facfbad049e3de1d1688c2a16d524388d79ee60a0435a881c8f99032c8b726a179f881414f86e4804facc544b91c94e0327770b61a465c8c3c7e1a446
SSDEEP 384:isrv+89zHqlDNP9oid6NBSJvAN88OqmNX:trv+4UNbdP96mNX
TLSH
T119729E33E57CA637ADF38408B4876A077FB8609796C20AA0E99D5F8D41DA0C93317E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Local State
Size 2KB
SHA256 53cfb51c1790209b2dd5945e14fd7d78be1b1c719aeabdba4418545f64fb455a
MD5 9b8886a144c9787845880bc574ebf5e6
SHA1 de87fda1a9892c13c195353a455ab2c6793451ad
SHA512 a1cfde599b16ed64bbb989a9f55e555c50d43bf8dd4f554445958cd5f53555d9a11473b297d206a69fb3f9e2d509bbb062e7a478af46ec746ccae52d3f149639
TLSH
T129518E33A9209A37A9E2854C7A4B7B57CFB491A1AB422F10AEEC0F0C01C684C3307C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Local State
Size 3KB
SHA256 660a83aed4115d9826a63cf1af61e59cfbdc24d53c4b26e1d887e0dbfe5dec7c
MD5 eed6eaa90e156797dc37a6adadd39232
SHA1 c5f696b248c08017333c5e08f7e5b3aafa054670
SHA512 144420e02117c063eb74fb28d474d8860dfaf5819effb73c88964264e8880e4093c65bb729920b75c06941c56195c53e8ec04857ea44744197dc47727ad61800
TLSH
T155719677A96099375DF3890979863B06EBA05177AA827F51EAEC0F0C01C728C2353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592aee.TMP

Path C:\Users\Admin\AppData\Local\md-preview\WebView2\EBWebView\Local State~RFe592aee.TMP
Size 1KB
SHA256 12b0ed54a925d6a4d2b846f2ca3b24ad1b063400c57ffc082d0517837bf29127
MD5 f362219303cb9b94141272716fd00143
SHA1 bec344aaf123e17efe00268607c0fa7ac41652b0
SHA512 6c5ac6e703bd03b34f1a9e3fe04f497ebb7386224282f20c11ed5964a432d4b003cfa7a832fd299d0809ae85a80c10e190970cd8789d6473cd8cc792db93bb87
TLSH
T1913152B2E5A45A32BCA2914E3112BB87DFA050BA53124F0079DD8F0C42D684C773FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1844-324-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-326-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-332-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-335-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-334-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-333-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-331-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/1844-330-0x00000265C1080000-0x00000265C1081000-memory.dmp

Download

memory/4484-243-0x00007FFCCC3A0000-0x00007FFCCC3A1000-memory.dmp

Download

memory/4484-242-0x00007FFCCCB10000-0x00007FFCCCB11000-memory.dmp

Download

memory/5216-192-0x0000025102570000-0x0000025102643000-memory.dmp

Download

memory/5216-31-0x00007FFCCBC00000-0x00007FFCCBC01000-memory.dmp

Download

memory/5596-51-0x00007FFCCBC00000-0x00007FFCCBC01000-memory.dmp

Download