Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2023 04:57
Behavioral task
behavioral1
Sample
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe
Resource
win10v2004-20230220-en
General
-
Target
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe
-
Size
642KB
-
MD5
795aacba9dac3f2b90a4fa0967f43963
-
SHA1
21ec7aa748b7215a1cd2b6af505538706f40311d
-
SHA256
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad
-
SHA512
932dc696118f9d5cf42c5b0b626bbf75d2540535736b8af95ed2be720abf80b1f32b3057f3f5123e429dce48e6a5d01fad736908bc2280c84ebbda0c0c0a13d3
-
SSDEEP
12288:AfOMTqlIilNtVhyqGxwX0SC/OXVptKGA2WQ1+FGZMSIzjsmLD:AfTqlXxhVv0SC/4VbALSIzgmv
Malware Config
Signatures
-
Drops file in System32 directory 22 IoCs
Processes:
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exedescription ioc process File created \??\c:\windows\SysWOW64\yytmp1\1643457570\fj1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\opfileOneA 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\1643457570\yadviser.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\filebak 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\opfilejlA 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\syys7.1.1.syw 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\ywsinid.files\25.bmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\1643457570\sx1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\1643457570\1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\ywsfiletmp.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\opfilejlA 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\1643457570\1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\1643457570\lk1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\opfileOneA 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\1643457570\mu1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\1643457570\lk1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\1643457570\sx1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File created \??\c:\windows\SysWOW64\yytmp1\1643457570\mu1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\1643457570\fj1643457570.tmp 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\filebak 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\69906532-68f3-40cd-b3ad-55f35c1f1cea.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230316045752.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 6 IoCs
Processes:
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536" 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\EditFlags = "65536" 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\EditFlags = "65536" 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1508 msedge.exe 1508 msedge.exe 4736 msedge.exe 4736 msedge.exe 4392 identity_helper.exe 4392 identity_helper.exe 1420 msedge.exe 1420 msedge.exe 1420 msedge.exe 1420 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
msedge.exepid process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
msedge.exepid process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exepid process 1204 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe 1204 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exemsedge.exedescription pid process target process PID 1204 wrote to memory of 4736 1204 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe msedge.exe PID 1204 wrote to memory of 4736 1204 377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe msedge.exe PID 4736 wrote to memory of 1160 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1160 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 4936 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1508 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1508 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2020 4736 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe"C:\Users\Admin\AppData\Local\Temp\377a55d325a90655aadb2f44be952682cfbee2d9b922064447481c5115b8e5ad.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.51kj.com.cn/bbs/index.asp?boardid=652⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0ab646f8,0x7ffb0ab64708,0x7ffb0ab647183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7664e5460,0x7ff7664e5470,0x7ff7664e54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1044 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9505942622257039218,12555887993285621352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5462f3c1360a4b5e319363930bc4806f6
SHA19ba5e43d833c284b89519423f6b6dab5a859a8d0
SHA256fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85
SHA5125584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d2642245b1e4572ba7d7cd13a0675bb8
SHA196456510884685146d3fa2e19202fd2035d64833
SHA2563763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1
SHA51299e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD576c2369ff5fec5456b8d05ead34cb2cb
SHA180f7c1a2fff7af4c830802ff80c624abecd2c5f0
SHA25652a034d5fdc226e92b09be81f6f720bb9cb1ec59194cf41cfa48de8f5e50958a
SHA512708a838e2b4c3f7f214b23644a06af4e92331b441d61c8ba30b8360e95467bc2c42bf4c13d7112785e48346085be171178c73f68713435bbc286597e1dbb7c18
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5812856df35b0d360736af2b0af0e3626
SHA1dd492fd67eae662221a1732e81d2c5819431ee15
SHA256dfa1708e9a4777afcafff852a1a8ba4136a6550ac0bf4fe3e2bcdd11e05d7180
SHA512f037d295fc31fc8fb44ec5b3ebe59a6e0d7515484e3540e74b666c3ccd58ac58079324caa9a4598028f77fe9b4a77d33506c3d2be3f3fdf37390e440e89b4a7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c92006198372e59e14be6346d380f1a6
SHA12ea08c28ca7f8d772709368eac2992da8abfe4a7
SHA2566467177870c97fa3773f53b91f093ae6a8a793937f8efd7e61ef2bb9c7291ac7
SHA512fec88af44d9e6a252362fd1e5f5083252404c3392d9a470f6d0ea4976347caa70159dd8457f7fc5c5f6eefb511378218c14f43f0808d2b9afeb2713cfcb90359
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD50a1ed244c47ee00e49cc427caeb19c8a
SHA1a76d7a9319137fcd34a17d8c68e9cee5c5a01244
SHA25668db28c9ce11a5560e04ad68769e210e657e004a12344ff4b90b300f03e41dc2
SHA5121d203c6f54b9ff95869a92c99358cbeb5dd11c458e3b1a5820f9ee40adc5ab04bcd73c7113ff7cd68a12a4c7b71378a1ba0be7f88a022381e88691058e70a533
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5130644a5f79b27202a13879460f2c31a
SHA129e213847a017531e849139c7449bce6b39cb2fa
SHA2561306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1
SHA512fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD57579486d3c5d0076c07cc7eb8007ddab
SHA1184cce561873dc23d0c9bc894d399020a3967517
SHA2563c7f1f70202ac59aa8e497620ddd1df5e1fd4eb2a54cca34f18f96e611310817
SHA51270aab55fe298776b08c872a2c27d6a4a4dbe131134bdad2a38f8e41234cf5b685884ad80a68f87c67488ed212630d87fc03d02d76171dc193624ed6b2b94b8d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD59a1ec10cb155d5a712943b567916fb55
SHA175baae92c99bc6a5ebda3d42c3ce9bbaf42543ab
SHA25634eb144b98be41929164ed3c0a41cdaacdd4d6fe46ee19538b9fd94ea3b57932
SHA512f6713060275f5212a6190b2a98e7884aa60876d0864c6046f917d7d318e6cfaa5052c77319cdf8de7f82f159a428830642cabfbbbc65cb15e8ff4e9ac63a531d
-
C:\Users\Admin\AppData\Local\Temp\18480\10785\10866\1643457570\ywsinidFilesize
8B
MD590bf63fa7217a4e5a60f421b64ab30eb
SHA11614df9f3cb1b5e1dc040b2d7dd942f355994509
SHA256e6c767aaabb678ed4d3fb4f5c9193c55abf9739f641095705e94f198f08010f9
SHA512b88e6d9bccdf292ef62a18f9d080b7bfbbc893f5a3b892634f855558adc6b332e158a629365e0bf319c3d949215f0b878837c2f813b087769671fced831a7955
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5aa234fb4ec57660b16c38780fa849743
SHA1fc6533077202e2511032d60926eed3896579875c
SHA25677537dbc105548b1db4fbf933dbeb3fc03ba2010b3f03b26f447f5ecc2996d7e
SHA51232f1962f38391830a4d9ce5057fbc82c78d555579b68f3659daf03acb3caa1997dd7ee426ed8ef2d1d40034011fb881af728f5aa467648543b358cc8d0d1af0f
-
\??\pipe\LOCAL\crashpad_4736_CVWAKXKSXIEHZWHTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1204-133-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/1204-338-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB
-
memory/1204-339-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB