59fad089566df30b8d7b386b35fc922fc4c059b5399f1fc89dd0e435c2ea7a9b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2023, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

best-buds.png
Size

238KB
MD5

3f9245caaa0d7a3e9c29190c2785ee36
SHA1

66afe3697afb6d9cefeb8934254648869c4be6d9
SHA256

59fad089566df30b8d7b386b35fc922fc4c059b5399f1fc89dd0e435c2ea7a9b
SHA512

097b7ff34c9e2f886994af09169da5cb98db169d1cd129f703bc38abf0110efbb2728ab792e5049234221803730877772155148211feb22e73a92ab66e55ef12
SSDEEP

6144:YDvBVOyYKguUq+rB11vxDLhLbYUDr2x4ppBAIEo7cltn+hno6:sBV/8DxxDVLbYnaFAfB6

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\033b8a94-4876-4cde-a71c-e2cf9a6f0e1b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230603074533.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4168	msedge.exe
4168	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4624	4168	msedge.exe	99
PID 4168 wrote to memory of 4624	4168	msedge.exe	99
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 1072	4168	msedge.exe	100
PID 4168 wrote to memory of 4268	4168	msedge.exe	101
PID 4168 wrote to memory of 4268	4168	msedge.exe	101
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102
PID 4168 wrote to memory of 2680	4168	msedge.exe	102

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\best-buds.png
1⤵
PID:1704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd747c46f8,0x7ffd747c4708,0x7ffd747c4718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff687425460,0x7ff687425470,0x7ff687425480
    3⤵
    PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,53336630348062585,11738122005742170366,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91fa8f2ee8bf3996b6df4639f7ca34f7

SHA1
221b470deb37961c3ebbcc42a1a63e76fb3fe830

SHA256
e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068

SHA512
5415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
f20b0dad98e24d5ee8587dc7d43322a5

SHA1
4471bb0a2f8e8e516bbcd71022a16e4c8c74b6a1

SHA256
4f1d1981dd05f864f7476d5ab1ccf3461bb4a37b6ba2c7c8f9d8d438563c85b4

SHA512
a24d37c977937abd1cb74d13758c9754be101ecfe0c6047323b0616f511f00d89d7f4ecd25e422c95caf3ce0b3290cd29b7da3fe643702b75a8d7acd89641fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bf15.TMP

Filesize
48B

MD5
1191940f733773361aab24c194e014c3

SHA1
1f6edd927f91169bfc1f50321a20e9b660c1d198

SHA256
b1bbe282910a0ec3496089f98285c3e7d7fb28855a80c7ea081667b63fccef9b

SHA512
c942f89b0481c668f917d61d7bff64ad8dfae10ac827e282aa340dcee234a258b97feb7ce910f65a3f6cb788afa9f814191a2da566eda1ca853e209d6fa809aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
4f399fc59e2f9abd45f68a8c406f5cb4

SHA1
18f32c10a96f7e0a0b43bfbeb4735925b1c6ad84

SHA256
9c6447be6cc4cf15cdd05a75a533b7decd9e8e7ea1b28e44ee3a15072f71d1ac

SHA512
e9f7854c62d5c5e8a9b081f3c1f25c17d4b43eea90593e9b68ff16c6ec3874e46244dd0f5b6c075d47fbcba55c5594b419d614c5eab096a8f7c6e5db03298dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
f36886795191fe8026650c4fcb3045f4

SHA1
5492c2a17a25f021b038979d0e87fb68239d6ff4

SHA256
b9860483473973de58ff33b75dd038c27fb3009c0f500e3f95042a4a019e808d

SHA512
a4cdf1a1262fbb2139de77127a16f5d5cffa3ce8985e097c0ca17375c2afebdc3851b2ec17047e6dd197cb1bfe023065ff857aa1f75b479da8d01423324215a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09e94ee200d5003e1e1046c9a255ef5b

SHA1
ee5679915fa86dcc45bbce4a26aa0013f3e8526e

SHA256
40c5b5dbbc7d858a4f88b97b35aad1867288804a69a24b186d7eabd2448516b3

SHA512
af10fbf8c3e20a3c76f2f1a186c598b2a5a012a23312958c11a4281cfa989f578a697234b567fbc881434be567c73a5bc0e490d4e8a2bf7c9f406ca148ad88ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d0a35363b7fdd069e1c47167a1e4c0a

SHA1
ff123db1285426e00a4430fd5d475dbbc8fafdc9

SHA256
1915669fc7cedcddbfb42b54eae7dea8a69cefeacaff0fa3a2059bba4d7d732b

SHA512
a3500e1e0011cb0d94a0e566fa5fbe8ce0f1edcfe15c5e447b20b91a189aeaa257fd97e6956ce7636945f033d9f5a86a32ec6769abe833cd29ce33304fd5c7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a28096c6c165b5325e8878d9aeb72a1

SHA1
29e6a81ab48c041aaf8eb6f63588e2769da908b9

SHA256
1a95d5a999e56000ef9398b4d99759b8b05d1cf0f269b43d29ccc6b2af3a5b93

SHA512
23f1b9bc0bc5127aa747eeeca7462dc9198b8aa2d6288e77fd5b9a3aee545a2e66ff3745c9d51b7026fd6015eaf04173c9db6bf69795133176397c94c70d7b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc2cfd1fbb0f1e4303fa1463337142ce

SHA1
9d2e0ec7d858fa3c8ff37bff9d0c54257f159381

SHA256
09041ebe745d968b9111a2d0a63d335e33a116d446e2214ddace02937e4d0dba

SHA512
fdd8445e562502e7bc5eb13cb4590b2ba6ad6213827e4418084016e5ef274a73a9744344b4def873ff62d5f375c064e73fe4adb330fceb0eb05988befe41fda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e5ba0451ff36f3ea9e13836ff06ff26

SHA1
29d9432a220b56a8aff2ec973bd6006dad895117

SHA256
be939c53dedb05948868aab0d04a7a31d9883884262e1da601e23cf95ca80951

SHA512
10247ac659e1ad79d1984e617f9ded79cbddfe9c69177968f385729cf7d934c3ca82d4da8ad5dc025336b2ffdb0fbb7629fc0c400896304a5a71a001d030ee9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1bb1f22c9ce18fad2fe5e703f8df6e9

SHA1
aeae348c7533ebd5f4e2653aaa35c14e4c2423a2

SHA256
a49d363453611d3199dca6d8155e4a179c45038035221874b950f486987a79bb

SHA512
ddc6cfafc53fd7ea7177d2c41510eb8bd0b274973bca11b6d340e35b00bf346492378af49f9abd77c0e96cf1538471c195c426024e82dd9bde0cb6dd384db4be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
55bc7050fcf887d5f6ae0e579e44a246

SHA1
862dfc888e4a07012af4cf355f02431ecf07e345

SHA256
a1a5414f4c8a297607d95823a069bde1e536a06d90da411ca95945364ac06720

SHA512
6a29325e74ff4399ecdf06e9fee9623a817508ac6c187f2611e801b5529fcc68ad65668c9aff5cb8f30cdd4bce95b848a8d3cd616ff292845c5ff0be766c18d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588e12.TMP

Filesize
874B

MD5
4db7bf2854bda82d1f1f9a8af321fe0e

SHA1
36cc5ab0043fb43b0b978aaf030ba0cbb8549394

SHA256
43ba6226f0577aa624af7156b5473162a9b440115f498aa5b267349aca4c4cc7

SHA512
4a05ff897e354afedb564327f660f8f6ae3420833e178189fe93d780ec704696197c87456e24c5f4d5d8ad3fd67508b5333c190b1721184e53a4458904c016b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
1d9eee441d0f85b7b7419cfd3272556d

SHA1
05303f8b3506559a48f2d6c3c62a8bf369c3201b

SHA256
b8b0ffcf0d9a8de8c6ab13ee3a53a30424cc5f48281301b10eeee976b10fa713

SHA512
100ce37eba78bb054e0d2bcd294b2baae5e8d9c4472a115b8fa8af6d7e58f74f6eff9cf91c4eb8d3d2dbc484b08f6314dfcd2908a443092f7d24d5a4f7365b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
39e8ae4c2817b6d31b12ae07b38e27ef

SHA1
58424dfa8d72cb5385971b9645766ae0b5563323

SHA256
40529a49aacb4c0fed87d9e0f749d35703c2758aaaf1cca1cb2d31947afc81ec

SHA512
9626ea26ebdedc691c484aa34779749674ea335392675d0f61f4ddfe90d96a38389736cfec9c91f83dba69c62c7897911dffdb201ffb425d59373329d33214f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
59c68bb1be25acf2d370230f4574b6c8

SHA1
cc91680b6e95e83942d98d9f3de1c75463e5c670

SHA256
ee5ab6632dab1c95e15a0722cc14e83083f2d22c279a34da012fcf03378c9f4f

SHA512
32d77a2f638e2e2f0583b6c9edcf270446f053df7cc6554e280a10b3e8effbbe90941b7168d2ced37bffa82ad2953a7cbad8912fc8945f8451a2d6eaf7f98794

Download Submit