hxxp://nl-verificatie-identificatie[.]com

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2023 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://nl-verificatie-identificatie.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1132161186"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\nl-verificatie-identificatie.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "99"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6EEFAE88-1FF8-11EE-AF72-42F81B6E1B82} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "232"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "232"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DOMStorage\nl-verificatie-identificatie.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "99"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000929439ee50e204ba4f4b605da59efba00000000020000000000106600000001000020000000ccf80613f08253be2680253e1448a7c4d62db8ab55b61e4aedd06f1c89114086000000000e800000000200002000000082d56fff14b24d7a1aab8ea866adc336e9540c1e84491d49d51053f1ae4f635e200000003bef2577ca2a4e110b169ecb8eeaa32747d9de75ab72239579714aedae66718f400000004b54e3c06af787fe520b04885ca7360902073fd8bae576a2e1d3aa2236760ca65dbc5691b584949b7ae925fb3bee053e6b57dcec31563ddfba33891270cd5bca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "232"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395851212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1132161186"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31044613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1141225264"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000929439ee50e204ba4f4b605da59efba00000000020000000000106600000001000020000000b64370e9ac674d3c775f30617dbd1c64551b3eb221237887ea5d176b9681d6d3000000000e80000000020000200000005611c324f8c622e2c2b5acfc24a7db437f65538c0dd9dd39853f9f51be704db22000000087029dab4f6817cc9f4979fa3fd988c198a5589cf9081cd9e157506180bc7b6f400000000881a60807e50268e98e8d9fa0450c645f82cb7ce7b53049b5a365be05978cb8b8783f6c2defd160ff2990ff9e2ace01cb1bff325139459c8c0b7a661d9c1780	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "99"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044613"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b0e54405b4d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "60"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044613"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e2cd4405b4d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "60"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "60"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
3876	msedge.exe
3876	msedge.exe
1156	identity_helper.exe
1156	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3364	IEXPLORE.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2336	iexplore.exe
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE
3364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3364	2336	iexplore.exe	85
PID 2336 wrote to memory of 3364	2336	iexplore.exe	85
PID 2336 wrote to memory of 3364	2336	iexplore.exe	85
PID 3876 wrote to memory of 3780	3876	msedge.exe	107
PID 3876 wrote to memory of 3780	3876	msedge.exe	107
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 2232	3876	msedge.exe	108
PID 3876 wrote to memory of 4960	3876	msedge.exe	109
PID 3876 wrote to memory of 4960	3876	msedge.exe	109
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110
PID 3876 wrote to memory of 456	3876	msedge.exe	110

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://nl-verificatie-identificatie.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa2e1846f8,0x7ffa2e184708,0x7ffa2e184718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9526189245315456543,4431549435868658936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
ee794798b4bfedca3a25830c7a153cc1

SHA1
03ffa211a0081f1e14cd47dd0f7d3b410045143f

SHA256
96211b522d7388b6fa692d2a0a63cee8b6b2a25d1018f69574bf5edf9035c621

SHA512
4a3b4f5d1422421daa3cab46632a0828eca852b93796fb12e23b2ae566a0ac2e02dcc12ed5ca87f88b9003317a96fd3dd1427057fe0b94a09c6b84bb8e11001e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_623FAA77B691C464154A0914FD511FE6

Filesize
472B

MD5
6ebe71d23e40448884db51295ed01432

SHA1
25234fe6ceb4da24a3262067695bdafc777a634b

SHA256
565a3965be8ae010d5b140a2f5ad93fe365bf31ac1b3080a2a0fb29d76b9d065

SHA512
74de0207a393fb93bd139ace998f985ac4519d37eadd9dc257736929c8a1a9d1a605ceab4d195e1d82b9f4958944f8efba18914c2c9b613a93e3452c1281660b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C147514003969A5579F97B4D7F9F9AB9

Filesize
471B

MD5
8bfec2daa6328f18a08bf4fad236c326

SHA1
a1dd88fded20ee0f39bf0450834b9347474925a6

SHA256
fadaa3f079b9995cb7e032b01aa5e668cb3c9069cda42f1e75e28ce70d1a23bd

SHA512
e2491fd77862a1aed1982d53fb4b837c586788fcc6ece85e0d4ca9a609616e655fffd450c7cfb24de1c313d4279b2122a9864cfe09af864e9368593f2c562c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
452c5eeb2e0b5dd82e8f969d458db857

SHA1
4c614565d7a8f1dfde4910546f65f72f764dd648

SHA256
23de608b79668487393b00fd45e17877b7f41411b3300970384044aac869c95f

SHA512
9193ca18f9d117c9402b62d9051606da9d19c1235cd71d6b8830591c6afb35c95cabd76dc628c9e9eaa09ea2f718e6aca07b3749be1587a286d6cb59a6424f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_623FAA77B691C464154A0914FD511FE6

Filesize
402B

MD5
adde31bc4e66185cb51cbb2975e4fa07

SHA1
30061d6521256cdf594f367bd8ba2497ac8f51ba

SHA256
f7279ec2f4df349cfe309867a5c5c526f83203b3c936cea199a2fc5726ba096b

SHA512
ce2517d45ff3422735ce3bf9f042c0a7bce94ef58504f651161ce628176d933a86220c887c84ed7fca4b031558504c720c9a906a1106592514da3d805c317678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
8bbf790f27f1c7665f2c201ed6c8db49

SHA1
a3b5574a046e87781acd0ade05240e3533813d7e

SHA256
bdd1a8c1e60bf5d69934650f2a5fdba1d5eff59ec1fd54af5c9c051d9292b407

SHA512
c1b64933a138f44750ae55fdfedf997f64772ca74e498c075b0275256380a807e2d20d24fc36ac3eae2072db8b0e6d9017f1eab4d61adf1fe80458f5a0ad8ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C147514003969A5579F97B4D7F9F9AB9

Filesize
410B

MD5
f6fb78ac39c13d00228cd1ff2cef1215

SHA1
7c4c3fa711538d80f42e10778282bf9636a862b1

SHA256
54465e0670ea553b52820b99e0360679e7862716bbf35680a63b8bfee0954450

SHA512
4222f3d8deac55ae3d244c42ad7ef0a1f6e6f017f8532c07f750d2fde77fc60ab1226d7a7ddd565537b9fda7f2eed508fb06bce6432929e80943aa449f034a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
171KB

MD5
7a88e1edbba1ad7bd345eb14f1377a59

SHA1
b299cf2eacc2d17d1f2fbda9391079b6f05fb022

SHA256
3f6aa29738172f431b8e2af2e39cba0c2f91583d7bc23f988c7b7b35975bef2c

SHA512
48870540a5e7aedf4513610e23dad5d37ff48dde92909345771f7235d4526893e65d11915b46191e62dbe6e9bed4626215703fc90932bdebed356568c1557f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
581576775484df0ada8adc23981e7553

SHA1
923a8abbbde59b9679db2990547e504bbd8ac94a

SHA256
3d5916fcffadc93a3042e2a80f01e484e5011edc93d197abc496ae464a9255fe

SHA512
6ba18d989290bc2839caeb1bb60581cd3dfc1acde2f0978ca80801519f264321ce965ef41b3fe26a395da46cca0fa8190b3f077c4a3ad98b512a1882bd6b171c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
919B

MD5
a38c36518ec75f381a365b08c74d8acf

SHA1
8a2fd13d522fb30635c7c92315c11f94b0754431

SHA256
ba73fd5afcd5a70baf035816a40f6f66f6edad1f69173d345df07deddf7f1220

SHA512
5fc0871c597983cc01f910e4ceba3299b3db4697c740ca473e81de950d81bd80ec4f2178989a044b9be31173a0f22864ab9c4ee534005bafae40679ce91c6f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94cb571685c6d5a53c33cb88d5dab69b

SHA1
9c765e77caae2fb459289c7b35b7369aa765f58d

SHA256
e823391693a4e1f3a2350cab5f929fee16054af5c7b89628542f5b0f5e8b0a89

SHA512
b27062c33cb57448d3dcf281ac403954d8d284bd4d7e99b367dcf147fee776d3f3ecbcdf1ddb70a1922018c8545a9c9ce089eb79b16edfd07f2af91acc8885bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a528312d1e74f677ff6c7a3e60671e9

SHA1
053e956220f002c255d9fe08d9a58fb0519de773

SHA256
3722bd90e15b09457aa028ccd80241362cfa22169479567013e93fcc207a632d

SHA512
c84c5ad1b9c11cda5950758c605b3c23f602d582021418dc838c67982266dc1ffb328255b68b68c62a017ea891b1f0ed18d41aa9ec1be95f8bab972a0788888d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4419135d4a783920430378a6891525f8

SHA1
f888945fb2e40becd8d0e103b12a734cf47a9d99

SHA256
0e5a6919dc5a8eb2c88a6636efce230c7bb42c751792305547bd3cd35bc3b6bb

SHA512
ea6aeb61cddc57f6f3320fb42703c540c9cddbf9d60d3974dd6bde41f0667c8a3abdb07ec73e092169a35b953d331c1f8784d3e51f21b1eb5aaa759b53affa6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
97f8830a4f4c827fecded0d873d1b3ba

SHA1
fe84f9b434a7c9fc8c583c3f0d3f2bc45d5ca2ae

SHA256
2240d2f825e19735635e9e7c6b55bd8932063c83b29c748e0f1179b76551a170

SHA512
41420e7fa9107eb8e5e64d19a652574cfdfe46a88ae76ba95c0887dab7ec23cbbba6d8683d6a11874fc2c675e9a8b36a3fe49723e130688c015751affa3fae1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9fb8757470a390a04e85ceb8aaa49c31

SHA1
dd8c5ef821f3197da9ef12e06b8174e094f70464

SHA256
8d236c6009c8a0f174115c0bc2033fb026d4d21351be07d84dd414dcf7559eaa

SHA512
48f615d1c4a801f605a73d106690cbd6c72ebf9a69821e10b4b1892307ac5fa73152110afcaeb33872f988177d7f5dd28f7565364bfe53b0b1c0a2a6fa58f946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\AP0URRC4\www.recaptcha[1].xml

Filesize
427B

MD5
10f0b8b3aa730b22a3136734ff5d7dc2

SHA1
87cc6d328797facc3828ac7fe0c47770af8a8757

SHA256
0578b4162fe47f7505ebd46cc9bc8f75cb9fb58015b5085e34c9e587a2c83935

SHA512
a35149334934bd8524a78c534763880d76ce07f6d07c42323b41c25b48bdc50d1992a44ed8a43cfbcf08ed8d1fda6a21fb81663e9522373c822e67bc9fdac071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\AP0URRC4\www.recaptcha[1].xml

Filesize
94B

MD5
0a1b28c553022e9892bbe1f7e69ff51c

SHA1
ecb06021bd45c020e4c142964a1001b9975817da

SHA256
bfc112a279e8861d26c4ee23f10538a8745041f86bb62af1db1c61ca5d9f1e39

SHA512
e3e89a3e04c0e9e6b77280a86c68a70de0f7dac2a262a170c2061b837c5cc701e472dca299eb69e5e489ba5f6da2f06cf7fa204b94186e540fef747998f2c7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\styles__ltr[1].css

Filesize
55KB

MD5
83f90c5a4c20afb44429fa346fbadc10

SHA1
7c278ec721d3880fbafaadeba9ee80bdf294b014

SHA256
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

SHA512
4f0d19678a6758e67cb82652d49ee92a3646c3b4b68b93253c3e468e88506bb8ad78942d7be244b390bdd29a0d00026ad561c040c1b557067edc7887fe7119ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\42JDD8EA\recaptcha__en[1].js

Filesize
427KB

MD5
0412c030048db82d958eadbb899b0b6f

SHA1
e824e0fc5680eefe1141418a61b63dfb6bfa1f8a

SHA256
237f4a5b7b8e81b7ad01c54cbb6205368aa9d55e1d6fd1ef38454facdc01353c

SHA512
52b7db6b9b10ffc74810518205bcc7cd317b9634ae8a5a7d8670832fed1a6e26cce783402e8aee0024c09c2f7f44da83d74e6ff2382516b35dd1a884a6d5289f

Download Submit