hxxp://msedge[.]b[.]tlu[.]dl[.]delivery[.]mp[.]microsoft[.]com/filestreamingservice/files/ec243c2e-e29f-46d6-92ef-c60f8cfa76e0?P1=1691179353&P2=404&P3=2&P4=CN3Ekzk8AVmDR8pO6unoJ6aqwmbG1afXbtmBLNMNxvDo2B2EcggqSUtwP9wK2XsKw491bfKFm4f%2bRRxNuTxfwQ%3d%3d

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec243c2e-e29f-46d6-92ef-c60f8cfa76e0?P1=1691179353&P2=404&P3=2&P4=CN3Ekzk8AVmDR8pO6unoJ6aqwmbG1afXbtmBLNMNxvDo2B2EcggqSUtwP9wK2XsKw491bfKFm4f%2bRRxNuTxfwQ%3d%3d

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-618519468-4027732583-1827558364-1000\{DA5238E3-9C01-4782-AA8F-C56CFBA1EA54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3408	msedge.exe
3408	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
5520	msedge.exe
5520	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5592	OpenWith.exe
5948	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5948	7zG.exe
Token: 35	5948	7zG.exe
Token: SeSecurityPrivilege	5948	7zG.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
5948	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5592	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4540	3408	msedge.exe	56
PID 3408 wrote to memory of 4540	3408	msedge.exe	56
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 3632	3408	msedge.exe	88
PID 3408 wrote to memory of 4456	3408	msedge.exe	87
PID 3408 wrote to memory of 4456	3408	msedge.exe	87
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89
PID 3408 wrote to memory of 4004	3408	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec243c2e-e29f-46d6-92ef-c60f8cfa76e0?P1=1691179353&P2=404&P3=2&P4=CN3Ekzk8AVmDR8pO6unoJ6aqwmbG1afXbtmBLNMNxvDo2B2EcggqSUtwP9wK2XsKw491bfKFm4f%2bRRxNuTxfwQ%3d%3d
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b73d46f8,0x7ff9b73d4708,0x7ff9b73d4718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1681968227680014390,17210128324963284472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap23880:110:7zEvent31792
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
173KB

MD5
d3d1aff7a71e5f6f4537a0b3cbbd5c23

SHA1
82bbaa35980290986094ec5b2f33da17fe0e1ca8

SHA256
d3ac13e9bebf6119830ea38adf6715f42a193e7cc5834087abcd77bec3c07291

SHA512
9f5a8f657438a49e2b60db1372ced7edca4ca714efc63ff8791ff232d4252178b5a148a02b049f279007f095e7ac5b649367a2fb3dbffa14b39b637f1d30d42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c26316a88c84a7443998e7c191600b6c

SHA1
2642bdcafe715095583e65d648bb3cab17dc92ae

SHA256
2005a3ffcdd32931f45487c99fef90d84192d3e58fe616bd9ca883ab7bcf1e29

SHA512
c7c97f247bee278aa54e9e917a7610a3bd76389b6951ad4766aeaf44cb8ddc78f0f8dd81e203841c06b6fbe9f0860e487e3b85c1134f7580b1631314878b4bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
891110b3b2835ac50dcb229a04e58cd8

SHA1
658c730b3f5aef8c32bc2741dcaf7a706ec8f1ef

SHA256
107f37a367736cecd9c76b65200224ffe908ef317d490cc2eb66690340bd46f9

SHA512
dd47efc98f96c0bdaad01c61904e6f806b1e5fbfa17c44b9c5048a13f062cc4c9dcbbf368180ecdf4ee5d564caab66d4f9e1ba11265c382250362a5b43419122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9816ccdddb36684bbd4b935bf1d6f34

SHA1
624e517461b8d66c48f7a831052b3e16da1017bb

SHA256
dc4a99c4ae07ce5082618dd794bca1a491585b6a1a76c832f0d50614a6f423a5

SHA512
45385880bec0d4fcb68cdde78f53650f6e5a56f2afe65b229d3c76573c60a5508c5d6b37a2aba27b216e227de1697f2d01872d18cf929ce161fa20e0e917707c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
891d44a65521cf800d6bf732266e197c

SHA1
5109e1ccdbb8698ed71550db81c1ac9a8a5c7595

SHA256
8923f634ca0ede52b0bc6ee76a329b89899685dfb6489c8da13cfbafc08e9855

SHA512
187bbebda42e76a4bc62af982c303783d9cf5b8171136a4d18b576d5c5747d6f6692542c1d66d243ed2b629b7162de5ef7c4d9032591cefc06884d15809c4149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b65c4b55adb09fd5726a3eaafbc292d

SHA1
69f3c6c88400d4c0c3af6fc2c6b69d97401f544d

SHA256
71f33bdd1457b6543c5aa8d767de5d208858802b84f85fd9012eb7837ff10e89

SHA512
d95fc0bb307a15ead1ed77b24bed7b9b8deef1e9da9943d74c736fc58b090c762343b72d3be36755bdedd8a4bda44a7f2de109b33327d714d25144761dc860ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fd6f26d4c5b38049025e08a75f89dbd

SHA1
b224eeca2e5746d607992ae2d40ad66e58a7b8d5

SHA256
326fcd615b53a11c0b397c8b6aea55bef7fd97d831110350b120bbd87b6da038

SHA512
64d18838626ba0a6fea6e1c078d5f81f0a0a5fd27144b90d6e7ebca8c3d495272d0cd9d5a88bc4250de7804333f6c943964b67c4c5013c413618224c7bf8a04b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b2c4b41696a1936166a93435746a5caa

SHA1
863f02004fc0e153441d84c942da6c7e7c565ac4

SHA256
f9f61cfaad4e4ae46c9411cd7ac8d9f506c2bcf2f46b5734d1c6af2494e03ac9

SHA512
eccde82e7d11fd33082380c145d70702561acb88c5af0a6c7b475921a2026b5051c5ef558318bac14c4b35ac17182a6578eb39cbe39e46e70617d3f32e93ab88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e6e0.TMP

Filesize
48B

MD5
35f190fe00d0044f305e43759fc7c3ea

SHA1
f0a4d0a39452507512495ed4846028a322f36421

SHA256
aa9189f0b46b9f4592752e133c432f7f4fbe1f89a8ba219bb84d674bd2291f56

SHA512
4c863f0c52ec1a96664bcfc869ed3adc35605d8a03662854e5202e0f17afa64165be1785a1acd5ea936a27ab1c46873862b2984798dba360c6da608798bd4c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
62b58df2a86216114a6e2ef5a5472e61

SHA1
212ff639c69b710137f0ab896ea7c72c7c98c8b2

SHA256
376b6d3fbecea2c53c6041a86706f8bdb961a3d9626c6a01a217dd52403fcfbf

SHA512
81d605d05993b80eab616c2f581fc77919ed83c4c4d3a2b3d8d2514ceee47c4191d73a8d726bef8bf269cedab415c03be0bcb63f1244899646958542d4ac4afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b76e53fabe1ee46600c9218fed09ed3d

SHA1
f416fad8d260c504f6ebefd80fde1ac0c742f7c4

SHA256
d44b5e628317dfe7707308ceccd3d5ffc24ba412f08267a40eac4289b51e4b8f

SHA512
4ec85b23ba96dfcc47ee46c006b7cb405273e88dcedd2bd99ed0e476aebec4c6d66e9b078155973a427f5b7f79856b577e7fe5b46777e9151e5162a0980cd46a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 56028.crdownload

Filesize
1.6MB

MD5
89f8c49d352efd8709be30c4316dac5e

SHA1
2591af346db8124cd559200bccfe8b2395e8dd0b

SHA256
8d49402afc138aac0369a89791bb5c29e823d19316b0161306f53aded664645f

SHA512
a691ebbf4a1756550ac7d1fbe6aa65e93b80e4b65acbba08dee7c306981ef966123f2ebaa98ba25cdbe1513b0d80f226e89fb6cd83488b061b5a8be5a96c3de0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 56028.crdownload

Filesize
1.6MB

MD5
89f8c49d352efd8709be30c4316dac5e

SHA1
2591af346db8124cd559200bccfe8b2395e8dd0b

SHA256
8d49402afc138aac0369a89791bb5c29e823d19316b0161306f53aded664645f

SHA512
a691ebbf4a1756550ac7d1fbe6aa65e93b80e4b65acbba08dee7c306981ef966123f2ebaa98ba25cdbe1513b0d80f226e89fb6cd83488b061b5a8be5a96c3de0

Download Submit