hxxp://domclickext[.]xyz

Resubmissions

22/09/2023, 11:31

230922-nm4xbahf32 1

22/09/2023, 11:04

230922-m59pvahe59 1

22/09/2023, 10:55

230922-mz7y3aff5x 1

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://domclickext.xyz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045988481-1457812719-2617974652-1000\{BD2A2773-6755-4641-88AB-9ED978E12909}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
4164	msedge.exe
4164	msedge.exe
712	identity_helper.exe
712	identity_helper.exe
2396	msedge.exe
2396	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3080	4164	msedge.exe	84
PID 4164 wrote to memory of 3080	4164	msedge.exe	84
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 2220	4164	msedge.exe	86
PID 4164 wrote to memory of 3904	4164	msedge.exe	85
PID 4164 wrote to memory of 3904	4164	msedge.exe	85
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87
PID 4164 wrote to memory of 4388	4164	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://domclickext.xyz
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe246f46f8,0x7ffe246f4708,0x7ffe246f4718
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17383688147329441830,16231440925883112773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
69KB

MD5
a90d7c369b2a589d9034e9a201efe567

SHA1
7afe40e9e4002a2254885901d66451e2ab0994c0

SHA256
7cc054981e642ae7bcbdbc78152eccb11b31a6d922ea1dfe61e749f8985e498d

SHA512
befddc83828674c9993b8912ea83486dcb04389e0d7b45a4e6c19b6bb5e6e0ed2b16d9247c2e633870658697131c094864d3cdd9a2a4c0fb17bb503ad2915b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
20KB

MD5
e366ff1043dd9af0d00c2f7104858de1

SHA1
87977ac9a591b2f543bf3a32d4fd28a92bd95cf5

SHA256
ec80eb09fe9e94e688b88803770962a077066e67124db3dff36d261182e10ba0

SHA512
322792c7ba87555c507cc528c833cee5c5fa9c148887d0991f1704ba2af7a945c8c87d1e11540b707cf5b7cede1813ac7e82e4b31c957bc48a3854e5fb7a0b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
1.0MB

MD5
666719beca7087c1889e811749bb3063

SHA1
8a0249c0ec987d173bd5443e0d57528109f4cbd1

SHA256
a3611a7726757be70493c9125a49d4eb36df16b15d6ab019fe052e65a3995ab4

SHA512
37ae602af66c2167f2c159725f59f055ac557aeaff22d1666c6b1d8d8fc172dc1bd7970943ba3ec10eea2d47884eef82283cad478af231bcac1b1e31cd059386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
181KB

MD5
7d0523c8f2a44a194de34bd42be8beee

SHA1
f46afa868fcfe7c189da86e69b3f3468aab47e39

SHA256
6191b5ea83557ff03488f2d3c2aff3d73a6360521c8eaf5f4747db9809df81c9

SHA512
18e0dbac8f74153a31b0a96fcca65bf3ae7398e1a4a59a5900ef1fffc1220e702c3e1ff11dd7e994f5432a0f89ca454b89838791affe45ce50034971a43a1c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
f53f4fe5356b976173ccf138c24aeb2f

SHA1
10c3ad4c91eaff8fb5af4f6da05d9b0118a82764

SHA256
a7b4330dba1c41d93330f2a2d5d4409b6f6ce60bb3754bdb0689f11f3812a1cf

SHA512
ad5295ea3a3b7670baec05d53093b23189ce9539de59abc903cffb655b57e61eba432eb5b7a4a26c96114cc8c12a0065999dd9899f194c58e3d8b7021e9e4ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
06bf2a58de4db2fea191c710baee47d3

SHA1
c8c69b5745afac23c1837c3796e8d8af2d637bb2

SHA256
9c1701b41e5cab15dab96ad12c62f08a2b3d2696dab399d17733644f9d93ef7d

SHA512
911ad59e118c5a274da6ba6a3e95188b9d74fd0c2db48125bece444200e47100374fe62c173bf19de42d65cb82a11bb35ed76f70d0f9bed2d87648050b94ed4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
53ad4b6ef88973f0768957b4785a08d5

SHA1
24ad58c28f3037b7f5e0c6200e18630eb67053da

SHA256
012fef2949a7c775765f251b28ca41e99a1875eae3d9c9b38504e26400b20c30

SHA512
2529a53a759ec419a802129482c9fa8c728acd6e3dc4a2976e68a5994c4b67c57598e5c9dfeee46f3d0903caa1fe313fc80bf73533bf197a88dc8d2f8796d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e7d39bc5dd9604073fe1de7c8979d312

SHA1
73bbf6829dc8324be105417107e3ce8dedaf798c

SHA256
6030fac949ae76d2d7de223c606e98de0f3f468f937b2c4da12feabb0a8ab727

SHA512
b0c6b9698a540031a0ff547bf8d01a03c6b64aa572f2e908f8abe1c55ce4acb8e6c63798fe0d12246100cb34fc39ee6901a0c3bed5ba60c8e3d0f012fe788b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eb8932f78173463d4eb3f15bb4f112a

SHA1
ace3576eb6b7b54369e51be9eeb1377c19a6b525

SHA256
cd208810e60b052d5ce2923ff04e725cdc0297283d9da2ced6dcc07d130f61ca

SHA512
081b8bb01081dfd53e89cccb86159480033c2ccc868a95c91c30a5f05af4ed01b8394987b5cf5544e67c73c0dc44989e0b154db5636248c36715a3fef10fc6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2817f4611e1aaca5c340489707e1f537

SHA1
e00676a7d7af4182be9cd22a7a392db5baf87f51

SHA256
f504302e9743156855db8566281b60e4409cc2d6bfcde620b309b601d5e2f446

SHA512
2932bbf173d0632a3488e1878aef9290f847299fe0af316e9d603fc752dcfa026820c4b5bde4c20f9216ddcc9985f5764951d9e632bf92f7b4f2a334ff769f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dae05016c26540daa7569a8990384ee5

SHA1
20d16e97157b54337bdc4153ce5368e975c8af1c

SHA256
9778962c0b4947ed9b2b04ae8b265e62d9d510475331c3b05e88741dd51b68e3

SHA512
ee0c029f2e626b509c19d1787c1e8569921d90fc102c8a05a70708a4bc70df1bc1c4985df4c1023fe3c5a26daeb44c116f799903cface6475805a2f56456931d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6c3b890dc2b31ff0e9d77779744c3c40

SHA1
c998057ad3ab1336e4d1ea75253af0269fdda997

SHA256
63cb03ef6b22919ecaba6b26c5e599156f37b2f7fc62ded2952f238b54c9eee4

SHA512
01d610ed1603ae7cb5241d82c347f1476604165a5f401241b8394e4d084adb2d726415bb60ca63def0933151bcc79846ed75ac767396c0b001cc5edbcc273b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588c4d.TMP

Filesize
48B

MD5
52980d1ad7b66a7a33f91f04954d542f

SHA1
5334efd6b594e25e68f1c66bd675c0224280aed2

SHA256
9d53f37c7e60f8a59be3faceec8ae66aa90077be8b5e7775a6c0fc8db246c033

SHA512
7034c2c308932000cfc51ddbae81d44b50c83326f0676c739e9ebbce6d41de10010c605e40d0f9e22664a2dba3c6d7113a62b4b4a51d565617c339b401e2dc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be356eb6aa7e653d9d3db643933eb00e

SHA1
7e06333fa32b887b1fb77612e965361772ebc7a8

SHA256
4990d94addf3fabe09bed80d77d8dd0be1a11258a65033f0587b08a27f9f3c45

SHA512
951ac8bef7e672531583c4b73c5a52e1f96d385d1d47f02d879e4cc7cd45fe1e5f77a409caabc0761efa6692bb699c4fd3b42374495110e8740b414a1415f2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa80e033dd3cf5738fd5d8d42f71e68a

SHA1
cce6bb883188b4ad78f0e788bc89ac0b34e084ce

SHA256
38b45f938ed1ee24da9afe86e5395f669e06ce392e53a8fb3f11957277d8b55a

SHA512
4618e2477bd30248922f1d077dbc739d1a8d6145bca768e50f78d5c3bbb131a290f7b824155cacebf7d7e5d496ad3270aff90f1c4fe47f13c93f30b326cb7be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4943abf976270ac3cf5b801e23924dc

SHA1
f3f9e7a53de280ef45cf9fadf6e1850b276511ae

SHA256
fdada0d4a15c84143689d77ae3971fd2f99f2670f80e6e5ab1f471d229f23445

SHA512
3b28275a9cfaa6bc88edf4bfedd2a7e33af1cf354abed67e2228cf67b2b8783a2c9acde0bd8e18e3577f53507f178946a4ab8a12e93faf2c8f4098a07c732b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d561.TMP

Filesize
1KB

MD5
6cc8ebb419c4867c0a312b99b01a0d84

SHA1
ed436026c3ced4b5d92acecf515b999ebb6ad767

SHA256
2255b8e5bfd5c8f91a98ed7ae79fe1ab81be720a4fe869f0757d75252ebd0a25

SHA512
a819acbd8989d64e9ffc49892d70de8b6d8eb022fa15758d3f8ea2d3ac1ecc4b56936446ecba79ded3a6eefd70c1e9b4c73b2a4572f235417e038180887a33d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d80ff76c6b8774896ff246853be7ce6c

SHA1
7962d4548d519819af6588c5bdedf5d5f4cbffc9

SHA256
a9b161aed88cfaf495c0b12602ede9949de4f9973dfb5ae2012c8c18375c264a

SHA512
cf5aa8cf94a042e2acb179eff034f68d5d9e2e7cc633e8d42591c91c7f7322ea13ad1ed9df5ffef5aa3554c9b5d72d21191d542b54303ace6be9219b063a19cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
455e11b47f0c8c12e2a5e0662f43c7b5

SHA1
e779b72c426ba26a8a1749a7950256e31a8e0100

SHA256
556437c452b4bbf45d0d79bfa0c5b1a56a6449ef087fb9a19e8a07bc8c7d82ea

SHA512
741d39a6655dce6a080925ed16ce825439e63051422f2f51d90ca3052a60efd1a2803b40b38381445dd82d11a74818ec568e144aa9f5d6a0b7df988327d5f87a

Download Submit