hxxp://ww25[.]surveydrc[.]com/deocs?subidi1=20230930-0238-573e-84d4-197b45d48065

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ww25.surveydrc.com/deocs?subidi1=20230930-0238-573e-84d4-197b45d48065

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{F324D1D1-AEB7-42DC-BFA7-E2BB1C893272}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
3480	msedge.exe
3480	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
5328	msedge.exe
5328	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3700	3480	msedge.exe	60
PID 3480 wrote to memory of 3700	3480	msedge.exe	60
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 3408	3480	msedge.exe	87
PID 3480 wrote to memory of 1440	3480	msedge.exe	86
PID 3480 wrote to memory of 1440	3480	msedge.exe	86
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88
PID 3480 wrote to memory of 4808	3480	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ww25.surveydrc.com/deocs?subidi1=20230930-0238-573e-84d4-197b45d48065
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5acd46f8,0x7ffe5acd4708,0x7ffe5acd4718
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3574670711668116720,7471356971005498723,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
53KB

MD5
57f1b575031d4e17b5464a2bf860e029

SHA1
6221aecb2e744f837773f901492f81ba11fa32b2

SHA256
86eefae96306303557bc35e857e66e9662633c0040cb9632f3ee67d820a06b96

SHA512
d334fce1555582d099ac079caa488f8f92c878796c5351c8a4b0dd4ee4e9cf8586e632e63c7322c415c8845f7e38dea24ecc741e9b1e46163029d72e313d7920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
53KB

MD5
4cadbe1a0535614cec62bb34d7167924

SHA1
b2ebfcd4313ceffe546cb8008939412d3b70de67

SHA256
2c9a70fd1f988c26f066e18c1512eca8107c70995ca132bcd6068ba4e23dccdd

SHA512
7cc410bcf3c0b83114431aaf27cea736f6bc6e14d6ae18e6af5ee9226feeb2bd0dc0d43dd87c6de8b6971e032769b2d2340712f66915389eb93113c716ccc65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
40KB

MD5
bcfea5ab2aa9fb0dd08708c321e30c8c

SHA1
84384db7ed5d659bcd2ddce8841549e6e7238752

SHA256
da0aa980f01a0086026b276bde5d2efa7a56555d3216e5b8d379ba7c7f31d97d

SHA512
28768855fe1cd9685544cdac96a468ffe4e6b77ed83c74c0cfb9e0d0373dfd746e9d25e23b41ec6441529a94795c4e050d21841d7e03a8e65ba06228e283c67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
182KB

MD5
cab0e0444bd6133e149f009db7cfe861

SHA1
cdfb64946c4ae4f57fa8aeed63075808883da118

SHA256
293ab5d7809d40381acadfc942293c957e44bf1a42940a23bfae843b3c75fac4

SHA512
97b287250f8cd0e60b0d890c598e538f4d0b30f174d1a3cb60c628da36783d302cf3dad9cb1f2af27a9325504cd46fdf9755249fa92affa5e54988afad6acf2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5d61144cd03f0a6260f5670eb638e76d

SHA1
06cbf0a6c74a91c4bf8a1d424d64c91f523b3599

SHA256
186c3858a854c55e860a1478fcf3facdf2d0f92eb97dbfb6b7e2dbbde0a466f4

SHA512
ea29c09c3aeb93b2d141cc87253d90b73d35970f478379886eec65ed2ea0a2bf2a46ca3a6cb3ce642ce6b2c86c3b31c3a230956a91710efbe05e9110ee8a5cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
184d87aec6b43cb3c2e2dedb2c550f4a

SHA1
48a21f0ce0f1281c6519dfc66e51b6d3a0a6747a

SHA256
fe438aa09630cce3cb154c246b19a08297683f8d9876d8d773801cd7ae5334a0

SHA512
7269a58e6ed14eb1d250b150833916e5c75c6e69369f165827488d0e873eb82288673c02e717c32cdcc3c10b35b29e206df4cf6cd675be1006ba0bde34fca719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4d7307bd744835c18574b62f1620021e

SHA1
02430cfdfe3bb42be43cc819c5bc39ef06342384

SHA256
bd9479a05c7697c750001f77c0adb793b5da212bcb7672315d6fd99fd2a2f3c3

SHA512
9060f6a963a872a8b26444c9b300ca6b347262dacc4ab16c55bcef964f7aec781adce006d11f95e4e22989f6f196d84b95efaf3b8375b2cbe417f4560c948248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
acf14584587ff200f44707f287ae3372

SHA1
dba006a7e028f2c3f9a9fdc0a18065dd96257974

SHA256
4b820443a9030ce306a5ec3f42b79db9483e0e3c7e611d319add10772a566fc5

SHA512
8c5ce393317195dd4648fe324253db4d936673712cff733544261803937b940f2eb7e69a379daa0a31ae3bf12666e06370b1854d689837cf11e953df6062d5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
68100d39ac2b0518a72130c6fb0a8a2f

SHA1
da0bb4df7b2745bb9738b1341c49ff4363e08a0c

SHA256
016a40fd151be1b9c8aa76f2900e876aa5d87c67167f4009e8f0242fb76ddc56

SHA512
f554bf5ecade3be764b1480d742cb05a35966aeab9b595e2ec916b54db3177bce83cf290c0e913e95ef22a6532c501f11c89b4bfe2a4c46da089c222c8022c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3155208191d501636984640037970e90

SHA1
93d89a2beeaa3d444900dad722469b121ce3a658

SHA256
1f6f7dcaa75e22c14a7b7984c81fae0a299126ae5a42252e54162c26d2424d30

SHA512
ca74241e2407bbc62f11af64ac06b51856795844775f8e6afd47ae250310a6205af757c99809b1debcabb552f2cfacea2c7948e2abe6780562d899e01253aaff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ed622203a3a38b4f79785afd2eab44af

SHA1
1252b072ceaa558b4dd1334d1042960b9ea05fda

SHA256
c667ff0b5659cf87e1efe26f6f3e4e736735258dfea193d751bc3688a96eb110

SHA512
26a24422fad4666034945dc9031138cf9ab3001728cfa6056b738ef081d829e2089da7606b5a02d2efcdd055db05a13dd30d75589aa4cb09e819d7db9c1362ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39c718f1479b1c0ecfba992814e48727

SHA1
2bd67217f244af79ca08d8388b6bb4d2ec41642e

SHA256
47ccf242cac389bf0d52033c550b77adedf604c774de20c026e4bc8f35ff5bbc

SHA512
4cf2f54c1a12b4045d64fbca841ceb0549154fb4fcab918a5facd5c701c5d46c0e3ff3da58f74a57f0bcf5d20bf230a63f5b35a43adb8e0299e7c0c2246d93bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
7d99cb380a9a5efe322de747c7f11d84

SHA1
60c860f94974a33037034c9bb3b6e014df8b7395

SHA256
0f28b822e1737b046996f285ddb515a42c640ecd081e1d4f300d373f9b14aeea

SHA512
a29ef59fccc217e76de30bc08106a4d9d8716193a214d640246f304333bad49fe620a794a5be13d6eab749097815264f417260e824358d7b2577c7065f5fa919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dad7e55ae65ba6ef515560995cefdf0d

SHA1
675816b84c24600a3002813c18e4662dd1463215

SHA256
1f9df942f9b9bbe42039e11bf0958441774967b568c4039a4fb53f4fcd7081df

SHA512
e926f055bb0410abd41dd74aba4e6889d06783f201f3cd10a52810b458fea65400e6986e34cac038e1e2204d25241c314273529bc581377a18abb9b7832d215b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6ee3716b37d30c4ec5d5375d62700da3

SHA1
96caf0b9a4e43fcbace0a7b1cb27fe2f4a13e63e

SHA256
f19de26b2dd9d84464ec3deee903364b828b25ee5b68bee50d35998b3d5587fa

SHA512
7d93adc692b73fe9746cde876f6816aac194cb9764f14bd8d45f3fb7203e90e83a5cb625568de2886221c967f50760e0745cc7a4f97af6907168c9c438df57c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f5ce1a2ba63203183ad1a6b177b6ee4

SHA1
0004289cb9fa55127066d36b688543847f98cd17

SHA256
36aa43c24521fb0d70d477c9b0b857a42712cc652f97431f9208053a5603a051

SHA512
bd83b82ea822f3aced48e2575b3fa1b0ccb9d410110364adde58b454c384aedcd5e162596a846f5a349dfd34fa183a6df10b0c392e42e86bd74433af256d0e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f856b811a0959966b9213c4cf541362a

SHA1
4d1370acd8c36e439ae0138436e27831825efa92

SHA256
c9c09d18037582387e083607101be5c6fb1d550645aed27ec4b51c988e8fb749

SHA512
de5093327b1d2961d63325da0279d6eebe079bc5b5f7827a2ab59b4fb1a9e13ce4913fc235c73c50c90880ff75a5287bf51efbebf031031a753b580fb5d68db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fe1eb91d3ae99c523b7ffd4a0de8ce4d

SHA1
222aeae7833745b1089393f991ca5e2f060aa1e7

SHA256
878f1645d97d71c5db40f6c4c1733dc00a203354c5c6309e13a0bc935ac3d1aa

SHA512
751b2d22989fd80db62101ff01c9737505c8969d55fe5cd18e08f3fc3c2db39593f5c13554a1160e145343112c1e8b3e9e621deab20f9df865876477aaab87dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c9142c39e05204defac6b51ff4cb15b3

SHA1
08bb2af65947175d96812213923eea4d6125591f

SHA256
e93ebabad5bdbddfee05beee80d7d8e112bf590e17c61c49d87276449546c593

SHA512
592c1dd01498a45910ee96626064c07f9f860672affdbdf68c65fb7c1be46891a74444e7d3d5225ea6da277194f1248bab761f2ecfbad295f91528db3582986a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586099.TMP

Filesize
204B

MD5
5ed6d90d63a3da68619f17aab4646d49

SHA1
f82a67cbe50418547b4d73113acccafcc9355f93

SHA256
3a4e2996a01fbe4f7df9c10f905887c8abc0e40597188de685bf1fb39837376b

SHA512
277718d16a948ea92c370849130d49ffe160ab0b901199169a5a97069e1ca52fdfa887a2f6d78d51f38ef702220b1c352d290d63b64bae69c2fe97c84224dec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
112edb466849a6a603d6857864aea733

SHA1
a45e796af2d38bfb90d269940f3298eafd6e2570

SHA256
3ce50f3ef92dd0008ec8a2fb075144dccb611f58132dd02b2902ebe64225c1d9

SHA512
d5a332411026e10fc45f46ef4e7a2118b3a662311d14a63b22c2231a2a3f47860f0a42087d3de843d3061bc2a044732f836de9ae7f5c55884d306a714551c462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50e36bdbfe7b299d8998de58b358016a

SHA1
971fc0733d4d07ded8e0ce6fa3325e009e46b313

SHA256
55473f8ce4963ba111249d9b40902ca943e78a0721de671fad0b936b549832f2

SHA512
e8161babd3579ff9b918bf1d1da4d77b26a664c27a6749cf2eca7aba2398ca629fc3cf3ac0727a821520cc1408da38b65c90dc2a58b37b198afe682750543ab5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d65774a38adda5ecf2be398bd2921d43

SHA1
e48ccbed77238feffd8685861e6e8c7163739c80

SHA256
68ba281cac1377bccc57023ba9e13c6e1c7e5d88b11baf66e8b70d32a6f142da

SHA512
9853b7f62e65fb73fe4f93757a8d45266d47edba29fc2c96b29980247f73ae5648388b0f59f454e61e52f5c101b52ecf6c22dba21c6063ae3925b73afb979679

Download Submit