hxxps://pastebin[.]com

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pastebin.com

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
1452	msedge.exe
1452	msedge.exe
544	identity_helper.exe
544	identity_helper.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 5008	1452	msedge.exe	84
PID 1452 wrote to memory of 5008	1452	msedge.exe	84
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 4044	1452	msedge.exe	86
PID 1452 wrote to memory of 2744	1452	msedge.exe	87
PID 1452 wrote to memory of 2744	1452	msedge.exe	87
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88
PID 1452 wrote to memory of 4384	1452	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa280e46f8,0x7ffa280e4708,0x7ffa280e4718
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17553880329999970417,15679666242267693167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9df5ed28-625b-4b6c-b98f-9438d4c0b8ce.tmp

Filesize
5KB

MD5
8144adc437c6259c53a3e008b5ac7bc1

SHA1
e9c5d5f9d22dcf8d72fac882f99d3acc166b2bd5

SHA256
dcaba251cf19daa5c352af13acd5dc361b76ce4d29d7c82a10d8a36919f4af6c

SHA512
9ad9e5360c59198b58aa1598c445b668f99077ec00a904d1d45b93773154edb3a8a9886d21493e8fa33cf805280ee72acf110f81026d702dbd10f87f99abbb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
231KB

MD5
186553db499c78e307ddea7efa22dd7e

SHA1
53fd1bcfacf7e84ca0cabb11d78495bf629a68b9

SHA256
db825608d83a7fe7ad0a68a35d972ac0f2193aa74d7d290cda8514f2c171c6ba

SHA512
ff69829131f381c3a5f1501d04e710d5a032343187659b3ecc9fd9ad49699309d28c13243b8f853e0b01a19b6fffb71dc8c619e95bb57ff72f1fb6d8e9845cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd575bbbabc8eb6252d9fff8733f0e8c

SHA1
e804bffae1a20b1a6cfc41b80b6b8863aee32df8

SHA256
b108a9719db12f0884aff60124981929e14cd1f192b26adcf9281ed177e0e872

SHA512
78af44e37ead3655de6c6606690ad752ca4de99ec61a370a72bbd49d619ae4409cedb46aad8cb98fdfd8a5fc07c9b04c6f7849572729e40bfc7a843cd195bcba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a14e12ae60a58ce64d0e6fe68829008d

SHA1
30be52830d89a654e945da8332954eccdc5a4b1f

SHA256
b20c3a809befbdf131d88b9a296541c3d456cd9a91f4cdb9dc12fc80b850fd80

SHA512
314373ae05fb397f8856c5f8038d951878b3c63f03a3e9103d30f3cd23d9a9dae51ab3e0b9a5ac3701a411477f0f9460ed183f5e8d23dfceb832e5c907306ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0a1a33a3e80cc4c0c632732df8c8fcfe

SHA1
d96419b7426c0427bad1c23cbbaab8bdf3f0f464

SHA256
25734cd6a072a78f48f28689905ae009078125109a142be9ab39a45532697935

SHA512
aa237d238e92e1c90ae14ff9e4207ca4e5b1ee5d2b841fc61a525e5a10c44865ff86d1524957a807d8bc5d6cab5269fb5ead6c87b3dde15cd0a827bbe45dc0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
8f753dc9a45ff3e62740c061194ba5c3

SHA1
501662764f61b8f6621a86551a2c0f9295d87c17

SHA256
fed7c3ea1860700a209c9527dbb33f839e9d25cb8aa3e5e087b699cecb2859c8

SHA512
98b955aa5ce2e9c0597fa5544f303ef4a8b3aa9f3b14f08789e78feb1be4f89f83891531685048ba3a42ef80e7e84416afb40fbd2814865d64d571c1a8c3deb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
2024392e73decf99d627baf6b45cd43e

SHA1
f4b2054419ae342956e8a2dce62ca8390aae50be

SHA256
04e8629b25bfd07c8eae2dbe7e25321700bf22cf3067925be85b593cf334b221

SHA512
0827a72070bf2fb5afbf581b38978314f2462795f759b36b85c909059887a209126805b3b4fafbc8f5df05dc371b567f8c4f3ce382ca6351396e09f971a37d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
79e10b059ac031a8a706248ec8f968fa

SHA1
876fde39d638f8da582bdc2b9243f77255ddbe3e

SHA256
9b9e93399c854d947ec44e50d94b1ec38619a1a4e2ed1389a9e550bb7d64f434

SHA512
f9b144f760cb896135ea1d93483453caa2f6920540f82c990d0a1df46bbbf1a9a49ad6453feaa2420afaf4afdf650830a1513317afad0cbb5dd0e7e7314cb680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5ebcfc760ffd0d825103fb255a34823d

SHA1
9ed77146cace703e27752e949f20e82c12ebfdb8

SHA256
f8b92f17a17ce2449ee54dd9a20f1b90809f9eaab09d89d387da883a31e6b4c9

SHA512
3ee8b1650daa417584ce45714e0b14a203a68f98e1dbbdd4e584ddefe05d470c4b14a1a3f9459322a8134ce83c843f77b291619d00c01457228a0d8c8e7816e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f5b23d1f2c13ae4ce5f9058095c867d4

SHA1
df160e3bee81303935596d036d9770b1ffc44853

SHA256
78c5d11871fe18e3b1d1caad5514fe5c4bd8c9695abc981c821cde2b4841db30

SHA512
6a2c9eabd4f8079630fdc3247274aebe9da102c94900c38c2135e998daa672b82ede0ea6d408040fb3758d95b29534d4743a790030f85b640a8bea044d8b2e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
90f34ebeeb5c94c59d86167a9d43998c

SHA1
732a7a8ba630c9540cfbfb33480953ff9d545ff3

SHA256
0c24aa5bf873764bcc16f3c93e2c3de06ce7c3b05d6e42f568c96ddaba4fc245

SHA512
f71aa591bfcfd7b28b864d08acc84349c9d8a23fb1cec3f8ac4007eb5db28506ed2ede2fc8edeeecef5a12e6898c6bcea59e38dcc45912d592053e4958c6f73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3be4148e1e7d80393737744eda85b5dc

SHA1
09163b618d0d82cb250f754b70f7e2bb9233c5b0

SHA256
39d097f13a791703ea843fd8bcb7d7cf91283de429ddf1e47606780aad0a4a4f

SHA512
12e86c087da7d3c101e127c4614c422e4eeaf9a73ae3d62563f33cb1e782213b615b950c47a12d721b1077dba6f1d2f540ccfef2416dda6c10f88abf26cc709e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6d8.TMP

Filesize
2KB

MD5
976844f82cbfd23529e0f85caab45597

SHA1
9a70a6ef811e5346f82fbb3dbb030238157ab329

SHA256
8beb88b0ff8d4644960497a24eaf2386951565b59f267dffcf3e8422e90a35a1

SHA512
7af05ffd5314b96f875aef9ee1616d351eea847c1363c5429aeef698f373ab2e66464c37d1d0cd5a6107e3b821c49223294fda51f97603a1423dbd8cd7ef99c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dcc807ae-9b23-4207-ac16-c996d3e52c15.tmp

Filesize
10KB

MD5
14b000813e8310c2b66b7d028dc92b27

SHA1
a6fc067d71b7918bd26b107006fc9e341414e488

SHA256
dea6898e7537223183403bc31e12fa5b84c39c38128745ee4afae341cb8ab6d9

SHA512
22990a003c99b2b9586f62c0d45c0539a26faca81bbb108c58daa5df2d8dda821477a55e0b4d3a36c638f79f1a5441bde6e0e43793f5031aba3327d03ed85997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
586e5965f36feafa0779d0b3d3f67819

SHA1
75c9dfecf7ab6edab5ca6c87506b3304efda7db9

SHA256
6aa5342d114cde0c84f7b9f4314d68e77a6c769f8ac2316c5c6cfaa27da200d6

SHA512
e171f1dd575fd47073f53b47bb372c31409e7bb61d491dadc76bc01ead83431ddfe2023456b80703ab0b96fc5a1ef4d60518987bb207c93b9952dc3aca2b67f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
344a83657402e9f1342517f7a67abddc

SHA1
063bc42a98df7823212b7510e1f3bb4b63bdbc57

SHA256
16de41f650f4cd336ce404085dd9d0c51c912109186b659449ddbccb9260668e

SHA512
0d50f9ad19c9f952a2acd4042043a49020ad55647d775afd15f30b3035158af40d89847b662d3ad28ea139c07d962ae181ce7ecad4a810ae26ebb6f89ab2109d

Download Submit