f81c1245f856b7764ef90626a708c684f6117f6e2125582b2c5de1d1218b634c

Analysis

max time kernel
155s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DS4Windows.exe
Size

465KB
MD5

e04a76a4b5a4c802eb3c228909f60bbb
SHA1

5ebb77a556b04faceba7f89b9b4f13343298889a
SHA256

f81c1245f856b7764ef90626a708c684f6117f6e2125582b2c5de1d1218b634c
SHA512

bcfe476f8b01601dd7411e97b7895a340c65c720881cfbea5218f4a2aba8ab8757de19e8729edafbf8c711efe8ccf07a1f16bdf4034855fced43ce0a9bd97331
SSDEEP

3072:t8vbzyQ6Y1YXrbNK+3FNxacPEMk6VRQAaTWHAxE53PXJagcxjiitVqDRHFljXfuk:tszAXNK+3FVBRQ9TWgi3P5zMmh

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe
5488	msedge.exe
5488	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4408	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 1412 wrote to memory of 4408	1412	firefox.exe	120
PID 4408 wrote to memory of 2884	4408	firefox.exe	121
PID 4408 wrote to memory of 2884	4408	firefox.exe	121
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 776	4408	firefox.exe	122
PID 4408 wrote to memory of 1908	4408	firefox.exe	123
PID 4408 wrote to memory of 1908	4408	firefox.exe	123
PID 4408 wrote to memory of 1908	4408	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DS4Windows.exe
"C:\Users\Admin\AppData\Local\Temp\DS4Windows.exe"
1⤵
PID:2544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2792

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\Desktop\AddUninstall.otf
1⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.0.1921177483\1630449065" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1848 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c3208df-6bee-49a8-b2b3-0a313fecea60} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 1980 1e66b7e5458 gpu
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.1.416851285\969285353" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55712542-e3f1-4083-a6fc-2e8dc0e94d9c} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 2384 1e65ee6f558 socket
    3⤵
    - Checks processor information in registry
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.2.2026953210\290898937" -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3304 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e02471a1-f602-4a47-b792-199942ee8eaf} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 3320 1e66f7c6558 tab
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.3.1839935318\901382244" -childID 2 -isForBrowser -prefsHandle 1328 -prefMapHandle 2532 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f011b58-9133-4b6c-82de-9ef9c3527ae1} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 1012 1e670605758 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.4.1049996629\856934127" -childID 3 -isForBrowser -prefsHandle 4408 -prefMapHandle 4476 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e981f9-76ac-4ebf-b35f-26163d303535} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 4392 1e6715b1258 tab
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.5.2098516264\1933299653" -childID 4 -isForBrowser -prefsHandle 5040 -prefMapHandle 5036 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b0e27a0-1e20-4ad3-a332-4ab78291f73a} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 5052 1e671dc1f58 tab
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.7.657225166\1362560589" -childID 6 -isForBrowser -prefsHandle 5352 -prefMapHandle 5356 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3932b05b-2970-4195-9bf9-9efd2e8da554} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 5432 1e671dc1658 tab
    3⤵
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4408.6.1737597258\1416942061" -childID 5 -isForBrowser -prefsHandle 5160 -prefMapHandle 5164 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0501f70e-953e-4b41-b926-d6848676a344} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" 5152 1e671dc0a58 tab
    3⤵
    PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb779046f8,0x7ffb77904708,0x7ffb77904718
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,13492291383795898929,4136830526371601928,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
eff965395148e415e072fe9f5fdc5f71

SHA1
3307496846d572fd3fb8346684be09228326d778

SHA256
86a9b12bcd5a6c1be032c61d9d0477df52d136c398f7f7b90386b82263e111d4

SHA512
30abc4f6ff16c36b7497f4abed76f84ff1cbcd9169034bad53c4b2c0f1f2f9a17a6bad98f27d8d7eb5c797b67b1fca7dee87d20cff928461881c8d313dc5b42f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
3dc452e26ec96639f59eca64e487f175

SHA1
b82675b6fb6fea962b0bdb99c09dcc0821fbefd9

SHA256
34d960ff5ce97ac6ce5609307b0ae4b8618002008528c29d731e0506b132d39b

SHA512
e212eaa94f1f28e1970b26313e0c8d7bf7c5711d16b3a708871812655940486d4d6d76f279b8ac041e47a94d7b5a369411d947ab6a2828b77e66682538c0a129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d6981610c9be976fc1987811c4c9923

SHA1
c5b7b7446188c1a13e75e0613ce20e788a7edc71

SHA256
83dca452f8c596fdd733445f3fb13c5f0260e44ee1b814f5894cab7e65b447c4

SHA512
4c4ad3abca71cff40985eb1efa93962d34ebff11e118d26b76fd98ea2efc3eb3bb7ba09e8c5ccc048162784a6d0e21e9bbe84821ef5636947be9800deb0d7ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a975da0495f6ad5921dd2d7d0281283

SHA1
fa9b199a36649fce6d4622e1e59dd15b64b289b1

SHA256
29081299f60868db35bdf98181b352942aab68a23c942e76ef99ecef52f3021a

SHA512
2f7d026f45b0305a61b15f7810c7cf176f4fa874e39618cd220b4fd2a174677f091d550b000b926e1057d16fe2aa7300a92c70e20ea7c675527e4209efd3ed01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6588c5d8aaf00d97b9ef97850f2762cc

SHA1
6794a544fd51475bfff0a7714c9ba968cbd6af64

SHA256
8d43f925685ec7ff2771dea2f2aaf06f829319498170d930bf838f67ee138d14

SHA512
5ca702362b0908e07dec475b683ec0f69700186b1837b1a081191a2097c54b6ebe7f1e943afae27b87403129a9699f7c98cc4b6bb98c326b6aa788050b052488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
163934395c428c1897aa50065d7aa6df

SHA1
c5ad16eaf91b48526b4f88f23910adfd9223682f

SHA256
6ee53bd9dedde38c37465c4750720597d9f1760098a660041108a847700023d0

SHA512
72d0eca7852b9de94a9227fbc15f9e1bef972d6eded92ed5413edaf0aef77160d6307e6a1af4396d11820728a5fc8854d31642e8e6d66672252395409b295b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b054dd2b030f5cc88a774ae0c8534cb

SHA1
128d1db937662ab190bb1739721359c16b688fb4

SHA256
c8f71f2ce7bdd93c800d67641854be98d27f2c2fd1d5bf3a45375153f5d67f7b

SHA512
9ce4dc67bd8e44fc7007f708965f6ba72dcbf1b4a5f054adb8edf8a1c3ebd97e24b637ff514e812eccb9a603d6492deb5fc6976cbafc2530eed692bb3d2353be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uzw33i5d.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
7a404e8c27047f69901645a3b31d2ed1

SHA1
7cc28b9e722142d2793cd1441557c1073aff7040

SHA256
5d724e40e880886f4f3f7f0bfd8b488e651422ac4dd0558f3ce9a3c064cff6d1

SHA512
4bb015e6c3fde0e964c3499af6e17529c03cecc13c7ce65d75b7c08354b4dfd23b19d63552eee712b97b7949dfb9b4739c5b28fedaf0d822fdea42376fcb4fda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\prefs-1.js

Filesize
6KB

MD5
2a05793d094d8bd691b0f52e6e105abf

SHA1
899cd82f88272e31121e4db9347b449f289e5b74

SHA256
806255e32bcc68042c8a77298f5ff9663bd07573eb21f13cb1a43938526ff2b2

SHA512
5b398e0e3899811a4bbcaa55e2ce24604f177bdb12c598366fb5b350af8185dc6649727daf5bc72bedfaf96757befd323c0afab754da855728cf01f6b7bff24e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionCheckpoints.json

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore.jsonlz4

Filesize
881B

MD5
bc115eeef0a6b2f8956ac0c4081ce9bb

SHA1
3fc50d08b41f02e76d1313bd894a053eb5e0217a

SHA256
4b8acb7bffcfc009e82bdcba7e05358690f8e000198965b7f5526f094bd7bce0

SHA512
3a8157eeabb8715fb43c6282abf5a0061bc0e9c15ee82e87d1ca2155cd3cc0b1a0ddca73432013ba018fa43a271b6f872f6367c8c6c44b81e0517ae6164dfb4a

Download Submit