hxxps://tria[.]ge/shxxps://tria[.]ge/submit/fileubmit/file

Analysis

max time kernel
1696s
max time network
1691s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/shttps://tria.ge/submit/fileubmit/file

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1141987721-3945596982-3297311814-1000\{B3B03280-06BE-4C86-9202-B9232F201AE1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1640	msedge.exe
1640	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5004	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3040	1640	msedge.exe	81
PID 1640 wrote to memory of 3040	1640	msedge.exe	81
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 752	1640	msedge.exe	84
PID 1640 wrote to memory of 1644	1640	msedge.exe	85
PID 1640 wrote to memory of 1644	1640	msedge.exe	85
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87
PID 1640 wrote to memory of 2060	1640	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tria.ge/shttps://tria.ge/submit/fileubmit/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec1da46f8,0x7ffec1da4708,0x7ffec1da4718
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10370970177337391875,3144255183777242777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
26ac7e3fb0165fe955c2c042a82ef62c

SHA1
db1a83938cbc848a38258d602944329e4ecf3217

SHA256
0fd2a52252c3288f939b47b3eea5a14d60bf89051b46e1f9c31919ddb261c443

SHA512
d4c71f9c2338dc49b3589d7f00e08b8779f25c8042df09ee747240211e94b93e7cb1015e3e518202423cc294ee60e6ebbe33cd1a7cd31c245fa60b70f36cb9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
82d07d6dd70cfdf649385ac61667a4ec

SHA1
709d31d32f69b4f3d512e80e7c8f4ac8ae11a24f

SHA256
958e28313540161eb4aae19393318aa31ee44f8929b0746b702136bc0a99e533

SHA512
9ff29f0445b4708f716ea32b91678e486d919072a5c49da2eff76bcb33a7cd033a886848f0da592f61783fa01d7b4d84743d7c97cca6392195d08ddca4330dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
21becad13b88c298b64de08c0959b043

SHA1
9918ac0688d4c3b7e13946b12685284f64391f3e

SHA256
a9568ab47bbb748197607585fd2eed736d28f3facac3c3225c698e98421760cf

SHA512
5597bf884fb8d5ff1a78734ff310fa6480ee6e1c74353291940a82115f5ba1f78c5105d628a8cc7e098311db4a92f6baafb81c83c99c8cab387890ddd8918e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8ad7cb600179d07c8db99bd6aef0c67b

SHA1
0472f343d9a1fa6cc698e7f890b81bc7c422b54f

SHA256
393e4012b483ba3a6d899e840efdbda710c83351fcc3c0f1930726d2cf6e9d86

SHA512
75c5014f66e577fc4cb0c6cb566f102c7190da547ba0a2b2e8e08fcb4116fcab98097ce8ca59aec0dbea62c49636aca2b18a64758216112992a1629d956d5fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6cf8e720b7ffa68deb9c4c29381c6351

SHA1
b27f1f089cff432810c401a88d88ce9363d29ec5

SHA256
a0353d89af6c60228c762c0388483f5fa5ddcc8860d1222abf9825a104d01e74

SHA512
1b209b6c7ce85796f6067d81f6e54853b95f907c2483304a63344319baeae34c4289c41d3fe76c56558d1d3c9e1356ad5354e97417ac4a93f55c3167b579a5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2c5713066d9e6e9068a1c938b3cd6368

SHA1
7b8d42c39183137af07c55dc0ef1cd2f62f97089

SHA256
0d3495d9bc6e70c14eb1c07f2f28bfcdf0b7364f741cd352ef93245ed83d49ea

SHA512
15ae5cc50866d6ac1c2edc1417ac06bd5c20ebc5e032ce4928855f8643c99580d935b8fe63111ddd55c3670b7b8146e7f4f2236c134a0226c6a975a70f9c7dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf07ac0d65cea98ea8ee9c827ae83624

SHA1
94f21c8aca21ee92ce4f694a6c4e118c75daba11

SHA256
bb16e8e667df99c3c562b32855a48c9db0f93c0dcc388ad164f939ce6905a531

SHA512
974a92a4556aa745087d2735985b632e32ae3a16682e2b5d46f83d12127533e86446095e7a52abe79ee71dad7269291c9cbd2284f0cf6f7fbddf2e7d5bb3cd77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ac5b4f0fba10e4440d70a3af9a35eca

SHA1
a506e96061753bcc4eb98f93d939f3e3bc777e08

SHA256
82956c1b3f64deb5c85381c677dea945b7a219cbbede8d1d0759af9a98f248cf

SHA512
c6a83a79655c4494870407f609fbd8462e52eb7e3ad566d7ecc121e32619fec0b342ad870a54ae276b5fb0b201fec57db75e67f7e1a1da4d3fcb886c773e04f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
36de5d68cda4930fb226c9c429d48aff

SHA1
14644dc0dd8305e4ce13a3e9806579b76f47145f

SHA256
61b65936a5cbfc2f045537444bd1f9390d30f51995a0fbbb3e9f35984ea01aa0

SHA512
10e388edd57b972ce2d4b423cc17acfff161022300920bc8aa833cec78bb2314a93e0727edf9cf99d88ea430f861d951268e6e5ff584ce36369353dab2f4f164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70cb49c4faa15795d1762babeab9f587

SHA1
31af7c7d541e9d3b137a84cb6805f1c7e0c591f9

SHA256
a1923c807d42a018afb4324f9aaefa6d04b056ebeb29980dbc4d610f0d12f758

SHA512
1f653db2d2e51160b3ab8c67933f1c60536158972708ccc77f517c5ac369981f56dc35ec2817b90b3c8fed686708a7f9fce910905c56ce0f07805343255e7d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f15671d5f3fa1ae07c268f153713f18

SHA1
730be8bb79250754fe82a08532c352a43d4ff140

SHA256
ae8995623bb3680375bf4745f9fccf774f3d7c3f0545bc138bf0a681604cac0f

SHA512
4c4ec79fdce0abfe324b87bb7a4a530f0815354352acc77ccab8fffe9ab207ef4f5c8868fbff4de90ec6b721b642277157ba789d9346f1f71d84129433e1db88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
ed9329efd543a3429efc24987d340108

SHA1
1311897c120d59cfc4cecda7e95de8dee6404a9e

SHA256
887018e28e0b4f8fa8b9cb4b08e1cf1ce9fd7bb722033e5722900ddbd89b6beb

SHA512
caa8e170871cc921a535230f9832c564198592883a65b2a3536e25f93986e1fe55ee4af87d996c6e868ff954e66d7aa013b7b330efe1eff6e85daa7a2a54e9a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5896ec.TMP

Filesize
48B

MD5
8eeb6e5b6b990d68188f0d2b451e0b89

SHA1
896473f6e296d566c60a80d02e185d9689502f1a

SHA256
17ce88e9f18241e908d80655dd1ad31e5cda4d640eced5fc37bc2d13dda82c0d

SHA512
cdfa80944f20ff39635126b979949190d6ce86e06712dbe11266a84b56be38c686b46a8fff64a71f58f73af2bb3688c0bf29b9206e82b2e303e0dfc5f9a81f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85b1719d95899e71ef1c7a7252b433be

SHA1
3ca2f291cf98766391b5e5efc723d2054c383e0b

SHA256
7e7fb710aa7bf56aef54fa5b482fc60da75d9c963cd3c557528d583ce16272e4

SHA512
817d1df3d03ae0178267c9b9fa6f7af8636c605830a64543a535ff2fdab21fbf16935a3113b3544657f8248921a7bef2dec1cde95bc28675783941f503113e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e44880acfd8c95582e4a3e6b293026bb

SHA1
9cf5dfe03cf45348792ccfe5e1bbf8aa9aaf1a17

SHA256
f0a83bb7400b8f5f13b9db89048065e754414d54a8564ec8fe1d79a0a2460866

SHA512
162d01b4c1e5ee3ee524afe725fe5b36a23ba24cfeb5dab9daa08aec52209e7093ab38edf4483e33d5bd302a66db5da656ef4e2d138121a1838f0fa67ca7a5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
139f1528757ca7a9b5c9320baec0c2bb

SHA1
8700873cfa38d3db31e5d5da8a07d8b4718387ee

SHA256
ab46696307623292e74f92cbbecf08a2559a574ccf08e8f036cc3ad43fb21f2d

SHA512
bcab3389ccc23a181cc1d805f4218043f7d33cbe14287ad450b99728dd7518205397f41fb0c76d18efb57214cd4dc23ee87d140bfef68360cdeb7e39bb9564c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85e147aaf3f3d7f254cb95b6bf4c08f4

SHA1
31a6c8e2d7d3e6c2254e3bd3225422f7493e0f9a

SHA256
b244d0a453eee1ab02ebfd4cd776e0ef24a3e70e9c214bc8b2ced30cc80b41c5

SHA512
d3e44d210f70ed8be7a85d2a4334c0a86e751aabb0e6069d19b277d8f74b45626d7738e52828743fd682f12389513c914603bf0c9699040f08b2f2d5462d5bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5827004229c9bae0f9363e72ea33731e

SHA1
cc6e9327fecaeb2d0d98d6ff38a7061d119c0015

SHA256
771cf0979e18899f9c0743ac579a153e6cddbed1a73caf21c38d21558e605f95

SHA512
fd1de6758f6ddb8fc00afd1444f2938fb8f34e15788500612e09e55adf80c05489cc522af6997d7f923c3c90b88406950f29395cdff9bcff4adfc76c6d99a1be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58409e.TMP

Filesize
204B

MD5
ca4fb47c713710f0b5ff0d5f484e5d85

SHA1
65a8d305cba62b4bff01e0d2632edf0c25c82a4c

SHA256
07b6b7cca1d460f18923bfec9ca6866295c43f963e648d84063fce7cf471bce8

SHA512
5ba6e9eaebdf862e1816a85f9b2b2f4a03fa840b67770d8b54058819872342208d203cbbbd562e5a9fa79ae6b8d60b724048de0ed6a4397dee506a38d71a1445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9160b5be275eb21165addeb60d68ec8c

SHA1
6901bedbc12dd579cc52b2041cfa97bc5368ee8b

SHA256
2a374a17a14e64d63d86c305c5372995a669a63cc734ee46a70becd33cd63f86

SHA512
a1c86bf661bd83f2e2410a027e32a73e149be16f394eb6cf021b5c35e6d86eafbb5b326ee744bd5f84d866d328a70a31ba5861a57b4b5b815c78f0c10d777dc7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
fb04fa5742ea97cfbe218d909c59a14c

SHA1
a2c0d2de0d740b6c3354e7e45b75a0122686dd92

SHA256
992d65fa4e95db929e3c31b2477c3e516ba9dae33dd43f1feb08b2ec3660b19f

SHA512
a8ac34465d89491e0fd0b20f7d5b42b57b838bd5b278adde278055d70a2800d7936c5e8f5fdb647470fa1c420988c421986acae60a254d14e2aa462c54ed2593

Download Submit