Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2023 17:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=fw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3Dfw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g%22%7D%7D&flowContextData=i82ckSim03e4YP4tJzxZlgdQH_Q4gSfBWmoboxQm6cCG97m_nd-aDBKrRmuJGv-1RksiWk7Ykd9dp5gRi2nyH0lkxge2ZpJIiEiKutBmZs0NIjNrdd3fGpnlYAwiYff2KpxioGnKKIUHublokp4ZZ_1_7Ii87Hu9fzAyZrsygfiy1vH0OlbHkHRcGKRrj0WLzIAmCtY3OggjwMu6a6_gdDI4Eb_ec7jH9ta9uG&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&calc=856abf808c510&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.220.0&xt=104038%2C124817
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=fw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3Dfw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g%22%7D%7D&flowContextData=i82ckSim03e4YP4tJzxZlgdQH_Q4gSfBWmoboxQm6cCG97m_nd-aDBKrRmuJGv-1RksiWk7Ykd9dp5gRi2nyH0lkxge2ZpJIiEiKutBmZs0NIjNrdd3fGpnlYAwiYff2KpxioGnKKIUHublokp4ZZ_1_7Ii87Hu9fzAyZrsygfiy1vH0OlbHkHRcGKRrj0WLzIAmCtY3OggjwMu6a6_gdDI4Eb_ec7jH9ta9uG&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&calc=856abf808c510&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.220.0&xt=104038%2C124817
Resource
win10v2004-20231215-en
General
-
Target
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=fw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3Dfw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g%22%7D%7D&flowContextData=i82ckSim03e4YP4tJzxZlgdQH_Q4gSfBWmoboxQm6cCG97m_nd-aDBKrRmuJGv-1RksiWk7Ykd9dp5gRi2nyH0lkxge2ZpJIiEiKutBmZs0NIjNrdd3fGpnlYAwiYff2KpxioGnKKIUHublokp4ZZ_1_7Ii87Hu9fzAyZrsygfiy1vH0OlbHkHRcGKRrj0WLzIAmCtY3OggjwMu6a6_gdDI4Eb_ec7jH9ta9uG&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&calc=856abf808c510&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.220.0&xt=104038%2C124817
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid Process 1556 msedge.exe 1556 msedge.exe 3480 msedge.exe 3480 msedge.exe 3524 identity_helper.exe 3524 identity_helper.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid Process 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid Process 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid Process 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 1556 wrote to memory of 1304 1556 msedge.exe 87 PID 1556 wrote to memory of 1304 1556 msedge.exe 87 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 1248 1556 msedge.exe 88 PID 1556 wrote to memory of 3480 1556 msedge.exe 89 PID 1556 wrote to memory of 3480 1556 msedge.exe 89 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90 PID 1556 wrote to memory of 4200 1556 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=fw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-849803765A568852C%2FU-6PL99754A59833350%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3Dfw9t0CTVboWisxmCamp0JvI5rs-fE-guHyA8.g%22%7D%7D&flowContextData=i82ckSim03e4YP4tJzxZlgdQH_Q4gSfBWmoboxQm6cCG97m_nd-aDBKrRmuJGv-1RksiWk7Ykd9dp5gRi2nyH0lkxge2ZpJIiEiKutBmZs0NIjNrdd3fGpnlYAwiYff2KpxioGnKKIUHublokp4ZZ_1_7Ii87Hu9fzAyZrsygfiy1vH0OlbHkHRcGKRrj0WLzIAmCtY3OggjwMu6a6_gdDI4Eb_ec7jH9ta9uG&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=b74a4258-9dc1-11ee-8a28-506b4b4b668a&calc=856abf808c510&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.220.0&xt=104038%2C1248171⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9131346f8,0x7ff913134708,0x7ff9131347182⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:12⤵PID:796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5293754000999661173,9481229486227416245,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD54616ee8e53f539f5bb5e54d40f93f540
SHA1129ab0cce212cd2a54c8f5a7d10eb41625ecdcbc
SHA2565806d7b7bcb38e17218f4aee1fd67ecaecd15e3049dec9aa01c9794145a6fa17
SHA512183e9a64262a07438c1518da6b288747334645c528d5714808cd4d4ba83e432ed5fcc788fad3d22242f550d76d8b3a578db2ec8a6645b54458961b5698995ad0
-
Filesize
152B
MD5efc9c7501d0a6db520763baad1e05ce8
SHA160b5e190124b54ff7234bb2e36071d9c8db8545f
SHA2567af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
-
Filesize
201KB
MD5e3038f6bc551682771347013cf7e4e4f
SHA1f4593aba87d0a96d6f91f0e59464d7d4c74ed77e
SHA2566a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a
SHA5124bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize840B
MD56a9eda1bf5a5b16cfa53aaf7850e1a69
SHA1a26a93d2b82a80130b62fa841ff31082110f3214
SHA2564b64d84e915d7810368010fb5bbc7419c9ee282c939a70ecf7a8f2a39387bf6c
SHA512408b559ae803943b9c4fa52762edf29f99b679258632fbd6a6bf7c39f881d6573245ea3e742a4f4e07a990db23717df43b5196b73056ef5a9acff89be668b564
-
Filesize
1KB
MD5f69a1c5f32cc9c819434bcd027b153d0
SHA1703102decc34bba1d38c2e45c9a1e9aa95e8d7c1
SHA256b805d069d28716413bd6ceff4ee914cbb4567ec5ab6717a9d1172ce8a4fd3b0b
SHA512e23fc22d2570996f123a14d7b56c3796abb1a42eb1f54fa8c80a1625ae1a9a835e513d37d82523439d41f3aa81ca4b53469c0e92a154505c717a225f9a3d93ea
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD55b8d1d3f328def24aaefdea06e6f518d
SHA1b4fc4f13edfa422491ff8bce3f1cd3d9ccb403d2
SHA256814b02a23c2ed11fc62d8d82a6f3b97bdd5c385c67e7334bb55053bfd6b70684
SHA5126469b648a8e8f703aa2f0d79bd515f44c750f3bb7ee9334a462f41e149bae30f00a205b3228080c194c1fbbf12c7823f5d4bdbf8bb49c15fdb36a9f90b48d9ab
-
Filesize
5KB
MD54044b5bd32ec8bb8fa564bbbb9c95fc1
SHA14854c2c1254891055dc4a1bf2b7ecb1a81f24904
SHA2569f6eb5d6083713d676e3de27f4829479d761e625ebb9b387cfa4f29acc997ac7
SHA512fa40114aefc10ee66a5d87573fb9b7d4d901ef40c3dd816cb42da3a9cfd53b2f251b768a94e5faafeca5290758a35aee933ddbca2553251972607b866476ae28
-
Filesize
24KB
MD5121510c1483c9de9fdb590c20526ec0a
SHA196443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
-
Filesize
871B
MD5a61b33c42044a46565f14a64d303543e
SHA154ec5e20fdf4607196ea8a74ce26d6264e57da29
SHA25614438610f0b204673ffd9c3331023964eadf75f18eed01df772de648d095eb4b
SHA5122b75fa640ba976d7e9b78a5869400ad9195633d0ea1e3ec3138a39dc203e9a931e36085636041e8837c9c33b585c6f155931c77ae1985349d3c5b808b1738dc1
-
Filesize
704B
MD578ff0be3b927fe27ac4ee6cfb156e20c
SHA1d45ae1a9de3b6c59b4ceebebcacd3a6c99808199
SHA256f46a4ea12ab5092f5eb73949e8d238a72e1ff11d20e7cf1ca91a1ca9bb4c76c0
SHA512ddcdb74369785266ba9fce76cb8230dd71873862c38fd716327aea9e44ff04b33ffce98a3bd7c0ed852aebccdbff9cfcd7b6c7117e167b2ecf8195089c349a5d
-
Filesize
704B
MD5ef5698bb7f524e620183a917c5043c71
SHA13a094d5a5c8fc974ba537f40a00f260629993c23
SHA256bde1dd33c5bfd8ef0e524d47f90a05a8d53fc2ea0830752602a72f3aa5f8d10b
SHA512ab833a0d5bccf947eb3417512825d6681861ced69489eb09b2e6859cf06fce9780909deb0b7468546514dcd3509e2dffcada6b9b8ac09ee8123d1eef155b3d98
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e