3717dc91c9e99c1dbd7aaac5bb1b7a091b1df769673e8bdb1679b6387b2248df

Analysis

max time kernel
62s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710fb6c11d42890e80ddc83522d17d7d.exe
Size

27KB
MD5

710fb6c11d42890e80ddc83522d17d7d
SHA1

aa9dd06874de55dc26d5fc5ce5c64510719948fc
SHA256

3717dc91c9e99c1dbd7aaac5bb1b7a091b1df769673e8bdb1679b6387b2248df
SHA512

759917813cde7c619672544cf0fa8b526ea9e07c47a414d9273e301827eb93eeecf84b51bd6adc604ca320aa5de694ebc4ba24835fc20f406cabd1910b93ae50
SSDEEP

192:G49HsxwSUFx+UEqzerwdIpJNY8uMp7QPJVNMxUPAUBlxPVGcmfc:GBXUFh1yvN/uMmxDMm0c

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	710fb6c11d42890e80ddc83522d17d7d.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	710fb6c11d42890e80ddc83522d17d7d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	710fb6c11d42890e80ddc83522d17d7d.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\provcore.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\RpcPing.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\windowslivelogin.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\dmocx.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\efswrt.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\KBDKOR.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\KBDKYR.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mswsock.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\ResourcePolicyClient.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\wshext.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\wship6.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\WwaApi.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\amcompat.tlb	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\KBDMLT47.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\KBDSYR2.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\sdbinst.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\wowreg32.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mobilenetworking.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\msxml6.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\netcfgx.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\WinFax.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\wkspbrokerAx.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\sendmail.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\devobj.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\kbdgeome.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\label.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mf.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mfsensorgroup.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\ir32_32original.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mscorier.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\winmsipc.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\fpb.rs	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\msvcrt40.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\BWContextHandler.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\CPFilters.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\ieframe.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\SystemSettings.DataModel.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\srm.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\winrsmgr.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\d3d10_1core.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\drtprov.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\efsutil.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\hidserv.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\WMVXENCD.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\wmploc.DLL	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\atl.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\CredentialUIBroker.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\Fondue.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\mavinject.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\storagewmi.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\urlmon.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\CastingShellExt.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\deviceaccess.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\msrd3x40.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\srmstormod.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\Magnify.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc110deu.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc120jpn.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\acppage.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\SysWOW64\msvcr110.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\SysWOW64\sysprint.sep	710fb6c11d42890e80ddc83522d17d7d.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\WINDOWS\mib.bin	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\setupact.log	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\system.ini	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\twain_32.dll	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\write.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\hh.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\lsasetup.log	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\splwow64.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\win.ini	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\bfsvc.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\notepad.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\setuperr.log	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\sysmon.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\HelpPane.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\Professional.xml	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\PFRO.log	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\winhlp32.exe	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\WMSysPr9.prx	710fb6c11d42890e80ddc83522d17d7d.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	710fb6c11d42890e80ddc83522d17d7d.exe
File created	C:\WINDOWS\explorer.exe	710fb6c11d42890e80ddc83522d17d7d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\710fb6c11d42890e80ddc83522d17d7d.exe
"C:\Users\Admin\AppData\Local\Temp\710fb6c11d42890e80ddc83522d17d7d.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14364669239666521368,14481580675870762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff916e746f8,0x7ff916e74708,0x7ff916e74718
    3⤵
    PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff916e746f8,0x7ff916e74708,0x7ff916e74718
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x2f4
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
972e235721960680d0c8adf66c13bedc

SHA1
ce7c0014acb50ea3289448e2b03c5f2fb3aa1bf6

SHA256
3a96515f108577379515f68ecded6302cabb9a9633f39c4feb764c3bcadfd0be

SHA512
4958d1f1b1d3b84fec6b30d9c8129a5ac4e203eeea72902e17fa99d862ab85b64dff16e8517fbc79f1c2d9978234398af5b4aa2c9e601ef53aec7405ce8cb076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
a27caa1846919f25ba171b1b16c75f5e

SHA1
6e78192fcb104f1556eb20c939703d9c2bdf6fff

SHA256
76daa37d3fb0a0693ed1d735f6f9d5a195406eb4597233660f2aa2a0e0a35cfa

SHA512
40832d818ca02583d345b5f4abb168a9ae45b1aca98136a237819857bf9f97d4af23bbfd9b64d5548752b3745498282e58c272dc1f06b385baf1f7de3a46e76e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d34b34d5f67181b15493aa0dad5426b

SHA1
71d73448b0c53cd91d9a1706524e8231ee0eb6b6

SHA256
c9160156e20f9f4e0495d1853d77881f84ffb6ca8a925ef55fc1bfbbca32b41b

SHA512
cbf26949e96122c7f58d2ab30c418e4053921691ed9bb247de6bae992a1f9ddeba4b60270a035b7024a57bc986fb8a9783067e8e72ed0e7d219da9078965a9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
469986b774eb14df1d874b4841e8d550

SHA1
602969a06d9b917e9f12b86d1722907545612fef

SHA256
ddf60388ae0ffc60a496f64f550adbe13a58ac95f7aa5a0b426f1b591534134f

SHA512
b79cb113025b25c43a7eb5d76f9286036d07b9a412ce305d9417f717bbac38e612e78d222015c032902cbfece4045a70f4b8e842d6f71e0fc34e6ca6b3ca2e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c0518dd6958356d8be66c07aee94e35

SHA1
54f282d7abd30323be922eddb50fd8104ff17854

SHA256
c9fc38a1a8c19009802178645de06598a694a68a5f5b565f1504bc139169453a

SHA512
3388b455514341fdac9bc2a64d6a2d38b0debb14f3c1b931221398d4a27a3f8f7f7398044da71e831c9efadf4ffea0f8b0877d51b0ac7d67d72ea7fa5ac7a919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b8d6d9e1d6d6d8a227f96cd27c67e31

SHA1
2868bc929d203fe433e7b0731ee8cada213a176d

SHA256
8b149847b76c9d6fa709cc00bed62275e44be623f13e86f57f448ed2421dfe4a

SHA512
42c08c20e6220f478ad686ce67a1af5caea9f0a2c2e3a617d92287cf17bc6dfc7e3c1deffa90183239ca6b0f00ee3e911ef25888a8fe7fa9998d878313c8c79d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c7fdb326b69b2d2eb9f62ffa41f74f4

SHA1
a2ed33e272365a33c930c6cb7149501d3535ef93

SHA256
5ffea5adddd554777fe64563d4650e48263a01a9c8499871ced381b434ca7b08

SHA512
aa35e4f3bb438f5d8dea74fd077aa73beb5cf3107db5f3d8c4d4ca4abc81d1a6c33565eea91221324b8c19d2f4515cf76a3ac7c135df17580e72447fdac50c87

Download Submit
C:\Windows\setupact.log

Filesize
28KB

MD5
0a1dba539c0a12b1e1e11250fafd3252

SHA1
af4b43aa7d3408068289f86e160b60b087ebc54c

SHA256
29fba48a116d24d4dd6fc803fc0dc3152ea6350063427823e07de341972d8062

SHA512
81222cc3139b93111f40bc397de494a1e0d42f0012156059fb09c5f5fd3e3a829989bd87708b5774619949863c944fcb9a7ab199ca0c92eaeae12b8f5e1442f8

Download Submit
C:\exc.exe

Filesize
243B

MD5
85a001e95bd7ab00f3c0c34748eaff60

SHA1
0836ba8d8692d0a44c0d77f4b63dbfbe3781868b

SHA256
00f945ef6b1833108cd4baf260226ee5e0b109d63609a7f1cf5da1ef1812f0e3

SHA512
36ff9841c84b3d54e5e8d55394e71099bf61196d38a831e4494bf3d80cc55d50bf596d566459c8722fd24b94d2b78ffd0feedb3ddacdd0576ff5bb368f8afa2a

Download Submit
memory/1308-110-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-671-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-612-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-1053-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-98-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-1496-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-24-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1308-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download