Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:26
Behavioral task
behavioral1
Sample
7c9172b18543f697525c4d7314d3a23a.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
-
Target
7c9172b18543f697525c4d7314d3a23a.exe
-
Size
161KB
-
MD5
7c9172b18543f697525c4d7314d3a23a
-
SHA1
ab2875e039b5a4cf466128f63234e0a279cdf61e
-
SHA256
75fcc9aa30238b16e1c23bde007bef2248b0638e6f419252a80dc887ef05a3ef
-
SHA512
25c5cc367ea0d5db639cf406819dd0cd0276e874d204a6351a6bf475fabc1453386f862477975ddf3de66f1fdc322a3e68b0a68c0f77b54ab79b72c82401c612
-
SSDEEP
3072:1HIENA6jJVHO585ZI/0gPQLUmTw4Pf/W8WzQJJ5ozie:ym9VHQWgPQL1rne86kJ5e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 7c9172b18543f697525c4d7314d3a23a.exe -
Loads dropped DLL 1 IoCs
pid Process 1688 regsvr32.exe -
resource yara_rule behavioral2/memory/4732-0-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral2/memory/4732-29-0x0000000000400000-0x0000000000482000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034} regsvr32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\s.ico 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\eyfwin.dll 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\p.ico 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\sf.ico 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\c.ico 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\m.ico 7c9172b18543f697525c4d7314d3a23a.exe File created C:\Windows\SysWOW64\m3.ico 7c9172b18543f697525c4d7314d3a23a.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ios.dat 7c9172b18543f697525c4d7314d3a23a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ = "_IvvlbbdEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\ = "cvshost32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\eyfwin.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\CLSID\ = "{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ = "cvshost32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ = "Ivvlbbd" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "njdbh7 Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32\ = "C:\\Windows\\SysWow64\\eyfwin.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CurVer\ = "JopaBlizko.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ = "Ivvlbbd" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ = "_IvvlbbdEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\VersionIndependentProgID\ = "JopaBlizko" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\ = "cvshost32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ProgID\ = "JopaBlizko.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CLSID\ = "{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\Version = "1.0" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3044 msedge.exe 3044 msedge.exe 3416 msedge.exe 3416 msedge.exe 1740 identity_helper.exe 1740 identity_helper.exe 6000 msedge.exe 6000 msedge.exe 6000 msedge.exe 6000 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4732 wrote to memory of 1688 4732 7c9172b18543f697525c4d7314d3a23a.exe 91 PID 4732 wrote to memory of 1688 4732 7c9172b18543f697525c4d7314d3a23a.exe 91 PID 4732 wrote to memory of 1688 4732 7c9172b18543f697525c4d7314d3a23a.exe 91 PID 4732 wrote to memory of 3416 4732 7c9172b18543f697525c4d7314d3a23a.exe 92 PID 4732 wrote to memory of 3416 4732 7c9172b18543f697525c4d7314d3a23a.exe 92 PID 3416 wrote to memory of 4832 3416 msedge.exe 93 PID 3416 wrote to memory of 4832 3416 msedge.exe 93 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 1832 3416 msedge.exe 97 PID 3416 wrote to memory of 3044 3416 msedge.exe 95 PID 3416 wrote to memory of 3044 3416 msedge.exe 95 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94 PID 3416 wrote to memory of 3276 3416 msedge.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c9172b18543f697525c4d7314d3a23a.exe"C:\Users\Admin\AppData\Local\Temp\7c9172b18543f697525c4d7314d3a23a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\eyfwin.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://configupdatestart.com/bind2.php?id=39131372⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9c9846f8,0x7ffe9c984708,0x7ffe9c9847183⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:83⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:23⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:13⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:13⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:13⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:13⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:13⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:83⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:13⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:13⤵PID:5424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:13⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:6000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4520513074770779066,7473944537078459440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:13⤵PID:4384
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:560