57b45395f28083f3c13b57d762180b2230ccabdaacb36dd18c23bda278bf811b

max time kernel
814s
max time network
813s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
05/01/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

login.html
Size

26KB
MD5

87c1e83d5ebc2066f648df574f384103
SHA1

db4bac8860fe248807f4df1f6beb96c4c0fbeb6f
SHA256

57b45395f28083f3c13b57d762180b2230ccabdaacb36dd18c23bda278bf811b
SHA512

34742fa57c3f2524367a6746600d5f90cd65b66cdb7071840db0c89672d1c51ffbe08fb81c0a9d7fcb7ce06aa2a62255db35ee2caee90f9ee55452a855aa0d05
SSDEEP

384:wYm5V77sGGzK+TpQn7M9cyqy/f2f/Yb6WiZrffGfMfg23syZj5XCqzGX3O:1+scm2f/Yb6H93UWg0syZ9n

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-771046930-2949676035-3337286276-1000\{16C2CD56-74FE-4AFF-9111-755F63FF544F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
2900	msedge.exe
2900	msedge.exe
3396	identity_helper.exe
3396	identity_helper.exe
4180	msedge.exe
4180	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2840	3688	msedge.exe	81
PID 3688 wrote to memory of 2840	3688	msedge.exe	81
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 1516	3688	msedge.exe	84
PID 3688 wrote to memory of 3376	3688	msedge.exe	83
PID 3688 wrote to memory of 3376	3688	msedge.exe	83
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82
PID 3688 wrote to memory of 3908	3688	msedge.exe	82

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Modifies Internet Explorer settings
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f4ce3cb8,0x7ff9f4ce3cc8,0x7ff9f4ce3cd8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,9804030631014796631,14951751880158400734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:1
  2⤵
  PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushRestore.snd"
1⤵
PID:2368

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushRestore.snd"
1⤵
PID:3164

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushRestore.snd"
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
05ed8d7350c6abddb2413582af13b728

SHA1
98b3e6793352038355ee54fc58828e5ca1cf0f77

SHA256
878b0ffac96b1428cb415ab15b289258dcf9fc175ac2571622e4dc1219f32c01

SHA512
b80bf631b56588daf08570c05aac9a67cee414403149c223a005a7dd9c81b5e8d4c6f175815106f039d47c1bfef875ecbf65efba106d5107b137f2aabe446058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
97533ba2c932575c7d4b46803c4addaf

SHA1
f802b524c1aa993905f34b5e6e7ddc43707eb901

SHA256
97a6e6f48d832f55570f79f5d20f4873aded11f6a3529c9d55e8408681b81b48

SHA512
691efbe58266d695eb934153132e501ac0f03faa525226dceab42b0f19e9af09f86f0f6b126930b32071850ae07db612af35b9ac6e6982b99cc92d18857bc501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
401B

MD5
ec5675122befd9097d735132ab2b4cf3

SHA1
36ba176d8d7e6cb894566fa5c17cc7ecd1a49ecc

SHA256
b38088b93c21b362c74fb33ae11d22e3adc000e334872cb596beebb146c4eace

SHA512
0a34506ba3d050a1e633bb3fb3a65d39ebbef1b4f13cebcb0902dbe99640ee025a6214b90ebf4f84f2b49bd1c91ffe2c4d7299e623764e5f14529642cea46e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
401B

MD5
2ad62ebabd70e72d505297db0c85be3d

SHA1
af8eb2a3b7a25e00f355b4e5eb09d15fcf220dc0

SHA256
37247a86ef00f67a1247f030daf4f0d50f6e9230bd6c59dd06d971a5c65d30d1

SHA512
3a7b3bbc8e230d03ca94a7f50f499f04a3dac428cb4ff14e6dd1a54ce7b603735b55b925afb67e1ccbe853cb7ec6cc965cc306f0ace1c8ac8a0dc4ad9e3d711a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
bd4cc59f1f3e57bcf177f3d282a3295b

SHA1
d35014be23839c739c77c9c24effba33c7395da9

SHA256
e8561b2a5e0ac2ce138d20167c8c925a014eb587bd8b24909b3a06327361970d

SHA512
299b7679d1e2cd2816d3bac04840c2462448936ad004a58e86aabd41d3185cca1f9437bf1b82165a6c41c629c28695487b80058d8fba1593e32f134510d3d1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ca82e519c864e8b6676613d19651474

SHA1
b78ead40ee9896c48cc1f051dbfcc59767c86e66

SHA256
647bb2c38f43ef89efe42296ce4cb68a05fcbcffbea83366d0f3f36fdc7d9881

SHA512
25b41d392807a0171331a7ebbdb5f0073fb9478bb9ad3002b180e30d51dad318e94cd78ac7c39d164093d1fc196da311cb388a83f1c250568f42a7286e7d147d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce0ce0fb4337e837923fab74e0297d25

SHA1
51732a6c24d8276d74aae87eaf193691e4e8f3df

SHA256
fe0f48e5cea5d851c5186c7ccbd7031dc714d756b731bbfebf64c2c6e6885c7e

SHA512
ea55bd9c6e55ca287678bea69d9ecbfbfc6b57a4e9d92e674ff5e99b1827ce6c0284f8f4323d506942e0441e9e2de7923822e3f8b438075cffe6ad85c03c26dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8980d2db8732e2e475d4bf03bef23cdd

SHA1
814e802d92ff45e6e7179a17df690da255eb0ae0

SHA256
68137a2fd6a588ac65d1ec9718e97a5499b8b46422e58efef7ffd26636a984f9

SHA512
16d47da21c4d7f94797389a69c921fea2bb2891828ab186cdbebc144515318338c9597bc92cedfc2392e9c84f725b0504e529013719f765cd7bf44031f14fbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
3da3cf652acf7e0fee298963e8cb77d3

SHA1
8d35e8ba0767c10324335e8fc8f5c422ece4e504

SHA256
9b436ba7a14d3947bfe73fa9bd581f6fbf0acbf26e97a3a54d6d032d19f8cf64

SHA512
89e9555edd366fedaf79bf4c6da816a69fb220c987337369511c4422034cad486338a261eb6954d000dbfa636c969d04b65de62bb6df9c023ca5e11c892ee83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
919a2d33d00834e7826719c3d4a998b0

SHA1
7366a127622b1579a7d7eb249a54f112588302ec

SHA256
82e68c7d1b9636d062754339b1659e493e2d9be44f5c95db196a1a4237b4d901

SHA512
e0e0d825b7f17253dfeb06e612dd1a1ae851563164d8e766b6dbd177ea9ff7f29e7131b636c5fa4e2cf951f8c15b6fbba678885f09cb9deb1a3450f3ddd561c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce83c089-e44f-4f42-aa86-9d16550c91c9.tmp

Filesize
10KB

MD5
e56439d35034213fe8272c552448d53e

SHA1
ffd0ae9783d55648cc5f9153a15de418b555c910

SHA256
dd8b3b65bcda292acf69ea0a5ccda9122b7c22a69932fb91db2f38309fc774e7

SHA512
57bd9def118c0d87b32dcbd6d9190a47c9b422b203a9ff93efefb6b6eaa9f4624b4c0bfa7e276a175526075c0e440c0faa750b7af840b3e0ec83e88536a9234f

Download Submit
memory/1188-1338-0x00007FF761010000-0x00007FF761108000-memory.dmp

Filesize
992KB

Download
memory/3164-1330-0x00007FF761010000-0x00007FF761108000-memory.dmp

Filesize
992KB

Download
memory/3164-1331-0x00007FF9FDA80000-0x00007FF9FDAB4000-memory.dmp

Filesize
208KB

Download
memory/3164-1333-0x00007FF9F0640000-0x00007FF9F08F4000-memory.dmp

Filesize
2.7MB

Download