Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:44
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://link.mail.beehiiv.com/ls/click?upn=pxT7UpzS3eCuj65G9sm45J177oS62WHRUMkZaIj8eGo7t6UJ-2Ba0fjhvA1s0bKYL6P1tyB-2B2-2B0Zme-2BgPCKvN6iazXywBglthR5aR-2FMcA6L36vx-2Flpg7gEgebqj0Q0FeXtG8DVNue0yEJ10hVIhkwmPVsqXNO7mfCaMLuXA3XkiXtw23VWq4KPwlDooIVTVuY2xjd9nUvLhXm68OoJMHpFXABIttJorUcwJVDrSZP0PBulIwrfsMklEQxU19pmnOaNHJzqXgiTn5nOEJJCGoIsow-3D-3DA1AS_eUH47kFdntXqo2xSPPWlsYoPWZx5Pag9yv-2F-2FCT45fJg0x6Y62OqN5o1wujBp7179eF3fZH-2BIbaEKtvP3-2BjVQmzEdWWNrrB16zcgHS8luxdR9-2BV6evyFYRTjfmJ-2F6oqjkN0BZRimaptUBGtr42oura19-2BMvsLT9ri4etGZtoS-2FKlvXPIb23YUAkkSZ4S87hnTlVW5yc-2B7T3-2BIo6kdUV3kFyPQJBWHfbVa7AB-2FlOR6Kjq7ZF1mHQbQrM0wlkp8G09LIxoX8ROK-2Bezv8QNPXVWb2wI0ybtRt7HkG2vDFSrNFNH0vd1K5oZuxEQW-2FtUAq3kT-2FbgOW9y8fsx3T3HzBttaHqQ8rB4e2l8CrKyaL9O14tHnhMCojZzYEEpVRz0-2Ban-2F-2FpyrW9HwmguQcz-2B4ZSYpuG6xiXaKqXzO1dcFBqP-2BJ2OZRMltwLUMFILV07Sg7MjxwIEd-2Fy-2B-2BpPhAG1JMW2zSHxQ-3D-3D#amFjay5jdWxsaXNAc2VjY2wudGVjaA==
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://link.mail.beehiiv.com/ls/click?upn=pxT7UpzS3eCuj65G9sm45J177oS62WHRUMkZaIj8eGo7t6UJ-2Ba0fjhvA1s0bKYL6P1tyB-2B2-2B0Zme-2BgPCKvN6iazXywBglthR5aR-2FMcA6L36vx-2Flpg7gEgebqj0Q0FeXtG8DVNue0yEJ10hVIhkwmPVsqXNO7mfCaMLuXA3XkiXtw23VWq4KPwlDooIVTVuY2xjd9nUvLhXm68OoJMHpFXABIttJorUcwJVDrSZP0PBulIwrfsMklEQxU19pmnOaNHJzqXgiTn5nOEJJCGoIsow-3D-3DA1AS_eUH47kFdntXqo2xSPPWlsYoPWZx5Pag9yv-2F-2FCT45fJg0x6Y62OqN5o1wujBp7179eF3fZH-2BIbaEKtvP3-2BjVQmzEdWWNrrB16zcgHS8luxdR9-2BV6evyFYRTjfmJ-2F6oqjkN0BZRimaptUBGtr42oura19-2BMvsLT9ri4etGZtoS-2FKlvXPIb23YUAkkSZ4S87hnTlVW5yc-2B7T3-2BIo6kdUV3kFyPQJBWHfbVa7AB-2FlOR6Kjq7ZF1mHQbQrM0wlkp8G09LIxoX8ROK-2Bezv8QNPXVWb2wI0ybtRt7HkG2vDFSrNFNH0vd1K5oZuxEQW-2FtUAq3kT-2FbgOW9y8fsx3T3HzBttaHqQ8rB4e2l8CrKyaL9O14tHnhMCojZzYEEpVRz0-2Ban-2F-2FpyrW9HwmguQcz-2B4ZSYpuG6xiXaKqXzO1dcFBqP-2BJ2OZRMltwLUMFILV07Sg7MjxwIEd-2Fy-2B-2BpPhAG1JMW2zSHxQ-3D-3D#amFjay5jdWxsaXNAc2VjY2wudGVjaA==
Resource
win10v2004-20231222-en
General
-
Target
https://link.mail.beehiiv.com/ls/click?upn=pxT7UpzS3eCuj65G9sm45J177oS62WHRUMkZaIj8eGo7t6UJ-2Ba0fjhvA1s0bKYL6P1tyB-2B2-2B0Zme-2BgPCKvN6iazXywBglthR5aR-2FMcA6L36vx-2Flpg7gEgebqj0Q0FeXtG8DVNue0yEJ10hVIhkwmPVsqXNO7mfCaMLuXA3XkiXtw23VWq4KPwlDooIVTVuY2xjd9nUvLhXm68OoJMHpFXABIttJorUcwJVDrSZP0PBulIwrfsMklEQxU19pmnOaNHJzqXgiTn5nOEJJCGoIsow-3D-3DA1AS_eUH47kFdntXqo2xSPPWlsYoPWZx5Pag9yv-2F-2FCT45fJg0x6Y62OqN5o1wujBp7179eF3fZH-2BIbaEKtvP3-2BjVQmzEdWWNrrB16zcgHS8luxdR9-2BV6evyFYRTjfmJ-2F6oqjkN0BZRimaptUBGtr42oura19-2BMvsLT9ri4etGZtoS-2FKlvXPIb23YUAkkSZ4S87hnTlVW5yc-2B7T3-2BIo6kdUV3kFyPQJBWHfbVa7AB-2FlOR6Kjq7ZF1mHQbQrM0wlkp8G09LIxoX8ROK-2Bezv8QNPXVWb2wI0ybtRt7HkG2vDFSrNFNH0vd1K5oZuxEQW-2FtUAq3kT-2FbgOW9y8fsx3T3HzBttaHqQ8rB4e2l8CrKyaL9O14tHnhMCojZzYEEpVRz0-2Ban-2F-2FpyrW9HwmguQcz-2B4ZSYpuG6xiXaKqXzO1dcFBqP-2BJ2OZRMltwLUMFILV07Sg7MjxwIEd-2Fy-2B-2BpPhAG1JMW2zSHxQ-3D-3D#amFjay5jdWxsaXNAc2VjY2wudGVjaA==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2492 msedge.exe 2492 msedge.exe 5976 msedge.exe 5976 msedge.exe 1632 identity_helper.exe 1632 identity_helper.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe 5976 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5976 wrote to memory of 5964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 5964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1964 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 2492 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 2492 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe PID 5976 wrote to memory of 1288 5976 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link.mail.beehiiv.com/ls/click?upn=pxT7UpzS3eCuj65G9sm45J177oS62WHRUMkZaIj8eGo7t6UJ-2Ba0fjhvA1s0bKYL6P1tyB-2B2-2B0Zme-2BgPCKvN6iazXywBglthR5aR-2FMcA6L36vx-2Flpg7gEgebqj0Q0FeXtG8DVNue0yEJ10hVIhkwmPVsqXNO7mfCaMLuXA3XkiXtw23VWq4KPwlDooIVTVuY2xjd9nUvLhXm68OoJMHpFXABIttJorUcwJVDrSZP0PBulIwrfsMklEQxU19pmnOaNHJzqXgiTn5nOEJJCGoIsow-3D-3DA1AS_eUH47kFdntXqo2xSPPWlsYoPWZx5Pag9yv-2F-2FCT45fJg0x6Y62OqN5o1wujBp7179eF3fZH-2BIbaEKtvP3-2BjVQmzEdWWNrrB16zcgHS8luxdR9-2BV6evyFYRTjfmJ-2F6oqjkN0BZRimaptUBGtr42oura19-2BMvsLT9ri4etGZtoS-2FKlvXPIb23YUAkkSZ4S87hnTlVW5yc-2B7T3-2BIo6kdUV3kFyPQJBWHfbVa7AB-2FlOR6Kjq7ZF1mHQbQrM0wlkp8G09LIxoX8ROK-2Bezv8QNPXVWb2wI0ybtRt7HkG2vDFSrNFNH0vd1K5oZuxEQW-2FtUAq3kT-2FbgOW9y8fsx3T3HzBttaHqQ8rB4e2l8CrKyaL9O14tHnhMCojZzYEEpVRz0-2Ban-2F-2FpyrW9HwmguQcz-2B4ZSYpuG6xiXaKqXzO1dcFBqP-2BJ2OZRMltwLUMFILV07Sg7MjxwIEd-2Fy-2B-2BpPhAG1JMW2zSHxQ-3D-3D#amFjay5jdWxsaXNAc2VjY2wudGVjaA==1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dad46f8,0x7ffe8dad4708,0x7ffe8dad47182⤵PID:5964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵PID:1964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:1288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:2300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:4892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:3048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:4972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:5484
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵PID:6116
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:5196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:12⤵PID:4948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:12⤵PID:3476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:3648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14086390334310547938,18090360351672234150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5076 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD57c30b635bfe577bd4587d08dd0e2c5f3
SHA118215c952455f26985b1ca625ee671038f70c0b3
SHA2561ec7da05ddb7b9d0d9124cfe167183f1366bcc08da3f34ac1dc8315e1c756e4f
SHA512715cc0da7b59591bb9acf3195ec7bc0faaab446c37defaa20a3005e3f86df1413a7f0a8baae2332304a34586d9b7e3c60dd3bffc287deeddd3c2c470464d1dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
716B
MD5b82c3a63317ab6cb2b9538147feeeb5f
SHA18b67e4193dce6d8ae377985603eedd3e71c0882f
SHA25693d0366ff466f68f5253b703dec8e90e2c0f754cd014ada4c291128a1eaedd7c
SHA512dddaa1a5c0161864eda0feac7805664babee745bb01b5ea9dc5b95fff4820c8c7a75045fb7028a67a66a3fb0d584b965abbabcea1ad8290a953b345272ad034a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56a33b5d4e08f49d919ae8df0eaf0cd5d
SHA1b8fbf297ac95c16fa3d28d89beca618d3a0423fa
SHA2560e272028c2521ae34adb385a399db0bdccca0497deb98575602fd4b71eb302ef
SHA5122ad8f636cb9d13ffc573f4cc9b797f5dd3348fa3f12e02194efe3a585f5431c63acb3f15e11b9e2311f3684a411bb8436b4fb1a218eaeb88ac4e11bd4c2e6991
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD519410f938d1e5f463d5de490548dc6d4
SHA111c3209db263603fda1b689af72b4620751e79a4
SHA256bb7103adbeec987ca73ee2b3d42268d458b544a090769efb2e403ef901029019
SHA512a456e6f275363a75bf4e9fbc528e352b44abdf9e1b9e360a99ec818ddb55ec93b3c06c5c8da0319ef30f37021ae9f03b947a0341d91e36585a2a0d9ddbea9031
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5721a0ece96098a53d33a2cf4f71a3f12
SHA1f490d1233a3d5de2dadeb2b73a6cfd173198abb8
SHA25679d83f39649fd446b358d7a08445b3151ac06f7b976f443285c67e875f3e6bdd
SHA512bc92078ab599e9e0e5916096f2a913aa6ad16e2f3c942c3f214bc8fee1a8a8e275bced3aaa53f4f5c560bba292ac12acda7778f1579587024d18b8fae9ef6798
-
\??\pipe\LOCAL\crashpad_5976_PIFXLUPTUCVVNHLYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e