hxxps://www[.]google[.]com

Resubmissions

02/02/2024, 00:48

240202-a529jsccbp 1

02/02/2024, 00:48

240202-a5t8yaccbj 1

02/02/2024, 00:45

240202-a3333acber 1

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
228	msedge.exe
228	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 5044	228	msedge.exe	85
PID 228 wrote to memory of 5044	228	msedge.exe	85
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 4640	228	msedge.exe	86
PID 228 wrote to memory of 2808	228	msedge.exe	88
PID 228 wrote to memory of 2808	228	msedge.exe	88
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87
PID 228 wrote to memory of 3164	228	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a7d546f8,0x7ff9a7d54708,0x7ff9a7d54718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8120 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10318674186863881090,11373312993667506811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x444 0x418
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96a218c5-0e25-4ebd-a6bd-cc169be5d13a.tmp

Filesize
1KB

MD5
4f528f48d1989ad9d2ee4d8a0657f3e9

SHA1
276b503252627c5c9323b2eff289150ee50c9032

SHA256
5cd7478f740749310f049674525566f7dde4e80cec53880fdbd5fa3f900897da

SHA512
34ff84f49e7020cbf9842b4381a6fac5c2891336cb58ae33f0bef08e36f528e77a50d0a7d454a8bf11276590d904c6f33d503b11c191a2c5c573a185d563b802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
1024KB

MD5
38d518db6743c44a4d9658c3018b506d

SHA1
792455593fda85b6d935714d6c483fae5600f147

SHA256
5637ff2dae3b18b64a540649e015170f6011afdef0576008929261c307c77b06

SHA512
e445299b10e4f7af321d45ecc9e286478200d27be90269ec7dd25cb8889447e43048ffef473a5e7c12b8f503c7576b5e49cbbd6b075d31193ee081c653e6271d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
eca466238d1d31123d082f5db6d39f8a

SHA1
2c532a2604123209ae3d65ddb47f98dd78e8a244

SHA256
65e4e585f203be7d05078821fe633de5e9d29d178262bef3095e18a011dfad1b

SHA512
eec073bbbcbbbad0513285f9d139f69d1ccb4742287e0ed6fab53763a4431a050b67d7ba4e7dcacadc28399501fc408a78e5fea96973485faf21b62d85093615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_nl.discoverresultsfast.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
f57dd455560e45ec75ff10a8fea17d2c

SHA1
0bf4c4e8f82fc2ae6bf7b59d70de3bf14d10689b

SHA256
35c6d6e0bb9ce744a84a661b4c92845a26e291295d0e1955ac08205d6e35b051

SHA512
dbf273fd44abe33a622bb9892ef92c03ba490e488f669e0333a5da4dc310b332b527ca69f6ff2c6cb8bd33ff18ba4bb9bde955045fb7eb3f689c2c0965ab66de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
346fcfab802ba08acffa4da975dede06

SHA1
b8f52c83f387aa7fbe6e1dfde9bc45b9fbb3f319

SHA256
0793bf7f5879dd0f8a1a73e03edda046d8d34e0bed9d0edd7be1223d65bd14e0

SHA512
6e23805f7d736fecee8d4e01aba2a5fd21e6b5ae68b9ec90bbc250ef685b9d5396a33f3a0aa753b93b8c01ea4de25dd7d5e7e08e144e23f865f865e9e4135bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
3848e89743ae4f525622cfeac2dd47c4

SHA1
6b7230a0ff4cc43819591bebfa6cf8cd6307c86b

SHA256
6945db4cadd01c7e2b103edac72de2d23e7bd414289d9483ea1afd1c8bd64ff9

SHA512
a35d9134f012b77f4f87133a9a94fec55719be867822478343440c0ca7ccc2e075ce857bd2d9e5ce74fe7b216adddb108485720802f5ffb20782d4ec19ff1899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
da3ee2ff1671b6b76fbcc9d583e1139b

SHA1
600d5e7d7a25e749187734216e4f1a00fc04a359

SHA256
fbdd95e3fa495449a7f1616c7dbf96597ca80abe4658d04511e75ab515b49f67

SHA512
321fbc2995c93233cbb8f3299090a943b818f426e9f6624f5c48d8042bda106bc557aa0e669e45b95e7e7b6696dd9765adcac29622fa453af88de40cb17b8c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc3b55f0934368c7005a71720618865d

SHA1
c1623b7d08831cd86536c41bc2e00e6fa7ab7b11

SHA256
a359b765b1b4090e047e1ff4e9c75fcdc332c0e635e048c990c2018609042441

SHA512
6b194b1d6fcd13c86fbc881b49ea90df2b0ffc088e67d3561e6eb969dde4e3a5a8bf5f1cda7af23125c1c90ccc484bbce9e80f1ca1baab175788d4e32d61a931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1aa1f7f6c0d527859311c0d5f2f26048

SHA1
46a49ba204fbd39c09a95fcd3e1b671b9e9c1e08

SHA256
4d57e2f27a720a1303b22d21760f9aa89e89dbb568642251cfb22601a5bd896d

SHA512
2e5a4afa256f3e453e6e905eb5efbfac131df3efcb5be4d3cafbd5306df8b09c8dc46315318545fea4bc364f8cbad531bf6b65a71899e5b3a1228990d1bec98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f23c4b0b2ef96266c653a4a8356c57a

SHA1
409348f02437fb74423554c90892ca2cf7e6f03c

SHA256
a4cb2c5e3e63ead31f99fe2143195a0dce8c310f90d98a8f8962ca504d5dca9c

SHA512
a202aff265cf54ffdbd0b7642c733674f2bc0f9c75769223134cd20051da02196789081e15a1a9315f9af5d328d8d69b30e13964977237ea45d6b742946442bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
362566f0859b6c6c9adc8b818268ccc9

SHA1
3764594db28473cfae1cc67160d82a33ab5545a1

SHA256
fac02aaf0d19668126c079c569a2ed288f2dca71a0910f5490aa461206f3f2aa

SHA512
d7e967f539001e3ef640c722202d33a8dd3458ea0c002becad4bbedf129d098e5ce6b7406824f3d585d1ac42d52d3cd367a1f3af76658c1379477ccf2d31289b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ed1de0c482e40cce8cddc484b14f2ac6

SHA1
1117ae828436aa6ad6c2cb2652edeadfc8a62701

SHA256
71ced57d5e961d256fe2554c48fff596da6c41a396dac44900e07fa979f84dec

SHA512
273a4314da992a21418afa8d385107a3d0d7776f8b03cdd408c59a687c33753e78f5881e3758041947e46835a420ecc883d1bc006fa1d85c3bf7b241f8bff76f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
52d36c33a4bed97943b40686e537dc67

SHA1
b024cf0c6a3fbf26be2c630124569e28996bae58

SHA256
4f4cb73fbebd6fae9424f3632ee5febd90c93f586755d65ca552afcbf8518134

SHA512
ee087a8f0d6731f96642159d578df747e4d390e8c4a9d829a052111263e94aab2b59700d047750d6e5e3f55b27573ca7ffebea58f1a1e712d1a70bbaef92e752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c6d5.TMP

Filesize
48B

MD5
aa46af187a22e353b3888e39011d0579

SHA1
a5c730606eb8bd04b0798ee2222013dad96abe5a

SHA256
274e4d5a0de07ffa50117576be3b7e3a489d0ad1616fea8da6119b3861f7345a

SHA512
44277885c484d594a270fba4a56f8adb05de696a644335f9ea1dd5b2f6587bf38941e734c1bbd1f4eb2a787a80d86fe34822cdd33df342e9f1be979d55465dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c27084817996611c5f67db73a1d73de7

SHA1
9f679f8fb905780eca46a872c7686da41363e1f6

SHA256
5630fd37c872b081828571ccd61fd04c154168e5fc2108d6efaa99ce49565f28

SHA512
7efe68c4e93474360fbe9f2aaecdc54ffbf46bebf08a04942b16a63759f7be8a8436bf734fc9a368e856b23926ed3bf9845322caaf75841a9b888062acf2235b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
14b501481181dd6283a010e3eacba799

SHA1
f5e17ac30efcfb47f5ba3a83dfca521558856677

SHA256
ebef674019be9c80da9197659578cf735f9b6c76da1d2b9f2f17339b529f95b6

SHA512
b35696764eb04e2169aa41336e313dff51fe9dd1773a1d95728d8e41760b7b848e6f6d37a3500f76410e7b80bc030002a8d169feae8060ec5d27dc23b358cd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ac748148397c064d231ef7e5a0eab59

SHA1
049c6bd743f3c0d67fba273594f370d3e3e2cb97

SHA256
11d70ed21f1395210f433b340c39c588351b00d8002888fc6131ec3032707e18

SHA512
4f8d27ba547f815341199489b68e0cec52c20a628e12d934da78d9cc335c71dae633e3ec53d5abdd1d79f889b2cd4ed5f0932aea5934baa707c976701c39b9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f20ba9362968b17a4801e5ec31667e73

SHA1
16114cc29b19482fe8d9455c96241bebc0198dc0

SHA256
7644d0a8768f45fd7102bd108b67060efb152958526c1f8247f5ec2b201749e7

SHA512
fd0dc522f4ea89ffd3f440bf41edfa7080de5a6ff4f32ac97aa086d6ee61e0d62418a8e3941545b796bd9bcad3e8370746ff5e8165a95d90d462009c1865a455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2099f53f3c8301fe77d17de9b335c229

SHA1
b479ca955ed639cf4a39e035571fff36e97c63e0

SHA256
2020aeb9f1b97a3919a7ada1d670c305e2ee46c640b014c0afab7010ab946e2b

SHA512
0bb6f183b6b5e7d80864af4cd093d3fbb9a6cf475fe63ab79f5d6a7c6c97011925ff2039c165120b3eac89a0019c182eceba2f9d6e10b4d360c05591557b4293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffef522f6aa4c405b594067208db8a99

SHA1
da4b13f50e26f1fc9a15c5dd70977e7f3c6be073

SHA256
8871082a73e144aac61d24f20f068fbf17a2cb9f165fa42eac3302cd485b7215

SHA512
5219c97759c176466815fde263f3aca19ffc28de3e1c1eec9d924ad55d1aaa651a8bd08d66da52c4d36c493b899463f858f04080cab8292dc75f7c89220b9e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cb5be100b541f2a97559e94f801196f

SHA1
88f72469ebc4d22339d1d6e411fd5c2c02d89996

SHA256
b4594e6f86c785636113dc5c69e3fe384ecf32fa0c5c70f005a9e26d47c9804d

SHA512
45d2c92a5bda77b03f239809b0a99d8e0e9f98ae77ec01e19211fee5d331a295b0e52432b38b92abe52a00e8c7b8b85bf043fd4852e480fefea29aed6d81661c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587172.TMP

Filesize
204B

MD5
22b5e10eb1c7b5b14ec88fabce81ee1a

SHA1
aeb535669ca7b8c4dcf5dae9b0e8f7914077c2b6

SHA256
57475dede79558133de2cf4d24b44276b054a87c31e9a01c4d1d28d313978bc7

SHA512
414dad9b6b3b1d3a82540e5baa709bd646c0f253a1c820a1d6a278baca3bbdbcc2169454877737844875560067a95b276c577f7623738dea55df6f681777f431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fd0f51a7a627441d5a916b7c6a6d37d

SHA1
7aee6509a95103b5d82da13dd929cc3c005df678

SHA256
2ad62071b2b2cdeb45e48837c6060dcec47b1892919663491edeffa156a3fc74

SHA512
75ad31ca826f930195a87fc14544f4db339bc646c84c195f185fa543f6a792259b351b4a1631eea2e8ebcb1564d561c5067db82a3f52064f7796087178c03ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24ef31605621db5cdf2b43505e61bfca

SHA1
894a7b6df235d1dd21ab56dea458a930ede8d951

SHA256
80707dc5c6a291b9258107835c3837012ab25154c1f684fab84e32fd47e0754c

SHA512
b4f990a0bfcc54ac5d2f45457f2d15d2229741367af7d23a6d5c96e42211f96e1043b9db369d4406b3186643e897ff0d0d6c7e63c6bb38f8c9bc60060b12d4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed0a227fa0d0d421263583dd77d54a52

SHA1
1e636b3664913425f78931f56970fec879e42640

SHA256
31c61bc909d6ac923e97075c46be8f56fdf9b38130fa41c02099421f3479bfed

SHA512
c1282c783ad113188b2c1a5cbf78e9eec6fcabcc37aa629e9161bd18d748a44c3edb52321ac7cc46186835daf9ea7ca2dca540f9ca8f782fdd7cbd8546c734f9

Download Submit