727388f61b62faecf0b6a98e3b81377ab79a845f1c86498673b05835590c237f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64d1560250cb0.jpg
Size

106KB
MD5

86f8acfd1c5dc3d26582fd38df78e62b
SHA1

4a80f72e1d0566f09202f741d007171cbcb57661
SHA256

727388f61b62faecf0b6a98e3b81377ab79a845f1c86498673b05835590c237f
SHA512

ad977d31817366394c7e6393fcb96df20c0e09ed2375a73d3f7aa78dafd615a11b7a72b6cad9da2fffa9acd747cc156ae47f6c17a18aa2ccac5a135ce806642e
SSDEEP

3072:0M0zEBNX3RlPGs/uSju+atkr2Q9BG8kzw:7KSl0gu+Kkrhncw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{23172EFB-F1D0-4D2F-9B2D-DACBAB45430E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4620	msedge.exe
4620	msedge.exe
1868	identity_helper.exe
1868	identity_helper.exe
620	msedge.exe
620	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4808	4620	msedge.exe	88
PID 4620 wrote to memory of 4808	4620	msedge.exe	88
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 1984	4620	msedge.exe	90
PID 4620 wrote to memory of 4980	4620	msedge.exe	89
PID 4620 wrote to memory of 4980	4620	msedge.exe	89
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91
PID 4620 wrote to memory of 4432	4620	msedge.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\64d1560250cb0.jpg
1⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3a2e46f8,0x7ffb3a2e4708,0x7ffb3a2e4718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3680894876920634827,455391514488801662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b41fec2dd851a396f77ccf59ba332b2f

SHA1
90a57c7e79d798a40ef71aa35502427a10734410

SHA256
d0f9e7760ff818dfea140aa1b42c078fc24a38c5f0c628890ba9b94396b095eb

SHA512
1e929d24b9a69135824f8eaef5f31fd742f076dddca0db499846fc1db22c6efca40929b89fc18529485e8a3f039404b4d893b447f7580cf5ca5651b27e2bfc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d530a37d85cbd40ecea22527a1f19df7

SHA1
4233392fcb6ed74bad249acf116ce9467bf0aec0

SHA256
359a76016c77669e8e8c5ee66081ba2b6f16cb138847b62c999683b6adcf880d

SHA512
defebaa9382475cde80ad12097ce04b6c42f5ea9f9643b6956558567d7c033ecbd515ffd6166cc1b9769cb6811939d23df47bfe54c62673700ba497fc5b7efc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f790deb32cad1260abd1e2f91ea52cdc

SHA1
22a5271ff99a194cfedb53f014fa41644652013a

SHA256
02be65b05efec9ff92c671b7301d44219b6e823fb2f9f4c71e551a5061356143

SHA512
bc19f8665c79b347434b57e58cf8c2f380b6c37b89f172cb990ade4afd105ba190199794480ac77d8aff44004dd624c857a53ae7aa65a79efa397610da7da256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5be34c016ca9de20d6e14bcfa7cfc60d

SHA1
0e78f59597688ab46b1608623f44cea360bfb522

SHA256
d903d6b45fc08a7f1e3c15639736ba1d3bb6cc640c1357ffba5d3170b55192ec

SHA512
a3a53db1ef1e448df22ee5b3cd830f3708f8f9efebe1c4a56098c7d4265e83bca98124d7753a2cfec5f5f499eb84506742e1bf57ff1a6c802e9a6d9a2b2b7bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
f0ee336f2fd8bfb9288815bda41f130f

SHA1
092ca37c7764f9ea984c266263e1a014c7234038

SHA256
7c97d50a85a3e6fd162bb26b5c7d998cf7910251a0548e093e7e186d6dfc8aaf

SHA512
446fd97744305b9e94c5257d234637cb5020299b8277ecac031ed3b43b47eb9d152cd48e0e0ff29793d449ba7a02f161a84484528580fc5c5eaf594d40a1bab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dfd92e65ec5e68eee00ea4fec3981a4f

SHA1
996af1dc7d4fde98fda46d12bdc2ece3c4d24cde

SHA256
901c17c64abbb6afd322689887af8256ca3a0a8b15fece6cd1bd0282a9c84b4f

SHA512
749048ead6cf6070465b43c8521bbf0eac2faa6694e09f35372f7ec2f14bed8cb05740517ab9b558915c26b4d9f9526ca34a113cef47df3e7ee2960eba6f7de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28cb04e1f0156269a2d2b61dada525d8

SHA1
98f38f1b05209e5a44f2c01257cb3be811474172

SHA256
1a75f5b6b1f20df711ac99039843e6027389fab06bee056c35c73b4fd5b10016

SHA512
151dbfda452c48e03fe34e67788627621ad5203ded248f6c6fd24f438d9ac8f814e5ced85d12c2e15cb6d0fb33de40f0615e4d205fcc645e51046eef78b41a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f8f030f4fd60256b3a10fabf267fcb7

SHA1
9c255451654fbaf04787666bebfba54fc1ac06ed

SHA256
a401899e048d745bd3edf369a86fdf01bf2a5030ebe0b3b4ca799d7ee5c2058b

SHA512
04d4f1c870c6ef0381b3fa72f40b2468e9b1eb0f3e40aeead476b2653ca24bbcb1f0251a67660f049da94101dc5997f2ca1717bd4de96eeda7954b60189ceb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
27bbe02b8c3ad80ce7d321ff111a791e

SHA1
0581edd7021cc1af4ab8dea950b949a0a01d928e

SHA256
c06113c4a4532ffc1e926a1bd5c7993168351cf01ba9b27155317549c2b91722

SHA512
962400a42a7da4aa06dea111ea5b7b0fc83bf4c703d43c6c34b9b0656878d2dca69861a927c4398691cbad03d300a4267230bb567c11bf4e022ce3118b2f9e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61f62f9c358f80b86b36b81bdab88152

SHA1
649b28ac4702db3c85728ce567014b82d00c6954

SHA256
d0ae44614da6666f47c1e16ba387f8794b453ca73511ab2afe9759654de88e3a

SHA512
cc77c41404bcc3929efa2017ede27b8bbc5c486d6e87fa04d1ddac34af74521435fbddb81808981f85af373404f809b0f7f334bdae23850656d05600d400a356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2258f594c12d37fb7669deffd813ad65

SHA1
cc833f904f2b841015a4562db246714c86c740aa

SHA256
4f4aaa7984726bf3589fc35aa394aba2f43b0f8bcb5c229aeada3dd50c3b6cec

SHA512
d0451a6da3321ddb0bc76c82f5ca723756dcbbec118655730c436be68b7787b0a7f30f7680e30fc8b7a38f2f99c6cd0d63905eb0e2e39da85b393c5949ed7d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b918cece177d605908d4fa3ce6601409

SHA1
c14f48585ab25b6ba47abd2de13fcd1a5fb81bf8

SHA256
35c158df3760a72aaf9af9f4eab47e37aafc7e17918c669d571cb7170787fa4a

SHA512
60c91d6df060581806bba0b2db7a017bdc9619e35bc2429bccdcb1c917484a577401e231926ebd882d442c6909a8cc391366f5af5dbb92ae22e7ccd1cf18a8d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c4c7.TMP

Filesize
1KB

MD5
c4c1c0c99b84ae8452857c49f63b9c94

SHA1
f7d1334e64eff7c07ca10e98ca98681e71b03df7

SHA256
33ba75d845c79d8fc4abfb4cc962d8eff4d83443f247b8e949a2dd492c2a7759

SHA512
dc523af08bc8cc51156f91836d4e19c77b1805e739b038c1794795dfecaa22dfd4a56049bcf0692163a43ed97e8587869fb51fc558a5b2ce9512a877cf0e21ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4d4185248f959860e34298d4013111dd

SHA1
1211662783c6768908f9e350d9cd9d449cb22979

SHA256
806aa3bd9ed3f6534d702764982fd59136b0257bb2d1f6f613dd702d3a51b382

SHA512
a66651633b934e0390d120a7c47cfc5e49c89857743d69beb13b4633dbb06fb869b7fb19a1d5c41c5d4676986b25e22ffd7689941ddc82079b361b42e1a11bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49e1d03ad7f09dbc02ee4a08dd8a765f

SHA1
2d50cf361101762d14989ecd6981216770a55bda

SHA256
4e9655335cf1360b2f9916de60cc2a7a0daafe3e469fa83f7117fc384c0e5cd0

SHA512
d41a9487fb97fbe0fb0bf8e4fcec3bb003e503e5d7cd35cd0bc2fb565834d6a4e6a428fd1844752059f0266dd81f35cf9a657fe665508c6737a0086eedde3c28

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
863855339f1887f8549c48a6827426e8

SHA1
a79ad659b110f5128f702dbb3bf00f4857034dd0

SHA256
617f3ef9885963a5acdf1543dd83338b7540cae5ba97a28d232b7046d9f8801a

SHA512
939c710e02210512a3723f6de277075b403280c187601922b080a1d24af934d24c634086b0b06a9fc7520229d50e3aa0604aa2360fc522a814fdbf3802ced44a

Download Submit