hxxp://x[.]com

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://x.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{CB0A88C9-EAA5-43CD-9578-300F6ACCA3D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
2784	msedge.exe
2784	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe
4176	msedge.exe
4176	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	64	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	64	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 524	2784	msedge.exe	85
PID 2784 wrote to memory of 524	2784	msedge.exe	85
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1940	2784	msedge.exe	87
PID 2784 wrote to memory of 1292	2784	msedge.exe	86
PID 2784 wrote to memory of 1292	2784	msedge.exe	86
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88
PID 2784 wrote to memory of 216	2784	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://x.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb6a446f8,0x7ffdb6a44708,0x7ffdb6a44718
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,4528728500742491414,3959330592409884052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
2b98ba8a46aae992b09e52759c2a429a

SHA1
0481ec3b991d21171029b82ca71bf8778ff9565b

SHA256
57760e0dcbcea1dcb169cb4d41d89b3bbd5c994dd2f2b7bd97e151027c427899

SHA512
25c40388573a8ec9c30b1080ea60f691faee5ea10ab04828c6c6460bbeeb6c3589f93a814f15aa0da8bb00ff83b4817255a7c34397d61eff6129346b6f942f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f9e18939412ca6b9099b2a4ef349a7ab

SHA1
747d5a1071246968b878130cc17603ba6ae519f6

SHA256
f66bc4ce84f85fd794854fcd509a5dfc9f75edc216d287831a67702ce6c83062

SHA512
ebf47d4f2a58823200cc67887df454f9600967114a30e22f831e43f99a9b6f0db8d6233c3b9d72e5affee9a544df8a4274217ff053cd33d205442f7f82a38239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e450e786904b626c3f3eef260f964fba

SHA1
d5d25df269d4b7d0c1ea6b63ed7387d9fd17f0f7

SHA256
35c992309542c8e6c4816c7deeef0a5097af779ce7780b07ca2fea8592feb72c

SHA512
a93d8415086297510ef9c3ccc9ed83358207f14cdb11f9a47590a7e7f1498f9420a4def3f32c579c993bd110105a5cecd1fc128f9ca74b40b87b3f0f10f23b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
18b4759ba4ef96cab9d5a5a5be5cfd94

SHA1
9f4ad8d291a0ece012cc4ba672f7a43bab21ec1c

SHA256
eef6988ba8fe6b45fc5513b62a8bd3ca991260276d458088e35009cc46495e33

SHA512
9dea583dcf9ab4a43a47a31b1249cefc924658902495d54fc053782e80953e8315d48b88c0f9f8d5ea5a28f6008884174b9394912b7e7459775a1851c0ef4c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d18f1529366600450b725a7663ac264

SHA1
3a7c051b2ccc889e24eaf804865d94d6869c2215

SHA256
08a96da21a40de919d92c18aae1177b7ca735488e8566c6507ec4becd72e159b

SHA512
62d914a97de77e167044e4b43da3f956fa14d1d1a1dfd2527a756d34045b20037afa6fc3e08dc93c4006f624950dd242208ad564c9e8fe5323c1e1e02ffa8fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd1d63a77fec7274f03343a59c370115

SHA1
cf647286292f6d1db606d2e09ee21100ddc11d4b

SHA256
66b3113de3e7e3c8fad082912f438a9b5743167f738d9a6c5193eeecb009a5ac

SHA512
809ba86b4e39c3b1cfc615fc6c81813a185dc6bb7b67c7e2560f7d7fb3f46ff7ab80ce020c6424129beb7fb8015d6bb7242abfb4812ccc1f85315cdf8aadc2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9243a6707a47d0062b16ad6b054fb67f

SHA1
443347dc27c073af1dd8fc7ea458d96ca0816d5e

SHA256
b8066a2334ce82d34da9963a61fdece2496b6f2bc8ed9ad447e48b910778e1e8

SHA512
9fb7d19dfd3ec86d26f2f494fce4cbaccdc8e46c265c26a588cdd018061d8f38bcf9fc53b70a8cc2481b6928e1dd86ec8a662345198dc39d7a620a6b8b70259f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
995c11304f392204d2821da7bb19a5c8

SHA1
3062831b478144f005987ac00a8d59ef66d5640b

SHA256
fc6f0c1188b31073e276b2bf4343d4a1513d369b236ff68e62b39ad73d2ff219

SHA512
69ca5d01b5bb42e63db71752602bc02ddef9300a60c9dfd0cba883549960f89f1bcf9278a13aeba7a91096730b1d69373563c4c9f71cabbcc2c797401d16d639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b725da8a6faaa513ff5bfeb0b77184d9

SHA1
74855aadaf4be48dbd6833c3bacfde10b2428fff

SHA256
9cace10986c0d449594ca060731f56b59f3de910948179e1aecf6d12a8c396f1

SHA512
c8fab08ee0e4b0f826ad4bb58f5a1e766fec6dce740e33b5f05d2ef2f7e500efde53d23e6f24c12a6f60b6e1c17323ac6f2e41e65570feed9848599b271cf262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41d1969e3187080c44148ae522fab0fb

SHA1
dbbad3453af02c8a72c2c15a48d4cc6ab50f78a7

SHA256
4dbdd00066e1348fcdc3feceae244adc088a6b0560a943b8ecd52e4046146149

SHA512
5df93a992689198a53cdaec411013fc6254711237a8dc2f9ec9814d78e8cfa14d986b40ae9c712bfb5ad8daa058528b90ea2cc7c5ea0c5e63874f996cd09a6a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b91d385a75c8c1416d76ff5ed673e004

SHA1
9d10f27e2293a7e1268f4bb819e49ab3f9f14c8f

SHA256
3129e5b50982769d02470cfdbd45a30e45fff5ede4772fbcf8dd3e33abac5899

SHA512
082f4f22a7cc38390b2a94331fe6f79c83d166dca9193e7b47d126c33a87057a479915d1c651a6dc70b56e7b3a91e369706844316b92d501543442265c1a3b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cab8b086651c056eeb75f2fbdcc16faf

SHA1
167c10e72a4e3d8fd72fbf28804b8983dbeec8ef

SHA256
0ae9cbded9a3c56b8a0e209ce99655e9b94dab0de5918cf91c08712672510708

SHA512
8ee37f7d6e52da88cf78e1d124c1b906f82478f6b52ab1459b36f91c60069dcd7d09facabe98e53e248d41bbe730154c30ba2c9cca47ae4100365a3188f829c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6aa09056ffa3bfc9bb062d78552896ad

SHA1
8fbc18f6fee55c478d282d69ffb1a9d7d572c144

SHA256
73ffd2e57aa508553c7750df12bb0df8a4b74359df0b4c0ec6caac26047bed2d

SHA512
17ac02c96bcf9b380d3b39ea5495ae1f28e0cb40a868c031b6550fadeef9419c9778b3ef6f83e9a49e28b3015c55fcc53f33cc5fc7836e7de994960b56ec195c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
56153cf0b7eef8a95e6e2de00dff85d1

SHA1
90470c546f4e71642ddde3fb9453d3b4eee5ca69

SHA256
fe115fff778f002aa2aa135f8b8fdc4b558b7a9a288d46c7fcbd47bda4919ac7

SHA512
37879722cf16c4888f8a4b4ae98d64363cf3a8dd32772269e0c0b47260673d31709bbdbaf8a9c9b7c56924643ea8876b043ca0b208bc4c79734853cee8cb76de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c4c7.TMP

Filesize
1KB

MD5
45bdfda72e6aa71fc6ddf981afcc81b7

SHA1
85f04d082c2df05ad1ec615d0b5df1eea2360cfa

SHA256
6e98b88295571739936884c1dd721b0a483586161506a856ce57180d05867dd2

SHA512
9f5b88a34c4074a4ef31f28bca1c90618ba6a8ca126be2cf426d19660d11fe08b37b69d54c08e23b46cb520c65015bdd0666f330b2fd2fab5b4cd4aa21f645be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
331e90bf543d78f5e494cdaa42e464ae

SHA1
b9014765071e561f92955982e3b36d0fccd7c8b3

SHA256
6b9a5c752f790197dd4c5e02e571f3f3959abd4999c93e09fd002d5c35cf046c

SHA512
e1e50931903c530c8a9aae022a429c721595c0cec3cd84722dd4152dcc20146ff1fa1dbb16c38cf8250fd4cf17e3d4935b3ededb5dc7d7aa506d8b786ac1d7b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
0f759ad0f7e078cc03e2479d13c6473f

SHA1
d01f3ca6f55948a3496c9c8b3924a6b81e99966f

SHA256
8ebf5dbeaddc1e8005085cd66556c43ed56c66cf4e6a36acb98617dc541d2f0e

SHA512
26abdb16fd063065ea9cd7e741cc8c0a905dc79d53cd21a11fd7fea311afa75b2f8f2f8627356962b625b7903a3a4768d3c11e4c610253f96f1ebc21a11a9ece

Download Submit