5c6fd6abe763f63fe127dcc79b737386af59e1653803c757272f0bf598cc1dd6

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

DF CONNECTED v2.7.8b.exe
Size

159.3MB
MD5

ef345b98394c7a9f7be6c9eb70b831bf
SHA1

63e07d6d89b417606df504e04ad1a678c953601b
SHA256

5c6fd6abe763f63fe127dcc79b737386af59e1653803c757272f0bf598cc1dd6
SHA512

a674f5cf6de4f4425c57ce711768a92611999add010cc7f2d92acdcce52f5234a1b64f6752a9135ae549d78e0833991dae0c8c132cf17e5b32b97eda8b06cc70
SSDEEP

3145728:jIHF86KT4FEwYNPINIYbWTOU3lJvKmEG1+vPr6KQbd6/g9cfMBOOOm2DNxrwNcLE:jrqE3NgNaxnSm71+vD6zd6/gOI+vNxr8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{E79DCFFD-9AF7-4C7F-B8E4-7E87851FD0DA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
396	msedge.exe
396	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5900	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4932	396	msedge.exe	101
PID 396 wrote to memory of 4932	396	msedge.exe	101
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4520	396	msedge.exe	102
PID 396 wrote to memory of 4744	396	msedge.exe	103
PID 396 wrote to memory of 4744	396	msedge.exe	103
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104
PID 396 wrote to memory of 2968	396	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\DF CONNECTED v2.7.8b.exe
"C:\Users\Admin\AppData\Local\Temp\DF CONNECTED v2.7.8b.exe"
1⤵
PID:4040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb608146f8,0x7ffb60814708,0x7ffb60814718
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4831909390896057388,4182979228619183187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c462209-461f-4761-90e9-0b0a3deac437.tmp

Filesize
10KB

MD5
931ab2092a369ffcc0b8262d895ce9a2

SHA1
b917878a0d552585c967d76205db3246526edab1

SHA256
5074f80aac981e411898cf98128f077aa96af22df091ca53e100ae1da76e57c4

SHA512
30d98815de88ec2b1e8f7f446541474d2dee9f131f269b6da2549a65ab8ceb6b55a5c277a42d1329232c7583b41ac4f7566d2cfa254cce9e740688f8162b7053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
25KB

MD5
856ad6139b930a06b9898fd3cfac5199

SHA1
a5b5e8696bd5a4f62dcd505840bcf9e550c553dc

SHA256
84bcb10b7731d5b0023c134035da00c399eb1f37af7e80f1418ba69d1d078efc

SHA512
e2ae430390049ce84b21d0ad1d5aa8efa6d36390997317110bc500410a37739778bfa81eab990017bd75ba9ad3520343d9d7a88d56de643e24e0f1d27efb2508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
580KB

MD5
6eecda97dc08ecd7694c9549484a6877

SHA1
87ee99ff12b618b376d7b83aa95e1cbc57fbc179

SHA256
25cced3eab813e930ea6bd3a4d16e012eb7939a27933a63084c49a8ed2dcafb3

SHA512
0663f1faeb21c8d5d0f3ab75b3fbd4061fa41291933476ce657b3bc0b78389ee39a37812a6e38470b2671435eabb0395c69e4ade53f4d5ecd290c8d1e9667bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
61KB

MD5
a1eb05b2e53b4908558d8ff04593ba0d

SHA1
cf7fc2706462d69876d05b3a8485a5b5ff71bfdd

SHA256
d95fd728438d7db547d3f5aa714b2bc81add8cce4dd03b0ce479d2dcfc61bd52

SHA512
108ab871d7bb98b5feb0fcbf6705710b34976da63ffe1033c8b3fe9ef2723238d9686f3a1d49f64b6f11dacb69953effd81badcf4ff42d3506bf0e85fcbe9b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f595b58decd22ea4d0c4f7a598e9a70a

SHA1
2bb6f62d012576992d79826bed2a95e1d5fbbb92

SHA256
282537637516ff573cea107d205da94d4c5eb27ab9f640368540e3e8eec734e1

SHA512
4a655ddf6fc9e8939781a560b974d6098c5f1239515c2a50b8bdf1986a63022e2057e7ba600218a35ed1398200052d4a4b56834b1ac2559d6944134bd81db42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c0f16c39c47f513f637650689ab42d9c

SHA1
f1ee0675342e18839b2a0573a921ed00375cf028

SHA256
5b43b6acbf39b9c01b6f5181f857fb071fdb088b1308c89e02d7024b557aec69

SHA512
f914eaac226119cf7c33bf8b0093b75e9e014da08d4920d7f6b23a212db8202cdc8eaac0d03011c7c5346b5f3a8e9a5b3c294199a44e39aad34b32763583bb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
4840c3ed11dc6af48a2753343f0fbb38

SHA1
f40c6689e4a507e5f01d24a80724ac5434106308

SHA256
86a23214bfd6ed55fc638f037cda961c2914ca7f6c8a71b3074998069a9d7106

SHA512
7eac139e217521df00c1a744cb196e0f85634d40e0b05457a015fa266509880c34e430afe60eb1d7391880b4eddd903d66786a2f615cc73812e655bb8c9e35ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24582a20f625cb914efd61be7dce7b0f

SHA1
25aa0fbc198b9670c59e68be01aabfb8a1289c3d

SHA256
f24b7f4bee820d49f33f3cabcf0d6e98fc13177bcbd7ab24ff499ea5da22cfff

SHA512
a5258e9f1b9ac65c882cd6cb9f7d74a137021b6492308aea2a0d4c649c6033b1af437b8a43d98835607d0fe8c28c7a2171f9dd998ad111a35ae12184be33176f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3c564db8a9d3baa02a3035edfa4c513

SHA1
589a54a5679a801c8cbd734aeda056810f500af7

SHA256
d99b3c24484ee78b627a0b22d010c8c4550ff8b1e92f81b2b60cca5d63884160

SHA512
e0dd9971e3b870750c8907658711a42e9407324b6a60125c3f3f7ffe28f695cdfc8bd7263e53cb0af2e580c0b93bf6a2e3b2e6ca89b2c092945e3535e0147393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
fa26f50534859b59eb05786b957f19d4

SHA1
920cc32acfe1081736b775d7904c645a492a1cf3

SHA256
fedacb27f3e05b7b871283c29abe17728c6cd2ec2d84890c489e2aa30b58a232

SHA512
5ebdba0da560f210dd746c78cad6eea8bd82624265e83b31faca4df9a73860f062457f9a614b0c4f0bca73874ea664c4608bfa05ab7bbb40660f11b217f1593c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21b130a224d29539c06f6765265f6ae9

SHA1
0d01797e4a1a29d337cf6281b8183fa747e0d1c9

SHA256
5e15443525fa24d3720aa687dd0b401aaa1f9d55665f8641808c10fb416a9dd9

SHA512
b50846095d66ea653bed30ee2b5b01f48734c3368647b8eb8413029b94f0bc8711884177e6e01c80ae99947e9fe74379e0db4810c97de5b73d07c8a24dd3a9b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
1eeb85a8de8c9e83d86b8e0be18be095

SHA1
c5207e1bf7083d5a30835a4dbc6d4f29cce94d69

SHA256
aab6f5f785f0be5d915fe11ad010c411f5eec33808d1ed80f8092ca0367d4301

SHA512
db8239c1f2c49aa0c33c16268be5d6dfe9ea18ddb4ff234bb0c1bb2c35e309349908e251d2e8f26babf5151b3bffaf6ffc75eab8d8a1db25efcf7ae9a89af4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a87589e771af658a6c6e80300f72f82d

SHA1
9f1625de8c8824af57b5d7a1007af83d4f14fdba

SHA256
e99169b2f458841b6f51b6c7450dc2c9ecb3235834e7a7e95953ccabd044c91e

SHA512
ce1af70fa7cafeefef1119ab83a8b955e7bc180ac5bf003734f47c5bd789bebc08c016040715db4fe2889c02e38d79d214ce8410dbb65e89a912d4ab81be9933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e2c12902df3c19a4237d128a2e1f7f33

SHA1
c677f8ab17434505ca8d79a2c0068149e8f3de81

SHA256
84ebb924310d3d548082c6c8d1c3c24df08045f77fb008e60cc375848ebe429b

SHA512
bcd1dcbcfb89631d23af1dffc4fff4e0c2e66af9d6b27ca79eadcf850b15027e645f055f07dd759674ddb1658f6c0e98429c69fa825656f2cb1a7ee013937238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
810ec022a5ada1772bc5ce4f3163504f

SHA1
abbc626638c489ba64f69921bb45b4eb2a82cdbf

SHA256
39e39c65e23d8c0957678cea73da348f580588c0f479555cf5c3b0419c5d1fc1

SHA512
c439243056a249f841b370c9c758757b38f568becb8c3435862326514e465b064f72a3d8baac5a8a7d63c5d5f7edbdb4b0ed30836d7079a7c2fc2a5ea5dc33c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
83e979ed01437f4ae8f9cfcf0539e0c9

SHA1
2cc033c17dbf1a5bdd526298ec28fc65045c2c17

SHA256
48843d908acd347873cc031360989b8d1baa824bc014c1846b3a87d2b907229b

SHA512
db698a24b6b794769f04fdc6c0e113642b083796ed9527c534622da157824571d2db974df1f3d2477f4987f86eb7c1004fa1737ee751a022d7af52fc2c7e77a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5873b4.TMP

Filesize
705B

MD5
347fdfc82ee879b30b9c7d37ae6cc8c9

SHA1
0e93dcf47ba159223b38ddff831656981263f5c5

SHA256
f397b2849685b41b5e9772dc1984f538d51497c4e5eb560e16671ab328a40645

SHA512
634aa5d2015cb30b845202c114b45d7931f17bfcced5c67e5f10127677e2229c89a5d8ce9b237b618bbf6049b8bd6ce347f8c0ae148dbe2db478d2a5a0cc670f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit