42854213563dc18508a39de4dc85f95f08c1ef29358e21731b8ffb7667658e0d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

files.html
Size

66KB
MD5

0d266a7de2694319dfd4d0d4a741afd1
SHA1

a3efe7db4f3bbcd2737c108d81368a468c436380
SHA256

42854213563dc18508a39de4dc85f95f08c1ef29358e21731b8ffb7667658e0d
SHA512

d42ab9efd809c0aa2b8f7573d196142bb61ab942c87897a55b1ed86a7e3a5f818d09a7e7b21a4b30b2392dbf59296942e766db71d121c176609306861bc3e533
SSDEEP

1536:WKVRucoVs6uzyCqkC1XD9YE8iYkDO216BalNIkD02tGuPjoLS:WKV8/Vs6V31amDO21HbD02tGuroLS

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4360	icacls.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3316742141-2240921845-2885234760-1000\{A2865643-77EF-421C-BE49-C343002C079E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1852	msedge.exe
1852	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
2644	msedge.exe
2644	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4492	javaw.exe
4492	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2728	1852	msedge.exe	66
PID 1852 wrote to memory of 2728	1852	msedge.exe	66
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1816	1852	msedge.exe	91
PID 1852 wrote to memory of 1756	1852	msedge.exe	92
PID 1852 wrote to memory of 1756	1852	msedge.exe	92
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93
PID 1852 wrote to memory of 876	1852	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\files.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffa520046f8,0x7ffa52004708,0x7ffa52004718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Roblox anti-AFK.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4492
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7879252788419919989,9309783356560593464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6192 /prefetch:2
  2⤵
  PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4e7450236a2a0d155ef2ee711ac72b30

SHA1
7beb25c5d2aaef9c1eba897c07ca39daeb10f075

SHA256
04f3347fa751096c7a0ae7dd81ee793c465b6793440018177c35aea4d81371c9

SHA512
172df8874510e06635254b1bd63acddbe5f31b058436370854991b1ee96512751d3b7b936a64a63a22404dc2538419fa40d41b4f9a25ba60599d879dca93d7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
64KB

MD5
a4999e4cf09383d1d944f2ff9fab1a98

SHA1
79cc3ea1518d8f535e773908602e248f9cc6f38d

SHA256
ea5b521612d76991563891e9e1884a183aed35ef3c235a694bc7a65262c8b870

SHA512
8c60a06d3bfd30ec03899acfc6ce45a84e08154e89d666cc3f3412bf98c8e5a737bc2e747c15f2cd5ecac384e72f02c4ddb815319aaac7479f74dad0b9eb2265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
25KB

MD5
c57e3f7ac99f615ea7d4c71ce933c80f

SHA1
e946cf2306367fdd0de8705e62ec05e6b31c080f

SHA256
0ec658bba227f83bf15e11df9726d089adc91746745646a47968c23603c5d2de

SHA512
1ab7317dd5ded1add5f3c86ef24e3bee7c9e05b6a16d73cdaf9812f9b1aba4fcd9c92e4befd992026cb574a077674671ac052fda7c915e7c9aa3e2d2d43f29e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
61KB

MD5
1971e737391eabf87667012e84069a5a

SHA1
8fd29644afc6da70873c25f9bf9d1c495c759843

SHA256
c9aab23276584648e971c3745fca3bed6d9e4c7e373bf3dc7ad316f2aef42fd3

SHA512
23062a1d410b69532d3bf97ec7d1fa3c27e974613326fe3a3d80f909d595bda78f2ba366bcd612e494ecee1af1493264d0044a26fae604466e5437a25da6280b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
9a316b23fd25f8567761bc15b6b05580

SHA1
a637a99cce6e91aceb7322eebee7090dda19ba7d

SHA256
de74dc5abcbee16a1d7afd70697c1f4d7a3ed6044a359617b33ca009bd3ea216

SHA512
64d5e75079639aa21d0f0b7235320815abefc6aaac15d2ec864442accf187d72e9467199879a01c5737683ac0c94272a38cc550b6745e6f4e734c44da6cd987e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dcf540f8ac4673b9fda44c53db2603bf

SHA1
2af9e425561a7ea5e0c58fdc300dde13c1bae5d7

SHA256
9ebf9f885f5564365baf033f1edf3f30966aba77e41a2fc7b6e54832ea0b771a

SHA512
154f5cf549dfdcade6e9c43d918ca58d8a8ca8e1d3c26b1264ca8a26c95a788382ac4683a554830b2ea5ac3fa5bb4a2a9d0b6523b9683a5ce93040490b89e2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
701012bb8e774ef5580c65ca97869e0b

SHA1
8c1c531b67655eb608b9ae74d9e9ebcc3255e093

SHA256
f532e018e04741a56f27aaa14c2727a91dcb7d121c3db532932f4aabed0519c3

SHA512
9faeb8fd27ebd131ecebe28e9a3302a35e5dde0482ba93acd136f8603403b23352c8126ac9b70adcfcc3924886313ef87c98baac39d2b1946acd218495442708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b36d4724d843ce78912baeb9751862d

SHA1
c9a2f297d41642a284dc48e0dbfe5c02420e7c1d

SHA256
cdbc37c09ba504f521323e9f50ae3411691d350e8e6ae1f1d2dde6e32a07f288

SHA512
20bb342bce8bee2e71b7ae7a52b087abbf4d556b6d0f03605bee3e296c936d58d88266c66805dc0019c441acd90adb99568ec79c4cf388caad2093c46f8df800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec35d84b0d2cc9d52c196e2854a9e2e4

SHA1
4ad580c23ebba04aeb5ed166a779239dd7691ebd

SHA256
2af57ba6f0375895b1875256e9af07b5935e44c990c4fd3b32e0ee5361b602ab

SHA512
1bafe9f4822a3430584e71a093dfcd017d7174e4b089d98c137ee1be90d61ac61e49c08152163c716169e306987f3d6492f81bc68a43812bbf44cfa5f80dbbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9567eaca2a1513f496d0fe0bd07e7310

SHA1
68aa7e746404a78eab5fd2f929718b7aed859e0c

SHA256
9d4820a04fd0026f4dc4725a59a94c098b9ee7f2072cabcc71efdb5b201b5e23

SHA512
26b61675087ceb16d9aac01980c2455acc206392653e31af2eade7b9c9505edd9ef0ae84143a15cbf520878a27a853382ba220b1fc6463b19acff088818e362e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e4d74f4cf4e3c1dcae4addf40a15aed

SHA1
df82b0fd75918f9b772fe174f5eec98d3fad4232

SHA256
6b2709e48fcd1928f98339fc27637021c25de542a65dd12d4ad025699f37f210

SHA512
be3297f7148c8dedeeecb2fbb6662a4bb964479418ffd7b5be075adfafb13f5e764416aa008d65b363865e8ae827fb54f3e48edf3812238ceeaf09bf17ac31f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
34165517bdbe04b64fadd309ff610768

SHA1
7157025c0c01cb8fcea15ddd0bda634d3b2fe44e

SHA256
273e5e9a06010ff04e3700ed1f4c2183fb0f1e75e46b9da9ca5af178709b5ca8

SHA512
25c9beda162b0ef94b3a8f75284a2a8a0cd158385c89825c53e3f27f0b603110663a8188cbe7f7ba771ae608f0f285c1880e1fea80d869969351d7e6fcd62874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0321634db347b720744103561132d86b

SHA1
b37aab51fb17ca159f5481fbc44a546efd99e532

SHA256
0b4a029af0bc8522b09b9ef4cfdbde1ee5cb24eab3cec3275105e76d1e3a08ea

SHA512
f80a33b8c88ecbd24ff9b86640f767061177b7b3c5b85d9f72b81e14311fe0cee4134fc31b2a4f0c3088df7873f6bd0bbab48253ffba149d20b9db4385b39c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
d38d53faef0bdd3d9502b427323bcd34

SHA1
93349a520a6c7a38a6cfca9897cd876ad175b9f0

SHA256
4a1d071e8e146c203c0eefa5b9a0b60c879a61db0995c93d1d4291a30ad13b94

SHA512
f0721f8aba58d90f73e9a20664a8477f3d943987f5518536a23276fb975addd06f7452bf203d191aea7a532c86d7095afd6c964f3d0ee410a6fdd061955fe26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
d346c87a7a4ff02aae96a6ae5462af36

SHA1
f89334acb4fda5b7200719b5b1f6e20d33d10e3d

SHA256
2d314718652f931bd4bfb58fc861c6bd542bbf777d7f9674ae17370c445257ca

SHA512
2a98a64f87c594ca84a591755deb7a61f2ae5720b90c2f93c93fac62c406678b24b583beb4c260e24c44c7d1ce178ccd9951258bcfe8266dabf98c6cf3f1a1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587c5f.TMP

Filesize
704B

MD5
c1a804eb3599d9d0760909f929c2fc46

SHA1
78c1d80f7f85cd602830ff747e4813db287fd149

SHA256
b2bb923660d2a5dd48a6f3815e3044cb278deddb2f2b9c109afb56eb773eb0d2

SHA512
98242d77d85bf53583c7aa3e5c154af483c56be53a65f714f3a62957159c4d7a578ae8d4a14ef2860ef341ebc4fe05fe4039bf75b3ebad6af9fbc858724a8a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6dd5ff8a19bab5d9f0eb201f94fe133

SHA1
e120247fbc5bef2e603a16177cd799f780b19252

SHA256
6e7d75a84693cf5dbe728c496fe48dbfd41baee9fd49a4a9bb9026f4fc2ca342

SHA512
c85dda360edbca22d90ee3e2c7ea3e091dbdb59614b1aff1fac11d883c86d508818b2974141176ad4233bd92de03257234c33c20c491aabc8aa6c924e709b936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d941fa9ff9c7d57fb867a46c91e1a88b

SHA1
08fdd6ffd53070bc98551e7cd7efe7208a267fe3

SHA256
737bd36485b544d90943ad4395a7ab10e91a88fe03c2cda7a4ff875ac460fdf6

SHA512
fd31234c33f6816c44c0f9e3b42de49447b12bbf37b40c71959b55668650e0058aa1e6e508b474657f55095e12f0311c6bfca53cb43c2e26a5bf60b1aaa9b9c4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 820467.crdownload

Filesize
3.4MB

MD5
b7d17db2af149ca895194cb8a7a37d92

SHA1
9e6d54bb19ba4cbe7c15892eca41ce6a546b12e2

SHA256
69b8e7597805862b86fd8d9facd1edf6c0f8ca08a8157202629c11db6463ab87

SHA512
8c3af9fb468f6f9a9594b528249ae0bc2a57945ab7701ffeacb9160b81f7bd8afc322bf04c78bb6492b5c4dde076f19429422b826fe21164280650841f7aadf9

Download Submit
memory/4492-371-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-461-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-439-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-412-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-480-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-332-0x00000253F02A0000-0x00000253F12A0000-memory.dmp

Filesize
16.0MB

Download
memory/4492-502-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download
memory/4492-355-0x00000253F0280000-0x00000253F0281000-memory.dmp

Filesize
4KB

Download