2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Resubmissions

22/02/2024, 07:15

240222-h3ez8see83 5

22/02/2024, 07:11

240222-h1cr4aee64 5

22/02/2024, 07:08

240222-hynftadh8z 5

22/02/2024, 07:08

240222-hyb3sadh8v 5

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoClicker-3.0.exe
Size

844KB
MD5

7ecfc8cd7455dd9998f7dad88f2a8a9d
SHA1

1751d9389adb1e7187afa4938a3559e58739dce6
SHA256

2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e
SHA512

cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d
SSDEEP

12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1790404759-2178872477-2616469472-1000\{DAB58874-31FB-4418-9BEC-EEA500EE3947}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
3320	msedge.exe
3320	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe
2456	msedge.exe
2456	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4572	AutoClicker-3.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4068	3320	msedge.exe	93
PID 3320 wrote to memory of 4068	3320	msedge.exe	93
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 2896	3320	msedge.exe	95
PID 3320 wrote to memory of 1012	3320	msedge.exe	94
PID 3320 wrote to memory of 1012	3320	msedge.exe	94
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96
PID 3320 wrote to memory of 1248	3320	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ee1c46f8,0x7ff9ee1c4708,0x7ff9ee1c4718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4291389026578954573,17388817087781930919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
61KB

MD5
fd0da247c572778b89b15413ad1956e4

SHA1
9009cd302b22b6edb98a97e9569fbb765640f382

SHA256
b6acc64fa2e8e311c90d54dbc05e76cbe0cce81e06ce95c900a62b32d1e0f53d

SHA512
97ecb491ca2365b2d0b6b25919c0d18b754a7d20dfc78bd427139349617a555fc4b8e47e1e7121a7ec8b604da6aebffa662bd87215aeeaaba37d2bd737edd175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
19KB

MD5
2cf9df4d427447dd00b9566db8465de6

SHA1
8087616509700002b3364e20c748888ab581b42e

SHA256
8008577b4c52cbdb4883d39192b6dbef37e006851cb0415c4752dae24b985783

SHA512
ea36bafecde55be1ffa649f4f873e2267f2a7633d9fbf9c43bc6ed1d7076761e167ca4944ddff9f26630f15266fb26237288dfeefcf2b1d6f59eabedff9c89f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
22KB

MD5
ec71c92b80c223cd69a79728849109e9

SHA1
81dd38dceb20eecba4acd3e46763a4dfefcc0071

SHA256
c3f7ce70d37f721facab49d8c60c3101a19bfeb04c13248610b7b7e0c4cc1e36

SHA512
069a184efbcb03ed2871be22c676cbfab63b701e269a737863852739f5eb1e1fe26ff6da2a1b6b8105c20e5e4dc3eec4b282dcc54fdb39ee7e0a976f4d04efe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
20KB

MD5
965bbfea8a5db5aea3a63da8c5b3d570

SHA1
ce645f4adf18c4ff26251610878969c9562de69f

SHA256
92a7f8224a1ba2ccfa92d3e1fc55ee5aa7ae20a0fcd80d3331bd660878a090f5

SHA512
17bdb764f190f97907462b8d0526474e0ba903a07a3fa3e71968115cc5e2d9e1629979398c6b6e664580b8f294d62f855f8bbf5f3fcccf3a40d90521e15b186e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
a7bca5c2f3bb15eb3ae7ef0feda27a3f

SHA1
dd615490f8a6aff0987566bd550a55ec213d8c2f

SHA256
001fae4c7c858b408d4165940a1856949488d78d30fb471407a2652aa3945665

SHA512
ccb2e7b6d87c21a3de87508c27c5ddf450c2a25133c82a0ccd30c3ddc1b491c561715763e16584b7064e04e8281847200b6b2d80adf15c48ecc7888506b4f748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ab1d136eb1c111077b5fa8ad5a037865

SHA1
052972be19dcc62cc8c1b9fb335c0b542db854b6

SHA256
e21982889277f8c9020823a24a5240f8be5853599c2a9e029f67b1a72e1ef894

SHA512
8c51859aea8cf2bcc70215117357c2c3bc4276663f9642264caf14d250c6cef035a0c787a3d31badefde4168114478e075749b38e718fbb079ddcb36eb8a565a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
73c634a2f8ccc418c155dbcb7ab3dcd3

SHA1
897df8e7d01992141a01bdfe40f3ba52df34c781

SHA256
3512461230031f806ebee5e94e67a8c5f0b49c043444c62edf0cdae7b09f970c

SHA512
fbea3903dbddcd4a41e373cca0e473345c0491f6c0803769591ca8d8e6fe75de7b0b18107615f5786859b1303cf1c4ff91f9a3d877f6306968c2ede3c132c2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bf04a1246cf334f8dcd84481ffb3efab

SHA1
a90649b7e5c32a00baab56e56bdd0dc58fc6b0a8

SHA256
3223658c5b71a5fc9c0f5a2e7d9ff829bb74538aca41525b60a0d13399bc6301

SHA512
755eed02405a0c103e533dbefd66ac1f5781ca6ceb70cae9c9c8eff46212a229f09ce0390211846fc851f68a8edcb0fd8592fa634c79d2ba02f343806abfdea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6756ed5be8cfbf8697d8d9873176ac7a

SHA1
00119afbac7d6a42cb8513847dbcf5927a617e18

SHA256
d46f7b04ec7d5b4f20dc09d0aa86c8c288f23552574a348c67a1bb670119c3d2

SHA512
7ce8394cab7ff37f56b0299208f72a07e074a886b5e331655723420bebccddac3afbe91df749fb7e0bb1f8b2764f12794bd02b17967211622267c83918cd45ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0ec19f1a672f3eed8fc7266ccf3d6b7

SHA1
b9175e0ecb0895e6cf31215f6891e5c42300430c

SHA256
acad53ca9077ca6965a33a3fb5dff4390a9e3d3272fdeb361d27def2380f09e4

SHA512
159d2acc71cfa2245f1fbfd8c127f5f63e593605df63cc7cf00245d0b367be4c967b6d29793a54bf0366c67945ee482f5a0dc000e46ee7b7e7a4d4ac4c572d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6dbc50fca12c2c32fc85fe090c86162f

SHA1
becedbc36686cf0b0b9f64bff175b2fea4e4a9f3

SHA256
7939a8da2d16a0bf4134c1a1336d5be67e019e3f4e51c6997e2b0b1e5e9c4c55

SHA512
76d226f32299b20d43db235ad60d7793e5d3b3d11b6cb81ad1167347783f2b244c179c54cf8fc8a3745ca5ca9411a197a77eba289e31aab0849c781fd8a3887e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4f07a17ccc93de9ab8a0dea332d65bac

SHA1
81ffaf35b9e3a4bfd8ab0b3835dc7397846098f2

SHA256
f9964348d8bef8530f81560756b4f3615caa6244cb3156c698b664f7b3bc9d84

SHA512
7e3b696fde76a8dfeb6069d13edc1575059f898a4dfcb0100fdfdeab1bedab4e159ed221318be5289f7f8079088f40c06c1a0fad6553f52a8471ebb2e7fc254f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f5211f4d386e1d5b544e547c1dc26e48

SHA1
1f40f74b7c20a42ee13fb4e02f54d386aa298f2f

SHA256
88d1ea818dc204ca9fd74282892ed3399eea730c7f54abcc091f7051ff02a2fd

SHA512
8ecbcea784ae9de78f9099da10dd29f94ba387424f22af37653387e0381066acdfa96508f528054764559085ccec9c9617cb6406de4909ede4de25f2aee0e535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1664923afb2f9553319fb1b21d67e862

SHA1
9790dace3642f26c3c4bb9e9c9408ebe249b581c

SHA256
5af1bbfd9b40228791ed649c61873adb1297f0acd54742be9097924c8f924a0f

SHA512
e3cc332f6bbb9ae4060b508146ef2593a3e066aae76428beee8f842620cdca009ed479dd1bccf7357dff87417c60493d5c983b99ccc14bdec7f3a6ead36096ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fcb9303e0bb29dedff4154b8a06e7b47

SHA1
ffe990bbd7f4772a5b6dfd34296d6f5e7bbb06ae

SHA256
abadf05442cd945078e575be34cbe20d6ebb8a2651a29346fe75882cc7d0a597

SHA512
a74291f34654fabf7246fc0f33b48644a04fadcb66fd8c30a751325e46c2ed07147f80dcaf8b4ed23c8943b839aff667c7a223f67060b3f52dc66366420ae622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a653eab88dd7c71243aa6400e055af5

SHA1
5154189461da2c13480338df1cc8b2c67aaf4615

SHA256
f557e9210d0fc62b325ce8bf933bd810ff5118ba9dc7080643b15c77f16d4e13

SHA512
a69265a5fb892dc6962584129d431ab8deab981722c7e6499adcb6ad1571862366fdabe25c7c20614f0220a61bbb7aa09c21a56dfca0ebfc6e7e00316964367a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa2f.TMP

Filesize
1KB

MD5
a6c9484cf1f4ad5be5d962922bcf5969

SHA1
0dc6ccc345ce278654274a77df3405c1d79254e8

SHA256
c58616ef975b7c9320a843d0fec0c2ddc1b13498be94362b72348810ff9bc764

SHA512
5c8b03d5313325d67978e00b44ba617395c2b9756d2b305e1474137acadf7acf30e2c3c110166b0d09c5b4fe3fc4aac8ba61266e2e7d9c5360c03de5fd1d0ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
395f7da0795e1965da8f6876fb992613

SHA1
7755e5e5cd99b7653e4f12b55bc76048f5402fb8

SHA256
bb5a98dee63d8d4fdee1bb030e6b240816e1da36f6a175517690e1f460bd72cc

SHA512
9da9f9398b66bd30ba8d68f089ea64c764acf908eb7cb1492edbc04ef0361378177e27cafd1c20f9ad6324d454a0ee48ff45f4b2136c103dfde6fa1c03ad88df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20b324832bc5985345d38f5c4bad6dea

SHA1
8e9806471e4c48d2e321513dce88f0e62cbae4c9

SHA256
ca05fa1e087bf89f96b208bc285ae18590018de179c6e7078d88c280387b5210

SHA512
ae9a607d5e4653ac27fe8aef4a0d5a35ae85b7d0474aae9a8b6e9f0ecbc7573d01b88c28387e3e2baeb997ad7e7bbf24252d4dc1b5b46b38a4d519a3e8a3698f

Download Submit