hxxps://ns1[.]centaurocorp[.]com/

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/02/2024, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ns1.centaurocorp.com/

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ipinfo.io
66	api.ipify.org
67	ipinfo.io
68	api.ipify.org
137	ipinfo.io

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{ACF7CC44-A858-438F-B8D7-F5FB143A361E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
1720	msedge.exe
1720	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 5064	1720	msedge.exe	39
PID 1720 wrote to memory of 5064	1720	msedge.exe	39
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 5084	1720	msedge.exe	89
PID 1720 wrote to memory of 2292	1720	msedge.exe	87
PID 1720 wrote to memory of 2292	1720	msedge.exe	87
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88
PID 1720 wrote to memory of 2816	1720	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ns1.centaurocorp.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff37dd46f8,0x7fff37dd4708,0x7fff37dd4718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16657523171911226777,15755583052868819266,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
196KB

MD5
26ce8ff9c868786d0658c2a1c4dbdb30

SHA1
8cf8d6aa7ead37a7db1eb8b883082bf4ecb5e0c5

SHA256
017875c443cfe45dc7788bc04ca9ad286b842fc6258a8916f1102bf03af97f47

SHA512
7bf37a3127cb5f6103c68f90ea3be052a56f0ddde0780d7038be791879ae517669b7c7865ef91a02ed33dcf31b34e2bba17a0ef40679307e536e9bd4c831c7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
86f3bd54755dfda0ef459e28b21c3c56

SHA1
aae624f83919e70b73fc2424020d5155fd1e33f7

SHA256
09d69b427638ddd186b795d422ae3cc10443f94c26aa04200530516f2713ca15

SHA512
437297bb03529450ba15d6d8347c71aa3de1b539c9b6cc97edde5974365a1420344fdf119df7dc2df76e5be9f7dba8c7c91f15ad6f31537fa461ff30c3225735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
380bc4025e68a1c8849b5635364e2b44

SHA1
bac319ccc45b760484553b0fc6b3002093bbfa6d

SHA256
f8a2559769f12febc8dbe95dad867804e0a31406900b7b65d06d20acb0cbeffe

SHA512
572ae75806802c51dc1b35fc37154207c408e1e22a80932492849570ef7f7543fa25356403c2eb5e49ac4ce9146d028d8602ad1dcba0e67a14e580f6729b73d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9b39a1ebda0970f3c4f1b9b591f8fb24

SHA1
a042e666f3b9feb16dcb46a7509968675084bd87

SHA256
ec2cbbcf588f261f75f77d036400030baaa0660c5eb554861eba23232eedb17e

SHA512
e4bc983a1bec617253b8f3ec24f457557f3050df34fe7870ad48eb7a7df650cf958f62f397eee3312f90929d559a32b78c583745cd65bc6018e5e2d6d4407dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d04b6c19239d8f61f0446982fa34a5b5

SHA1
60b1219d575d7ceb340ae246f6f1dff1e978667c

SHA256
e60abf47e7f53ba8febb59a2fe5c4a4df15dd03d56750d0db27880b5abd06a9a

SHA512
80785a76357afa0948eedb3f55a975bdbd4c5a27020cc766a82644b21cbd5adaf6c368a8471327ee92d67583d2cca7168144c7895124d0cd9dbb060ca7543538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
732B

MD5
b3650c5cebcf4151e2cc78afe6b94e81

SHA1
1202e715cf50aa9a99a990a7a5cbe536d8b11143

SHA256
9860400ddf4d669e49a3fc2930a4cceb69a7800bbc4729349c20cb01768ceb4b

SHA512
02e09dbbd0f3821fa9461124f7e7d442cb85ee0ff39d21855d18c6d7f79babfc24501f442e41db2623276a11cc4af121ab0b0b60c374335bfb06f8dec6975288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
998B

MD5
174e959cb6e9ef1afdbfefd27da7d668

SHA1
7d34bb58c5a0fc58dc6d27c18875133749b0420d

SHA256
1e581b726d29857edfa00670b330873e4acd172f86f020e38d7c246f1476647a

SHA512
57291b2d14f88873bcb03b9d3d1a726cc9909daa21295187e5930166ab66972b44546cbe7f687f618907dce3eb9a6257e46395faf1a8a850114a9bf08048d7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e3363c055c1f391a4a2bf3d86cddc005

SHA1
afd3586546350579a87972284eae9b08fc651643

SHA256
58952ee5dc6f0b1d2504ecec18aeee10d14a3bd06acc438ddbd788e9d7379b03

SHA512
aafdf0a9af80e1dc8f9bc43602f05698f93ab54293a127189980422b6b18769997a835392e3d4db81e5c2f709e63d17404ce3651118ab49d26c3aedbd31ea005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
806B

MD5
5bdee3bb027ce7026da60e5615c6239f

SHA1
7092857f7bf5db4ebb1be4feff9947bd6643f843

SHA256
8df74dfa051fca19ca7e2b3e19a5839cb022737b85fa3d86c674011dc1f2fd32

SHA512
0290caf1ddc86a94fca8f7d9770dcf1613a6ad304caa2cc028cb8374ad7afbae8a6331b9f902357b4854a31691c5db44542003da7144d9c9783d7a692b164885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16983d3e6975e2b434e3474551e0fbaf

SHA1
8b1f161efd61be33b90bf9cf66be1843a53a954c

SHA256
66465279e004811401b2a2e8e926e3831fae9e2d6d5cdea85333f2045941e6d5

SHA512
6e95137e4e9f4de04fb6654bf5c7c90857c95944fb9560c71904aad8d3cf0fdb3a90897c6d9aade2338aebe8c41e2688678a1ce5c238cc56577bbf0b82aaaf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3c1713c949fd6c5ec3d930692513b98a

SHA1
0395a31eb3d0f2a17d6c04e0db7db65accb9efd3

SHA256
c4bcf113df7fbf7d108ca7f6d1a786b092c98b7e1d5bd147a52f1179de731fb0

SHA512
93dc3a2ce4497fc2a473c586693c7f0be84aa4f065e56484beea222e7f5d2d3c819062347587f38c16fe785647667c50c2aca6529284f6bf5cdad8053e1c66c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f4f270e9d1b4f120df4c571f6bda8f4d

SHA1
5718c038eece8f7e8ab0bd96c872f324a0328b49

SHA256
9d5178bf8781b32014cdc059d260c93d713df93f9ee1b1763dd3739c0bc5079d

SHA512
b2dcba07065362c9747acf0713aec37664b6ca2f52f24866a94e62164eb30ef385fb327f16fea24caec2582c17654c087bf27c98041a11ddcba8081f88862cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6aea9e667bef92b8cab74b9e9e10f413

SHA1
7992983834520899a450da799c02e0c8caae2e09

SHA256
3fde6e8eed53a10f795bc675ea90d2663bfb7b4e16808c65272b4e81f6a2ccf6

SHA512
608625310a2d2af33c7538ed9113f819e00c6d4b9696839bd0669fd25b17bbb6f3f487b497aa8958aa62dc4a0136fa9955b9f07fa300f438b35694ca4254789f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6055e2520935f0f57c427e6a065bc6f

SHA1
f2a63dc263d2c4f47e782057658d9ae6e8128444

SHA256
089a31da2cd70e57b45dcbe27146fd4a5d1e2bbbbf493783ad796da4ef559edf

SHA512
eaccfe88cca3d1830eabc5ffdea6304bea6ae3a4a7138996ed4a9dba5c8636d6e90910f49461b6c5c63f362e5980b3812644a1033d5b4cbfd69c881b16cd2f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b5499a50318f88d5c5311e1ef00a7778

SHA1
4117d14e49ec43fa051877215f2856d520d2649b

SHA256
bd24d826ae7e2918b93cd5e17e063588d56972b15d154d3096d64fd9134e884e

SHA512
92a4d0dcdcb2c51a853157a01c204f17209609312ec0e3a380a8c66665c7d413d75d132410a05580a0e0dc86d4d86635d0cca00f8a060f9b56526c4564c63790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
686fd37989bc2b177903ad326214bb97

SHA1
e4aed7ec6c59969c494eef45af062bc2a62f0d9a

SHA256
08e1a43dab5315d12008b2eb2406e08d6ae31b1b20403e6593e7a6521f772eff

SHA512
4f382c329b37127f72728f48e902f03e302d057b0f2bff6e9cff0e486c8a0810e8bc5b759b4239f0d05d4a6a1f34cd1434686e51733c76ce73692560257fa7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e775e691048a5656d9052acf04b1db31

SHA1
954073641fdcb2e7c52d50b62dec10d70f970c54

SHA256
2ee82afa85316590c22043a5ce1d5dff3380851174544d2900969c43640dcfee

SHA512
e4b9ad60387ada4f63093586d744f53bf742b4aac7cac9befc0e04b39ab3184d44c880816c9981883b3e46fedfbd6db8ef584f9d62dc3f7badebb8ee4c023d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
0dd58bbc2fb3e5080a8eed2333d22325

SHA1
49009af3d7723ec7fb19362e870e5162a30d3ff5

SHA256
6d7e9968c78b3b4f6ab568a09e2795eb9cf4560add58365d4ca24619cfa1694c

SHA512
393217422c9aeeb0032686ab91f00a2f35bd0bdb92c854daa166fa8bcf75229fd892b556a605ee80014e9bd0b38610e62bb5e094e91560bed8d3018b89e4fc0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2ef96e73ea8d17cc2bfa7d0d0d49583e

SHA1
89a4fe9c96bf458f5a2428d8d3fa967ffe34ad1e

SHA256
d9d6b44131c18563fa8fc665556640d6fb6e4a7ad360c64c8d779d3043489555

SHA512
5a455990826eb09f279aee5c620e808d6403f4523c60aa503ad42370c80bd59aa5b77ea93426d60e0773e7f24a6064dae53709b08c7c83ce070b72cd2f7272ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8d0a8f98019ad042749fe490084ae2f1

SHA1
cc35489538779f17d2c9648db5c995dc60987a7c

SHA256
e8a32620b6feb8f1afd5c0e9c8f013a844f32dd956c694acca032ab6ea4307fc

SHA512
e5e639a65f5f0613d1bfc6439e816d8206ca856ef2981be6e2525a4856c783838476c775ea6dbcd1aa88911a65678e10385666b203e37f1e0303a18a84776ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
2367177ce82f25ae4095b9edd5e0cb0a

SHA1
61f64eeb5aabd8ab3da21378bb3de1b489322766

SHA256
9349a24d3ec357bed6d508245f7480244fdead6b16860baa4d63a44cd90d78ca

SHA512
48d4920bdd7b5b631f926f0324af956b0d35817b3ace83e91fa43c64eb92faed540e6ed0cfd9cf2c5cdaecdb16758104b3aba368eee58b4ae7a5483ad93169d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
04f445164da6c122bb630cc216462f85

SHA1
0e765549d682186755cf81077581bb68c897ff7d

SHA256
70f0a3b61fdbb5761f44a9644812417d3e2314d1ae2cdfd0457169677e1e5dd4

SHA512
a1e6ba4cbe7191b1d45b76a57ba78a2cf96ac190507a6886a8143a0e113852ef59d91f486eda42a5f5b22af8d1c8ea1af782fdfd7fd9e15f73bd2538f860ac02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b650f5b3387208f2d78023df812cf31

SHA1
8a209f4206ab0bf292fb53b8b7c0bc52a758d792

SHA256
8facf75c11768a8b45012bcd2f5743ab666a05c720c095ad62a25d566254ef5a

SHA512
196450946ae4b47d4128723d0608510d9de315c46764fca13e58fd8ad344dc6ab8f880906cf6ff9cac1188b8bf9dc48089280168c7c7fc3d9e617d052edf7440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58751b.TMP

Filesize
371B

MD5
7100002daad0fec6780ccbbffed707b1

SHA1
fa4bcef6da29927e6e4523b8af9647d3f72fbece

SHA256
b92e7e25e9ac8074b8ac16a1ac2d4af329bbeac592da9ada0c117a994257bc1e

SHA512
1be41cd7679b4c42b262dcf1615c70c37e0d572c4d37869dda9d943b092b3bab28d32f0dfaf29d42ae8a066dc4797700ae5a82c6df2985071911e68a067d9eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b22189539098f0ece0a790edc74c6f2d

SHA1
6c66207174a862c940e8c4ec0f6475ea171ea045

SHA256
bd04255ca332f64190a62154726bd4f532d90a3130fcad0531b398e56169fc6b

SHA512
6ea14043dca6f6c799a2a8880ba256f602f74f45b3cabfd6859c3f0c96036ebf87c4a16a9a86219fdfacd5a3f48d8c3b8d78ea3d92f1e345f5675c62b64cc4f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit