4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6

Analysis

max time kernel
183s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/BgWorker.dll
Size

2KB
MD5

33ec04738007e665059cf40bc0f0c22b
SHA1

4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA256

50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
SHA512

2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

124 discord.com
127 discord.com
128 discord.com
130 discord.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1884 1052 WerFault.exe rundll32.exe

flow	ioc
124	discord.com
127	discord.com
128	discord.com
130	discord.com

pid	pid_target	process	target process
1884	1052	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings firefox.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

5856 msedge.exe
5856 msedge.exe
5220 msedge.exe
5220 msedge.exe
6876 identity_helper.exe
6876 identity_helper.exe
Suspicious behavior: LoadsDriver 10 IoCs

Processes:

pid

4
4
4
4
4
656
4
4
4
4
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5220 msedge.exe
5220 msedge.exe
5220 msedge.exe
5220 msedge.exe
5220 msedge.exe
5220 msedge.exe
5220 msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	firefox.exe

pid	process
5856	msedge.exe
5856	msedge.exe
5220	msedge.exe
5220	msedge.exe
6876	identity_helper.exe
6876	identity_helper.exe

pid
4
4
4
4
4
656
4
4
4
4

pid	process
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

firefox.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

firefox.exemsedge.exe

pid	process
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
4060	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

firefox.exemsedge.exe

pid	process
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

4060 firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4188 wrote to memory of 1052	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 1052	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 1052	4188	rundll32.exe	rundll32.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4316 wrote to memory of 4060	4316	firefox.exe	firefox.exe
PID 4060 wrote to memory of 1448	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 1448	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 4820	4060	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgWorker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgWorker.dll,#1
2⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 604
3⤵
- Program crash
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1052 -ip 1052
1⤵
PID:1248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.0.1373012879\2072467202" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d55300b0-aacd-4254-b082-0824ee1d3125} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 1964 25098bd7b58 gpu
3⤵
PID:1448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.1.720135215\726261135" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {094f8d57-a79c-41f9-a502-cda5cd383af9} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2364 2508c071358 socket
3⤵
PID:4820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.2.2097853666\994749356" -childID 1 -isForBrowser -prefsHandle 3200 -prefMapHandle 3216 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {725d3533-698c-4454-8bcc-9a2e40d5503e} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3372 2509c99c858 tab
3⤵
PID:4148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.3.1352025831\1804080258" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5073145f-f380-44eb-8728-d6bfa844814e} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3620 2508c06fb58 tab
3⤵
PID:4088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.4.1607963661\878443435" -childID 3 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e12e6b9-fee0-4f94-a453-1ee612d12cbd} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3852 2508c062558 tab
3⤵
PID:1956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.5.1522744182\421841195" -childID 4 -isForBrowser -prefsHandle 4776 -prefMapHandle 4756 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14dedce9-c520-4d20-a924-e38e509d7bcb} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4788 2509e7c9058 tab
3⤵
PID:676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.6.1502884800\1616471306" -childID 5 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13b5547f-5e77-41e9-bde8-d9a13f5c62a1} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5092 2509eef6158 tab
3⤵
PID:2084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.7.1803875469\647088214" -childID 6 -isForBrowser -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c63ef68-1d1f-4e59-802f-bea32e4f2ff2} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5112 2509eef6758 tab
3⤵
PID:3944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.8.1922008592\172765926" -childID 7 -isForBrowser -prefsHandle 5716 -prefMapHandle 5700 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b476046-8509-4883-bb83-042e846d9e88} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2952 2509bab8558 tab
3⤵
PID:1112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.9.1956759982\1061656414" -childID 8 -isForBrowser -prefsHandle 5324 -prefMapHandle 3060 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b370d32-baa9-4bd3-87df-fececa480bdd} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3128 250a04d9258 tab
3⤵
PID:5276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.10.2038338538\1558863707" -childID 9 -isForBrowser -prefsHandle 1720 -prefMapHandle 3996 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27e9030-1932-4645-b0a0-374e9e5e2684} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2808 2508c06fb58 tab
3⤵
PID:6688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.11.202338217\1105921604" -childID 10 -isForBrowser -prefsHandle 6468 -prefMapHandle 6304 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c9b9c3f-e891-4c3b-b279-e7fea70b1f49} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5424 250a3692558 tab
3⤵
PID:6160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.12.1254599575\605787139" -childID 11 -isForBrowser -prefsHandle 3132 -prefMapHandle 6452 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e51cf56d-cf96-474e-b55c-f76adad2bc7f} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 6448 2509f8b5d58 tab
3⤵
PID:1800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.13.1417043767\243183014" -childID 12 -isForBrowser -prefsHandle 10128 -prefMapHandle 6448 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce7bbd2d-036e-4760-afde-6a07540abe9b} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 9852 250a0ec4058 tab
3⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff17ff46f8,0x7fff17ff4708,0x7fff17ff4718
2⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
2⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
2⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
2⤵
PID:6860

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:7052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:7060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12455874031589490472,8348839766807013648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x31c 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\dd4e8546e28d439a95ae53b9477ed7c0 /t 4552 /p 4060
1⤵
PID:6624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
528bf6b7370359f12f12b02b0e2db1df

SHA1
6487b8131dece3f5edebef423373ab36c56cc619

SHA256
3be9e30d03099aa26b5bceec3d7fa661c6670bbe17533521bb0bbb1a7a309319

SHA512
cd1848480f3de01dc5f9e0736f4fe566e600e185114c499ba353febb800bdbf483e429bd6df64ea421f7ba3e4ea80f981eaabf4d11170edee9973fcbb0a4caee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ccfd28a8217ae8e13b6c69d54f42d33

SHA1
820db844e2b2174132505e4c2d42a31c55a4e392

SHA256
7962755de8a1b208041dc3f36da70495e5620f7d0bc9ced7f40e45643976a3e4

SHA512
f5db90c9ffe2cb5da0d9db052891b93b49b26c6fc4f4ea68528d16c3252acc2f17ad124b295771b8d5bb267dfda8b33fa6fbc5c595156a198ae44cc4410f99a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93dfeab86773727fa105244c1de99670

SHA1
e17c87c5a79c2aafe87ed13944dfcd4650eaa84f

SHA256
e267a60d8a1ee2e3d0cc7bf2b7cd5d273f7b61331485f31c5b1b37a7c65a7c5a

SHA512
c6623cc2f9aa336a77b62445aafe3344d4be289a64179034601d5a3150ad9a517b06e22af70bff957ffc4d7347ea0bcc4ccd72a71025cd0c2c01cf0761725e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0c3c84610619f8edb42969539536c1c3

SHA1
dadd4544f656e60288d4d02eab94c2b21997f3c0

SHA256
fcb2ff2ac8f3e1d7f17e1988ea946a2aa5fa6cb068a9e37611c48d33bd0b1c26

SHA512
88768a5b1dd9b219904db6b1bdf3b6c589b53ab0c5ec4eaa9a5789bbf007fd99c611f35044e9a3422ce20c9dcd565478b4fbfc0f6b76d931489cb7f517d6100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1806c03e10f3c5a12dc61419e7a5fade

SHA1
7602270e0a59929a08ccc7e569da9f304d26e1f4

SHA256
aef9ba21964bdb09042528afd0fc1c8da51269dfcf346a423edc5deacc07da51

SHA512
5f64aba6c714a0f7687fdb0f570a1e509b31315a8cc4c67d1fc3806d959728699123e26a70a08c8942dbec88bbe418e98654a30f94408bec3ecdcdd25be88d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1c03ada08b34d1c027a57628bfc903ef

SHA1
4dac3d545042ab5ddb586574ac97397c18891042

SHA256
3de9d4cd59003c2b3627331baee347f9023eb57fc042c2a7f4afb645a8230c23

SHA512
4d81e6e10c4d3dba17422a000975093a1df0bd0ae588a4660f91bff261e71be9fe950617f2afd2780e1cefa8a1632c3c0349fb5ba52748d8e60d96a501386b5f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_FF714C1A721F46AC89DABAE8ECC504BA.dat

Filesize
940B

MD5
7937fb5fc3682ed13e809bc8d77f6c11

SHA1
8bdb1e3ac6b850f08de712d937925cc10cff8b9d

SHA256
63fd9089df7a4e19c8ad964b5468c253bb12eea0dfc85411864e8c618a5271e0

SHA512
f5de06400dce3ae5b3d3fd5465699c1aa47cc53cd6f4e1f07dd22e14a3ccc724a8d03fd32529428132142fae5b77f61c17708e00a3912f0384ec43c92f53f12d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
14875782139e6ab9305bf8a5c20cf23f

SHA1
3e58d60f737bb4a0cc144a8fc9ab2f88073b346d

SHA256
e3201f81b262683cb50b4a720fffb800cb19d2bf520053c3d4f4336e4bf0f80b

SHA512
4a12a4facbf73a7ce1f9f3dd6ffab94f12712dbb51ef969a3288c212516a92c9f627b64f900e3222feceee7f16cda93427c765addc6e1785c73443de6cb14952

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\1768b886-daa4-4728-8f60-7898e9cca368

Filesize
746B

MD5
1f7b3fc78efdd570f0230b664cb1960d

SHA1
9055ee82b930cc7555c7f131ba12b5a8f09e77b6

SHA256
36d5f75427aeda1ed3eac93a66a9f21febf6181f7bff227d2d4baacd975f6476

SHA512
65e27b54d0d23422540e518663470cc3abb7f0da72f6fcc380b907f545c33ac6920e6d65eab29c14937a5132b0e55cfc01f9a25dc15d989bdb8491186b12594a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\d2bfb23a-9adb-48af-bdc9-3564c8869947

Filesize
11KB

MD5
9a0adcaac3bca29c06a61a4cf575f439

SHA1
9df82dfc8f6b5ff8c9bd4af3602fbfc26dc6d217

SHA256
8f1599b2cea327955a981383ab284aafe30b70f55892e44d81a201c135a5db10

SHA512
85cf30f25a7c12cdf92e7d5da38e76acf1ac297b39a02b50aa320af5a39aa6ee1f4d497dae7d9b851d4426352c79b872e61b163c5884b92788221a5e5c6c21a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
7a9fe7b45306ec05903b85eaf94412ba

SHA1
3721df6369f1d8de621db1606bafa377d837645d

SHA256
e4d6b3d9f0ca6d94db5f8b6738fde80ef0a722434f0370da267106d64ab70ac9

SHA512
09a96c684aa87ed5864d53737b04ea3b2257358451d81abfbcb3d8eda3a6247e22624bab9e1ab80a4c3477133ad1a7571015619939e2d45d1e8ea09e0f07bb21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
3ae19b0d2292013c59c2986259015c45

SHA1
7b651ce75f84f989263b4933ec470df1ff123a44

SHA256
1859f181c0e4d5a81045edd30d0fdc897d796efaa5a9e840e1da80d2a44b0474

SHA512
07f85404fd7fd04f8e74302d7fb7f1fc8b506d07d9606d07cd568dcf703d2bc5b797e25231cd339654d2cd7be5f02abca7800f416234e5cf9fdd1f51875da77e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
48812ece1165a24ed34799369fd89c2b

SHA1
f4ff69f187278c7bf3568fbe3f12013a6af81fe6

SHA256
0a8be4354b1638712b8464ad119c9bf6e316f606c3849b3c38de0075aca6d33c

SHA512
a0c6b7e99b3c7a7a8d28cce9631eb98c34790d65b91c60cc391764597505ebf7d6a66d9405d108ea40ec359814f7118fb5f7adeb0bd3d9b39c8f6a4fcb8d3eb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
57d773f54ba6ebab826a4205f010b657

SHA1
568ea1b1816a44ed50f2782f85007637430cd08f

SHA256
cfc007e1e47334a1e18841fb27274f29a3662c45a523b19f702f3cc700db6c97

SHA512
24bbab33b235da6d89d5b0992ebb79d1ec7f0da2e7e6df1aeba52e5eeaeee8b1d7e4b77a4d38cf81962937b489f1dc3fe64d691174886637549e6d7ccf09923a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
139811d94cc2794d617835b8c38c45e5

SHA1
4984d225bcd510eb333a53328206b49beda73faa

SHA256
18d85b9ad878af839f5d42a89bb2ef336f61bbc023f597ff38fd5036d6943af8

SHA512
b0b0842bf0eed0d55350bc002c4d2ddd20a8d578f52305c464a973fa95412ebcfd0e780955660a5686442b543022493953372eadf6dddb4f1dd497103c4ded9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9cf54739d3fd552d37b831cafdc891ae

SHA1
51f0ade9a692672e387e37819acbac7afefad5f8

SHA256
ccccd38222273c27fc2329a6c7ddb42e758c560781e0d889d080d81e10c0584a

SHA512
e26db3b9e1c503f601f88d6dc2e25544cda91838a403b0bbde7f3206993b098a43d944c11ee3caca0ebfca0e7a306c32b73724ffb9d10acf76382a5b099ba768

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
99831a57130f0ba50047233702752838

SHA1
ba3c5d7a2a5748fad34b6a07a33510d9ae663689

SHA256
f6250f010359e415a269e9636f276010472a8d2276f0c5ffec9a11cab1859884

SHA512
cd959fb30a4cb390130d983f9db8fae7a619712f698cefa97ba41d8214e87bba6fd2a3962ac22f75ac3637d16629becf8bbad6b6c2a17748f98f7306045b551c

Download Submit
\??\pipe\LOCAL\crashpad_5220_OXSJEYPNGDYEPECB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit