0703be4e8607c870177b8b922ec13b755258bf0d1e8c3e4fd4248b97dc0cfc3b

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf9793cd3e817b4d923428a2e1a9e7bb.html
Size 76KB
Sample240311-ctys4aab22
SHA256 0703be4e8607c870177b8b922ec13b755258bf0d1e8c3e4fd4248b97dc0cfc3b
MD5 bf9793cd3e817b4d923428a2e1a9e7bb
SHA1 f14b77d1ebd3291353410df2b1c94f4da7ca602c
SHA512 9c1f0ed12275f04fa3fb386f74ca478150d0f5ddce8284c0839c20fe89cb02b9b09101738e1ffeb0581cdba524a677621f7b6993d6528ae35b3d3cd46b51c320
SSDEEP 1536:EXwgr8VSeO3LBZ9qKWF4TUnmiaS6cgRrYg9Tz:ueO3LBZ9YFaUnm3+g9Tz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
5904	identity_helper.exe
5904	identity_helper.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3272	3936	msedge.exe	88
PID 3936 wrote to memory of 3272	3936	msedge.exe	88
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 4280	3936	msedge.exe	89
PID 3936 wrote to memory of 888	3936	msedge.exe	90
PID 3936 wrote to memory of 888	3936	msedge.exe	90
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91
PID 3936 wrote to memory of 3548	3936	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf9793cd3e817b4d923428a2e1a9e7bb.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacec146f8,0x7ffacec14708,0x7ffacec14718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12629115558529619419,12493283990859267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 71KB
SHA256 726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b
MD5 da52e38c98b0f2047abeb07609608ab5
SHA1 da1210caff36df73e49a0c271ff7d573c2d20d02
SHA512 35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b
SSDEEP 1536:ntQRw6S6yzj9mN0hBcdYzdFONVzN7pPMJhJLY3T+2z9ANKokoV:ntQRw9BX9i0hBqSFuFp05LY3K25ANKo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 61KB
SHA256 ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6
MD5 468446a7240461af44b59ebb2047c231
SHA1 47b7c525dc91bece99df0c414960b9490b986ba8
SHA512 ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8
SSDEEP 1536:8b3HAMT093crXTgJRNAZYBmuhSeIUQUYaoxMaagTEwL:G+WXTy8u0eiaoWJggwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 30KB
SHA256 9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460
MD5 e99f1712e9ab2361d5bdeb29f499183c
SHA1 aa1ad85ed4ca152a807101ebfbf7636c49495236
SHA512 686620842f086366ae8132128c7fd2e7037d2a319d975d5f633ba0160143567d10880e11027df2da4dbecb150991680c14a2773ba810c1560d69742344fa0e8b
SSDEEP 768:y+7qfTpOQV4431krgjan94Zxg25+HHhH1/aeV8/D2TicNxBdhEx:dufTAEPkrgWnZTH3yea/DmxLhEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 25KB
SHA256 01318a80813fcbf44ef73a52bdd7c85b69bef8edda8d63a247bf6db8e2068a06
MD5 651759109c0101a3622ce3e8d4c98be5
SHA1 aa1838164412bbad08112a0895754c54ffd132d7
SHA512 6313df038c265f147a5954d2ed69ea61431795e005cbf25dda05128adbe668a194c73322727c65201ccfda5ba2252fe9f6cee88b96485b85940b83254d0220e4
SSDEEP 384:bswsBP+mBM1T5uGulJytKkD3USkm9zob5jRHm9DaE5Wwiy8/Ms9XO8HW9XicT5yD:wml9ulJydnHoBRGIEh8/D2RicNxBdbE5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 21KB
SHA256 1af1748db5992e49dca425c2a4978e33860ac81a80ca24e08fd9a6556598f8e4
MD5 d665d41e652d713020dccf0a25a7171a
SHA1 d3a4ac6b1f17825c105958e3590cad5e4e7e3a2c
SHA512 5102ad0f2eecfbcba57acf1d51adfc08746785fc68580aefce8e04005faeafecdee4c1460ef7f62d775f8c9fe06afc41c60b768c41b5f7b0315acd45d5995d1c
SSDEEP 384:u/ZGgqrRLbw1a6v2opcs60pLUOZ8v9yS+3mKIIq4sg86ltOWXscEiVxj2tLq:uRhqlLU9v2opcs60pUVxl4fOzmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 44KB
SHA256 bf521348d31946bb4e6d31c338e6efa0961ee907f4f871b1e9781a849dafa792
MD5 15d236690ae6ed6285bc3260340703be
SHA1 3b8475145f5f25c9b6b93a260b30ada4a4279b76
SHA512 2eca25be9587131ba4e4e4fed86283dbab3f959299d79db056619da072788c6480e5244095de5c84a58c40bf1f5b7bc808ec94c84fd7dca99464eba4f511bbd7
SSDEEP 768:xC9NnzL8oQJVN8+FrfHA+g7K4wb60v0MJRUTyoEQsdxinImzvzqaM+gezT3mha8:xsnzbwVNFFTA+gu4y90MJJoE8nV7qaMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 46KB
SHA256 a0c046dd99d7652764d57c6581829f856083963186bc58bc1d66a3c2c2d54e7f
MD5 9427024b62d2a02921276835038a14d4
SHA1 9853abf56fa3bc064fccf723a52b1bd150df6db7
SHA512 4414c0225dd59edca17475abf25082b324b869df9d1d8132b8a563a875efd8d71d5bda251dc0031e3e58e0a1a6da94970db4839359d5f4204ad658c51281a065
SSDEEP 768:MTmOam6kDyKTRu6/SJAkkU3jJI4eNxlIcTmOam6kDyKTRu6/SJAkkU3jJI4eNxtw:MSVcDZKhkRrSVcDZKhkRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b60397feecc0d11445c6d66661b2186eb2a73a4e362842a432a92a4dcd0605ad
MD5 0b86c6d58ddab1db0a1bb8d36f501b17
SHA1 ce430cf8489f772923f88f55c0f216df66466579
SHA512 c1f54e25e75d63dce3535fc58591ed5793dbc491a293e29dfc645fa3db6ac0a8920974dc6928320fc71b85acbdceb2f0e47a0d195395cf0c80f70dc25371a101
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 641693b18956a8a501b35f35df4fd74351ea7494823e1beaab3c6840da1cd12c
MD5 f082a0ac3b2dd8566b62706fb0e98c59
SHA1 5847bb48d30ba902dcb08d90187253ba38d208ed
SHA512 90f72982692c558b6b3ce81a338d969e0de06f384339643b183bc9c847a20d60ec1de507ab26819dc79f4621396d789d7137846a0dda4b06527f6e6125342120
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 24243d5bfae2e294edd6a7caf300ae28afba75e5ecff4cc33c059f16bf5ae2d1
MD5 a21b546ffd5cdc9bd1e49845a893566a
SHA1 7c27dc6f81383c776920252f4e60a2e61992ab4f
SHA512 c98e76921b17d0c811771a8e49180a7a123abf5ddb981a0f0bffd7c002c3c6a1810cbd381796d75ac0565b13604bfd8bb54fe6daa4dbb50f77ae1146d0ff518f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c370dbb245c9376abdc72310b4bc3c336ec400f6009233622ce138762ccbff84
MD5 028c970aa224a04826a182e64f1c31a2
SHA1 cbf97fdc0c1ad2cc509b4807a40167dcf3c62877
SHA512 5816f1137df518deb31230a74399acbe2fcf1d49d7aa0b6355f61b478f77d27e12271960f0fc04c224683f9b0e79b47e281b4bfd1e0d1ad33c137b46bebb4679
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 43128aedf39d0983a7c55b437f8f05d7f353ad02a3c0c0a5095b6282962c4174
MD5 5dfc3099ba9219dda89ba3c80610cfab
SHA1 780506935b83141210c985c24be4294a65c612f6
SHA512 8a266e1b40ff1b27a8c00088c4e43a59cee1bba5d2c9d2f677764657ba7cd18eb59bb9a28c896888537a7fd9bfcfef4725d69e03cf28ec62eb520bce6a3f0ea4
SSDEEP 96:nSkGS31CIwpvWMoiVmdeBTEOfDMcmsCUWQyV+VD7AiEwb:nSkJ3UIGWMRTEOfDMNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e4e401e867aff183b4c5ddb86b7991558c5c2f54eac531bd1bfdb99aa656cc85
MD5 3c421b5b1bea988a6d6de054083a7443
SHA1 7d7e097020deb7b9fe98cdf642283d7800f7efa9
SHA512 fa0b63504c2d578055b9ee69ae0ca0c8af8511aa26f10b99ca5f7da76238091b775585b60a10432479a6419142d26241a56e566c79b949a835aa8821204e7168
SSDEEP 96:nSkGS31CjwpvWMoiVmdeBTBAQqt9cmsCUWQyV+VD7AiEwb:nSkJ3UjGWMRTBAQqt9Nrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 433d97006f2c6c46c69d998565ae1d95e5d96104f4a427066f8060994cde1e6f
MD5 496c2586eee76b3b284021566d344386
SHA1 97782df86b7b9e6ec0b10858ca8c871c161a6887
SHA512 2a919be75d068427979bfcebd8fc9a2b9cc1902d071a36974f926aa45b8ee34c9398cda6a94765dbbba011732ed69605051044a2370ca0f6ccc4d428843a9427
SSDEEP 96:nSkvS31C+wpvWMoiVmdeHcmCUWQyV+VD7ziEwb:nSkK3g+GWMXCrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bdf33139f9c7b19be14aa382d517d5d2c9095a869cbbf3972e8f236ae87831f8
MD5 6fe5664b828a1338a6493133db65820d
SHA1 c094b1aef3a856599fa1b892e26100ea5cad2214
SHA512 56be8d18a07016b986eaefde9bc05d268931c040325393f549add2a0df4b54f26326869932346f46a2af1ca4e69f032831f536290f45d4880c31a1e3bf4dbfdc
SSDEEP 96:nSkGS31COwpvWMoiVmdeBTATjLH2cmCUWQyV+VD7AiEwb:nSkJ3gOGWMRTATjLH2Crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a77a65a30daf96e82f87558f04f01d5c1cdb4df9778d8c7d58834782fd7aee48
MD5 5311eb45bbf562bd7586accc14d73120
SHA1 e84f7e9d3912beb02bf2e7f9e7f437572fc4cccc
SHA512 2b3e6b6302a6521dad6f10952421552e8445d8e51746c03268a808d3cee025bf22c58df0828d055877e4becfd88ea38094fa89721ebd00ca354ec6c9b203b993
SSDEEP 96:nSknS31CtwpvWMoiVmdeBT1dvpkd6bcmsCUWQyV+VD7AiEwb:nSkS3UtGWMRT1dvpkd6bNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bbe00cba5d0a340db4687cc1ecf07f439b523342a4b472119686f03b5817d01e
MD5 af3d9edf828de2d1e23af91a1d682071
SHA1 5c218786c0ee19e9ce31ef71a90774983fbdc90b
SHA512 a2d48d98b8a4ce29f805f5514c1e989e51669d3740ac0c6a4e8a12c775d0c9a7d3814a66a8068aa23a870747b11b5b10c1d9cea5f1bfa408bb872e25f68236bc
SSDEEP 96:nSkGS31COwpvWMoiVmdeBTATjLH2cmCUWQyV+VD7AiEwb:nSkJ3gOGWMRTATjLH2Crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 285eca0cbef5eae2bf0d9a102d7af648cc807f400a245feb595fd41bd3dbf7c0
MD5 5f90e622983bbedce35b7625746c8064
SHA1 c671a7edb266cd784fdcd0256e3491f68fcdea01
SHA512 249d1858257e4fdea0c6e211533c66890a2b7228e236ad84bb980d8467eb074f6881c032371ab604ab93bdbeadd9c83d9624f0ef57ac3c0a9e08435c9260e0e0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 9b6c8c37bac20e069bd7d47c08cc8299d5fbe834b323e49c6cb44bde4a87abef
MD5 202ec3f4282422e1ea6f426ce50f790d
SHA1 b506a17bc389e7fe971643d68d8e890c779055b8
SHA512 66c8a971e6dec9aa2a6ea9f1bf14af56dea554e7cc3ea2717de5b78c9d28de1112ef13006bb865d6d83c3e9700367c6f196805b3f47122e25703ca8ed45bed68
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 e1c2ddaa17a8f521623932e0e135264be6b46b613799d9d2995254972f704c4d
MD5 980da8dbfefc54090ff27c736fc11d43
SHA1 19c2bb560e6ebc47d3344c455bd6ebcaefd84d20
SHA512 01623c8c2889af0d7801aefa6dd09c5728a630e9f0bd5e70d0e8f7a68969f160b62528b12a91dfa9ffc3eeff9f52d979a70c474c466003a2ded5a16bd7be0c2b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582edb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582edb.TMP
Size 203B
SHA256 b26b543bc48f47b66ed80b311dec27471a66ab8d1ab6ec27a7d8b990c6f6e0c8
MD5 c1e2a5f9dcbd9153e09212e8917ffaba
SHA1 b079c65af393823a91562feab147ee732bc3f720
SHA512 74f9faba41daae2c8b9818a364089ae7ff00c4f9112ea9a40be5998ab95c877723893e2d8903b40038ae278afbdabbca4a76d91d32c5dcbd372d70d6b8d46aad
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cfd6f5df15bcaa35df8daa31f96f129426388a02d5f7991e6b10ae509aaec2c0
MD5 2bd247acf66707a7ee662accecc6f175
SHA1 175875c0b863dc247c3c415082a5702728d60e1f
SHA512 4c6ec93cd28c38903909a110a6e4b8d996ea12f4da86545c28391a702f15b7ce2145d58ff3599bd2676324a346abd40445edf25a0f6da5d0d4b2375626acdb47
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4e2RUT+b9+9xUX1MPeuu0B:A9iIxuERzA83h09RZxY21+9E1MeuBOxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download