d0464020f6e05fb3c61155803c54dbe13180cfac6fb350bb73f290cc422eef5f

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adobe-premiere-pro-2024.html
Size

79KB
MD5

8626bda3ab2c5fd24e7c837f404ee0b6
SHA1

a9f60773e94cf221956a2a10d63321237088bd1f
SHA256

d0464020f6e05fb3c61155803c54dbe13180cfac6fb350bb73f290cc422eef5f
SHA512

219fd9c949bff6cb40f190e27cc925a86eb62365ddce51d79a11fd7e7fef47ba114759593ed49f27621ec9783bc3a6f620f931e1abe723fd7062e9eea66e6b00
SSDEEP

1536:RCwZjD8uwSykjFMm0SfEyOSkG0KSZtFapQOA/Oc1:RCwZjD8U2lSD0KSZPaDAmG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
1552	msedge.exe
1552	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3668	1552	msedge.exe	90
PID 1552 wrote to memory of 3668	1552	msedge.exe	90
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3224	1552	msedge.exe	91
PID 1552 wrote to memory of 3912	1552	msedge.exe	92
PID 1552 wrote to memory of 3912	1552	msedge.exe	92
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93
PID 1552 wrote to memory of 4476	1552	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\adobe-premiere-pro-2024.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd113746f8,0x7ffd11374708,0x7ffd11374718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,4910410218960454138,13603716224954977999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5984 /prefetch:2
  2⤵
  PID:5712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
43KB

MD5
897e2d76514d8aff3d45e523de95d15e

SHA1
c32b38489686b1edf33c79400209b5ab0874ae62

SHA256
0c3130804ea72c63f784a2b3498d5c325378774205eb972d4dbdb633c7e4da60

SHA512
0f35e6293dfba97390a5c4ad593ca2673c543ab293ff4c46e6eeb54347ea58b7de8678585c747c810125905972b0ac77808056472764920af09e5f277c86ddff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
15fd16892911b5134f4260871c250bf8

SHA1
e38038e5a6166c81a59446e36db05f58db47f7fe

SHA256
c0b8eb14635b7efc435e766ff0428a04ad488d7ce3820f67457a4352c0900fbc

SHA512
53f3d24fc2ce6e3bf12779a9fbb8775f2635561a8bf560855b99a81c473f8bda1b001f626313cfd1aa74236b4c6cd7f562ffda36b1a5661941c269ec616db676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
70c3e85f1f709e1c8c2b1695a451885f

SHA1
8eb3ca2e050e074f1846576fa6dab2fa7749bedd

SHA256
8d67660930eea0836200ccd77ef0e593dc9b59935d0f1e32a6047ee009cf9bc8

SHA512
e5fd882798affc2024825ddb31d4e5e553b5c3bfcf87de41a586cc1495d2b6c3be12dcd2fa7564b8d3d92c231f3485391804ab1ca0e3f19dae312b837c69071f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
539B

MD5
8833ed651988e7c04ba1d8e2a9978075

SHA1
c72047294572797c3b248a4e615758ee8ea29cbb

SHA256
a6c02a02ec481371f26822d1fa624c082e5e39490dd06a32d32d8bde33bceaaf

SHA512
611933d896758740fa9bb04e11daae4b37e66ee400378d602e200c0e12b92f780b4a1d2f0559f0dfe44f2f87e3eae71386a116897febb931d569d9e50c0e826d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f428734919640749786f7e418181d8b8

SHA1
364902950f698dd539c801741dd90b6ef6172a63

SHA256
4aed426d9fa732ff3f59ab1452a6e1f353c2d7d16a32b6ffe706bd36cafe3a92

SHA512
bb8f3d01ed45834c6a741d5225a2464c317d13dc40014aaa63935f9a120f9bcb91512e026b5f52c07abb75137ccb48ae2f4b431417c4ea58654c88db3bd4b6a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc4833d67087aeb050ae98f177af93fb

SHA1
f673a1a4c3204f6ff02b73efc30a1705060109c8

SHA256
8a5b9ff12d2d404408a1bc960bfa630554ca74b86422504159f66d5206b6af2f

SHA512
3d2115f39a9609117493695574718d5d6c6c9f4c32ebcd537e0f6cb856f6ea9198e091e1ce551eac18f5ffe03418558ca353fb68096f4e1b35e56aab8327b99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1d9c065477b653be451956793776da8

SHA1
40c107097c8acef71e3446fbd9e344337003b33c

SHA256
3bc2044bc6f8c79a1700d7ea6801daa0b9e5619d1736e26ca442f158c3dada1e

SHA512
1ceef29775d22a4ce735604a4a07c80eaa052f0e3a5eae2f9028bf5aa28fb2095b3e6b1945e1c1c9d4fe478ec32606ec18025c5adff74a05cbec393d694ad80b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f9e5390a4981089f8689a2b7225249e

SHA1
7c267ba7e82695631128cb05ddf6c5a2bacf8b12

SHA256
c3491d52db3842e46d971f5dc46be90af3107f40e86b5571ca56747a5aa51c1b

SHA512
86569a55f7c657291cb6ad9bb00478dee0b5deccd88ea39adb98e112b7f3e23430a433cb3413a34029d843ebacd61659df75269c60cdca0b93b0baa8cab67a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa8101d2849a31c01bbc21e8102c6703

SHA1
52009f7bda12d9c7675dbf9663f53a4411fb329e

SHA256
daf37426ff31206e529633c67d8d349d5b7d70ceb569cef5f3524c7a8481eed3

SHA512
535c85cef02d26a301a6bc9ff4359ab13b0b3c59ebc70aa63185aabba34ae325c270c9104e90a13cb559b75a6045d113bd6f2af3b511b2de02d0da284aefbff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccef66bebb55f63714cb746daf8afd3f

SHA1
38743efd5b339db86aa99a31ef1b70006c2374b4

SHA256
48a3337c03fc13eb669e885132e8c320519216023af3d3f275fc347706c28d2b

SHA512
0459c38ccb41b02bd70d8f1532309558750ed6c44c046b2a262fb2891fe0ae30898e14d5af53de0d226437bb831f17701d4d788c20f47e9b0da3b922cfaa3907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a89bf599195b2f170c7922bdfeb4eb0c

SHA1
72d02bd43c1caf2bc42a3c3e1a00d32db4ec5952

SHA256
ac50bcb2de3ca5d3fa6ecaf5f301bad3fed5a5b078bdfa45f7d586327b9f75bd

SHA512
7832bb4e9d15885da0c12eacf87ebe042efc4cb479ad7ab7660231531041dcf8bb9fc98bc00cc188311479da176aa0c77698a272ff4cac92a27b95960a3cd03c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
01ef5aafe5fd9f46dfead9db0a2c8014

SHA1
980d58e058560fd45dafaaed4e1f9c4f1df4940a

SHA256
45b5c9313fe482e0f6a4fdceb6b58319f4a6073badfa0e2732a0b053ccd5a71b

SHA512
bb16f05a42724d2b01b95764ebb19cc16eec3528db7a133babbdbbdb25adc99d5f3140b5f0ff058dbec0134a4894c5ac7e20d419ad71617f268b49b788657cf5

Download Submit