d061b8a2243961af30ace9badffe4035c812741f0a05b4e099fa10e2beffc29c

Analysis

max time kernel
1742s
max time network
1750s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91gdDQwGKUL._AC_UF894,1000_QL80_.jpg
Size

116KB
MD5

c6c5a4f28db3aa2b4102410edeb31657
SHA1

44d6e049c546b066c38bd098f133c1cb7f39cac9
SHA256

d061b8a2243961af30ace9badffe4035c812741f0a05b4e099fa10e2beffc29c
SHA512

675073de7d67f9e9445ad2d6198c71a08d0ad129c3fd50e2fa7bc2c31255c98df02dd43a02d479b84bf66e8eeee6152759809adff8740b0d1113b39a1aaf64c4
SSDEEP

3072:jClKVuf0tkpiHOz/Y2xEQtx3UzmnAhCmeLfy:0K4skpiH4gBQ/EoA0TL6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-513485977-2495024337-1260977654-1000\{221A2D80-51B7-45E6-922D-8A4EC6FBF3BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe
4316	msedge.exe
4316	msedge.exe
840	identity_helper.exe
840	identity_helper.exe
2272	msedge.exe
2272	msedge.exe
4044	msedge.exe
4044	msedge.exe
5100	msedge.exe
5100	msedge.exe
4120	msedge.exe
4120	msedge.exe
4988	msedge.exe
4988	msedge.exe
4688	msedge.exe
4688	msedge.exe
3276	msedge.exe
3276	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 220	4316	msedge.exe	110
PID 4316 wrote to memory of 220	4316	msedge.exe	110
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 2724	4316	msedge.exe	111
PID 4316 wrote to memory of 3520	4316	msedge.exe	112
PID 4316 wrote to memory of 3520	4316	msedge.exe	112
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113
PID 4316 wrote to memory of 2428	4316	msedge.exe	113

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\91gdDQwGKUL._AC_UF894,1000_QL80_.jpg
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc91c46f8,0x7ffcc91c4708,0x7ffcc91c4718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c6a845a100075c569af2f43170316247

SHA1
31c2ddce01529422debf676afa936ae20bb4d4d8

SHA256
e0a23c6fcc7bd0bf618f52965311b276c2ac3737ad1473808227ff3184c54105

SHA512
6743f1c3daffa68889041b7083914ba03c11c66c9e81dde413691c189e371447b7e96eb1fb22b3496e37e5a852e6d730c7ea90264b7db01d0346e04eb8651c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8b66096915304a0fe8c7263fa70e7918

SHA1
3770bca58e35433eee7f8f1646aa523287ad2284

SHA256
4472b5009ac3fd7a9257b8bd47c0a2d31daa46cc6debe6a9b70b7f33f9c6e681

SHA512
78b7f415ee8d65af603b9b19eabce56db384d36bf04053a5d162e172b17aa8cbabd02f95423b379d8e52fd7eb836bcb1ff03cf602a87bb2607147bf7cf711f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3c348f29a54f887b8c37c2b466b20b3f

SHA1
64e7263d28674be91a93bf013298395fa5163c6e

SHA256
ca4298d671551103954bd357b7194371bc2bbffa85ec6ce64a7adb0b5dbddd2e

SHA512
1f6b4ae41d31ddf52ce182844180fda051f79e22dd22e8c7f1246d7e781cbd95b560ba786b775c2a8369a82435dff336d7d2c2957438903af2f6361637c8c972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7f12d3d503498f5fadc84ee4f33e7827

SHA1
a1043c33f2a027b1679c468b8807b57d45a7b99f

SHA256
a4b99c03fb9fe75b862cfc76184fc516955560521571a526ec971a5c1e88fa70

SHA512
85a58160b1f29e493fe58ae6c7004420f358bebbebd526c5d0a83dd05d8c61ec0cb29f1057555bfd94377d947bd0aed7be070dc34f4014faa7111d3d6fcfe9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9637e3379a6953d99cf5bb3951b317e

SHA1
20beaa5552f1c7cc28b3d5da7827207f989e58af

SHA256
04881896f82a8df91db5913dcf7ddd40409674fc2bb25cd4989bac09ac6509b6

SHA512
18678c4e35d7673a518a080207d5aa2aa9f114b701d167296093db20b814c9b5a634371f9c7f0041431849592848193013e1101d5ab911911f8cf45df9280e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec0834589a6c80716bd255a497453381

SHA1
02d7b045644e79892e7cf6736eff8eca0f37a46d

SHA256
4b3b6762743a97f666929caccfd142ff300a414bb111539f9ce3e6a715ad4dc4

SHA512
d6e7a780dac5efe22c6c5c39882b9cd0dd15f6cd3fe5789151cd117ceefdc2e44f0ed26568f80aae13a01ea59e41f0dd7c52fbd6d1bfeee13a0abe33f1a98b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d490f6c7829be1b8be00755e8b15760

SHA1
f0f0a9b416306ff3881ce1da6e0a61a1030da77a

SHA256
c40bbb949f04a6aa766871be2df4e441edc1749d68cafddc9b986a3e9b0f53af

SHA512
d174639a2ae7d199586eaa49df64d55fbc6f66ee3b3e2b66bc3b9e2add9448b8aae9fd92bd3dd48435488c715a5b0dcfb8760d824aec5f16d015b0654b72c4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fae6642ed3708ae9bdc3d79ef7f824fe

SHA1
480fa1bb0df81e0e164ec1d534164bd654e9d079

SHA256
2563ba8d869fb0699a4a2dc974c129715c2dcaa5407dc76d9f97d6cae16f570b

SHA512
bda6c55d093f7d62eb3ff022233c3b3719e04fe7b0bdaa5bf29b19b926aa1f1a5b3eee2c0d4af15dbc35d2a53fe6e6844431b5c19b317df1442885063d286b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d38d69a41b6fbf5dbfe7e306e93e8c7

SHA1
1c9bbb64dd3d03893f867fb671730b0a11f95473

SHA256
ce5f21bedf5491ebf57e74dc4d81da1517c1d42b90f9c8756642dad19046319f

SHA512
c463c9239e395caa8d513cb76b5766cc3f6344b4620110ed6579707b8fb581c6be32f18a5d12a8fa97fd13fe30f58723042baf6278c4eb540b8249780667585b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
cd5bdc5510ae34810db627ec197e6c5f

SHA1
47f5ba3d8081202ec15a99adab1ea0bf60ecb607

SHA256
16095278fa352b0b4e16a8cf0072b97296a25ae5160ac24e453c775b46f5b4f7

SHA512
2e1268e0664207e94c352da8d97ce294ce9623cbae3d0a3ac92fb03577a0f290b61c90c00707e47d389c3633ec99cac9c75a27f2451e301f726b8b5a11a2b46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5afe08.TMP

Filesize
48B

MD5
c2a81bab484aafd5c931ce129b0b9818

SHA1
069dcd66de37944d037a126b94b5cd8f29ced932

SHA256
3f73b9090a96f3fa31f218a4bb69db4338ae67fad860f7c61ae6c84f1c396f66

SHA512
f260f91f6261dd72e4b7b083407134c37d20df049556aa5bacaf512036854f3300aa14b82a634357249cf16278b8b9f17b0f44fab93a9290966e442764b393ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
3d24d3542d3c0cb6d5a3b3ef35a9cef0

SHA1
0c067697c522d4e8df9dce5c04e9e27f3c4ef11a

SHA256
7a0c0ad0e983a3057e3390e827e9a32074c5c071067c5a213684f884b1f3e366

SHA512
cc55a0a3fe2ec00c32ab668075b643882f44fd179ab088be6647f1d4a109bd67c3f31db1b7d9b9199719af9ef4e8565111ab334a4be5651eaba9da07047089e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fb59b7b5524101fcd886bf45c6dad35

SHA1
8858b690364782fff46578f66500988495be118d

SHA256
3308e027c0118130a593615c20d874d0a7032bc142f8f7d5b1b6e7a91ce2a0b5

SHA512
38d50bee566220a27261dc2cee4b1dc35f7af855be313fee8ce311056f1c1de34a69d4e0d354ddaa363e9fa15de98a97d9f6da201844b0be5d32e69c97d14b94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3c56c9e95a9636259ade7bba0d0f59c

SHA1
f22ad2c005e49f7ef234d7105836ad02a38964f1

SHA256
dfd7329857e852145d14a880b5933b58ef34a677139f15a0127f19b302bb862b

SHA512
d7cf55e11649e92a739f2709f4ab2e98597d0b8b0d1ccd9987fe591327ed0b7467297923e21dd8dfcdd4f7d85aabe6fe59c1e9ff00e91cb685b13511b698899e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ad6ba.TMP

Filesize
538B

MD5
ab5da57045568b7c42e8b52b92c126d9

SHA1
c374a8136402af6cbdc8de64b87af9fda44f010f

SHA256
f577c910e97fda41a0bfbcdce73997aca24fa1395458e43cb5e1aa31855f4576

SHA512
7b7494a71a13324c11cf80b17c0c4fc5c95f15ee3c8c7ed2923cfe70f01b43e23f91450254abc84e6aa46aa48b1daebc050017ba1f43b7715f75e5518e1bd5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfc7ecc2457af8df7522600403010c79

SHA1
a145dd3f87355768fd587ab3c1bcb5ea9a255aea

SHA256
61dc53103933edb8f50fa608d911b8b2f8284cfc1676f70d52550235889f443a

SHA512
11e8f8bb33f1a843aa16105ea43cf972adf81db02e836fbfa6121ae11b109196406653728da52bef8929110fb3bfc09be80c03366724b291726ac6165c101022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
406c098f18cede9dacb1982ca66e094d

SHA1
ec7e6126c298452595123c6f837c4a156e1c53ee

SHA256
c148ac29be5b549a1b291abaacc3a70ca7a5e495288cdbf9002f9faaafea99d2

SHA512
d0b0804b3a48fcc9a40520d1b15fb378722beb6c7f49707942c6101c349abd08e9849fcbab3c9014e42821e68ec0a2a97d134e4a0ed7ff317fd70a407502a992

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7337b0b994c1336ad3114b3ac3be4912

SHA1
37546952474bbd61548adfc787c1edebb0c4338e

SHA256
0610fecf0b2a1bb590d4d076961a538f77acf4b4bcb48ce5931fe4c14e869791

SHA512
1678479ae740383c3b06b8f7872af244ca2cbfcfbdc719e21bd2f9e12926c257f9543666945aec61c40a7e5e64d3b4aedc01419721c6cd871818efb18fb398b9

Download Submit
C:\Users\Admin\Downloads\a (1).htm

Filesize
1KB

MD5
ca69bfb44da428214e77cfce13890bae

SHA1
87d66b1c2dc5a70c33c43a77e65607464ab2eaee

SHA256
e9ae9020f4ba234dfe7d2dfdadd6dd6b9b773eceb8e9ec097d65c6a97626ec5f

SHA512
be2dc55d60ba2bc0dc2d6e98727f4f78778e1a6d154e99f2478d3865610bbedc96bef654834bf957b216f51d0d1a1d57f60e6bf2f8272ee9024d53b42e6f3792

Download Submit