d15fb21fe52ca873db129f84318a5c1469a13ef26b7c5b14074a7f175ff14461

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

16KB
MD5

14a4b52bfd962927d828b4a58caa52e1
SHA1

89fd665f2c6ba949439d0795cf3aa99afee79432
SHA256

d15fb21fe52ca873db129f84318a5c1469a13ef26b7c5b14074a7f175ff14461
SHA512

6a7cfc318ede0ade36ae2be04026f0e931c040216f0555bae2dcf424da74c0e3896e18d86da89c6f61082817153fcc04f77ae533d5fa67383b65a559d0d1e904
SSDEEP

192:PNx5Ssv99qXoqTJkNr423eE0J0qsvM1Nvx95VRyZTfnIhwU61zK414lYyq03N:5Ssl9qYoJkN0PvvxbGlewU6JK/fN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3956	msedge.exe
3956	msedge.exe
2240	identity_helper.exe
2240	identity_helper.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 3460	3956	msedge.exe	86
PID 3956 wrote to memory of 3460	3956	msedge.exe	86
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 1124	3956	msedge.exe	88
PID 3956 wrote to memory of 3176	3956	msedge.exe	89
PID 3956 wrote to memory of 3176	3956	msedge.exe	89
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90
PID 3956 wrote to memory of 4252	3956	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff978a846f8,0x7ff978a84708,0x7ff978a84718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3462095240919240565,5544340909369954751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x514
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0ef7d372e8114f2a18af77caa54b7ed1

SHA1
4097984df1ce17a69be524e4aa16708c2ac38a14

SHA256
018499cd6a194fb517b14df8f2fc5b079cbde60320bed8e04e85645a98ff2f82

SHA512
a1bea2e1e760440be8970c3acd2703d4dad00dbb600c7c475e54f023a89cf9455a8540cd7371942e72b04f988b360446155acf325fea86a908fe454e0d8fce1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b969922d9a3d27d5c10b0ac1f7827f85

SHA1
397db5dd34a1d6fa7d636ea5ff1ffcecf58b3878

SHA256
c73d83fa3a2eecfc5b8f60974ff8b1f1079296cad009d50df8bf6e2436ac4ab7

SHA512
5f6e58e72d10504f8aa6734f15637834f9e9b2b7ac55c7ec7bc46014e776c08e708d9b9a4d2a31ebb4f818e79540c050819580a6443f3bdb787503f93888efd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbfb323092980040e44a097cd55d306d

SHA1
10b23ae59db40be767d420fe907f0a45f064eea9

SHA256
e6cc4c002e7f6ea298ddd502422df051fdcfba895868da0749b9f26ef07bf033

SHA512
be7bdd8124c0aa2a37207ba03b4e0ad11b7bb4c5818b8808fb7fe3778fea063a22e1d029a346d0d1459fff29600fe1240d6b5a7b687b00909f02107a80a8759f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef14e21563b5538531a5a9d6d27cecfa

SHA1
88eba6ae9abb5d9afc9c0b958f948dcff84eaf40

SHA256
1352533d98f2f42a244769646625d61e0d47b015d16f66d2224110ac42d664fb

SHA512
58b15ee37bc95cb43b3594fffe36b4f47f294b109f2040ece96d33ea7ded4bc0b512f5af13cc4474ad88f59e4582589d28c27fb13b21510db5216a3f935a6c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
9cff91dfa891fb213689e3582b1cfecc

SHA1
ac0b63a0cb52dbe630c225382c4e41a42b7d49ff

SHA256
4068096b478a498c74053544e7a922b8123b9917cf6994f0a19809b88f8efb4c

SHA512
2998c13b457e57b11515fb10d9a76fb1ae5c0b08825717f04f777ccf9dc1edddc7e7c70d7ffaad496dabee35b5136273664569f96732b6bc4fb0e8547b240227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
78594326b7fcf2aea8df40125ce31df1

SHA1
52378e10df25e0c5e8b3770a35cf8dac13c95e14

SHA256
f836a139d4260051c964391e7bc2f488b1aff1c523acbaacd40ef0e1eb204dee

SHA512
f18ebdb80fc40e2f1ecdf0947e1bce158bdd59a345db8bc744b3390ca24b964d91e7c03facb95a3df9adb02ffc023e821d46739642e27116508ccabde7312d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
3781c6d21c644687491599189ba2d09c

SHA1
7c96efc9c8465d5e78edba603ffc4e10af682eac

SHA256
07272ac0aed02d97abd03654b0f0499b843814de3446e3022d8d57eac3c212f8

SHA512
5cdb4187b84c06026772aab0e7073f30091119cb607738d443efe843f767e922b1564292184de63ae09eb35ebdb8df2340a62fd635e5e35ff6de2c67a562fa27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585ca2.TMP

Filesize
5KB

MD5
f4a592325a257064e2be096eb3ae995a

SHA1
97e49dd63be7c28719db92db55f4c169203c1ae8

SHA256
81fca552ab4d702d73cb1f22a805de3e63ea7065d7abad7cf9a2f42851200826

SHA512
8d02e6a02fc43d1a64fb29dae123d410b66dbadae1efba29b9f26edb9ec9ace8b7ff580df1f6bcc5276883336c4558a743493a3762042ef297ade16178641c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9fc370d-a329-4803-8019-23efc407b288.tmp

Filesize
6KB

MD5
b82cf587cdbec321adea0ee19f3c5cd4

SHA1
4fb3e58ce42db5f5b753e6420578dbd703f3a14e

SHA256
bf7f568dda89ea8c037facc7113772b8cee3d2e6445b5613fd2dc89d27a10da9

SHA512
e10d23851fe26601b09e1f22dd91fd9fabe652cbc8c5b57e08a0d4406ab7813bfa0b5e0caffa924e1270fba4559303a96d3de06e36fc605954601d63d1e54826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
624d42555ba064b0353eaa4f18dad72f

SHA1
12aba9055fb58b8087a15b6c291906174c0d3b59

SHA256
a2469add498501c40ed00445ed184d0b16759682747bdea3b7eb1d382049fcc9

SHA512
f63a403cd3fbedc8eddd104cfe1cd82b4ba349300e87d99f0b6f4caedbe67d3387db71f0d522cdc9b80b34cad7ee5b59494881cdd3930a36feab43760011d1a3

Download Submit