5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
Size 896KB
Sample240415-1fm2faha83
SHA256 5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e
MD5 e75bd457a2fb13fb20ebca1ed0794fa5
SHA1 804ffce3af6e77feac049cfd91e1fa527e23ae8d
SHA512 222770617d0c62c774a7fbd8b58352f30a6e7eb0dcfb5bd67fb5124168d9f66586210c9542f363762156ccef153d9932e0017fbaa16de3e13db601ce7894e408
SSDEEP 12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaRTc:HqDEvCTbMWu7rQYlBQcBiT6rprG8alc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
692	msedge.exe
692	msedge.exe
332	msedge.exe
332	msedge.exe
3956	msedge.exe
3956	msedge.exe
2632	identity_helper.exe
2632	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 692	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	89
PID 2064 wrote to memory of 692	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	89
PID 692 wrote to memory of 4920	692	msedge.exe	91
PID 692 wrote to memory of 4920	692	msedge.exe	91
PID 2064 wrote to memory of 2284	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	92
PID 2064 wrote to memory of 2284	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	92
PID 2284 wrote to memory of 3864	2284	msedge.exe	93
PID 2284 wrote to memory of 3864	2284	msedge.exe	93
PID 2064 wrote to memory of 2268	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	94
PID 2064 wrote to memory of 2268	2064	5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe	94
PID 2268 wrote to memory of 3800	2268	msedge.exe	95
PID 2268 wrote to memory of 3800	2268	msedge.exe	95
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2040	692	msedge.exe	96
PID 692 wrote to memory of 2484	692	msedge.exe	97
PID 692 wrote to memory of 2484	692	msedge.exe	97
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98
PID 692 wrote to memory of 4016	692	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe
"C:\Users\Admin\AppData\Local\Temp\5a592911a09ce19c6525322e68844383f1221ba3cd64ec061a7c51e042c0021e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1f9346f8,0x7ffb1f934708,0x7ffb1f934718
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4139572579994006460,11871141046097190235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1f9346f8,0x7ffb1f934708,0x7ffb1f934718
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1542681240405191674,11382346761563520007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1542681240405191674,11382346761563520007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffb1f9346f8,0x7ffb1f934708,0x7ffb1f934718
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17496648540989349477,3089267738781459468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041
MD5 bc2edd0741d97ae237e9f00bf3244144
SHA1 7c1e5d324f5c7137a3c4ec85146659f026c11782
SHA512 00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0
MD5 120a75f233314ba1fe34e9d6c09f30b9
SHA1 a9f92f2d3f111eaadd9bcf8fceb3c9553753539c
SHA512 3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 533c401d119dcfeea3c999180d7523b1190f998fad5a8e6624f5fbda44035733
MD5 68c5a4bed32762580f2d9868bb11e6ed
SHA1 54487fccef4d51ec18b00e4b93bca1ba754df446
SHA512 afa9fb0b349487a46c3b3106935466aec386e95a877bb1b9705fc381afd6256ba4838a65bcbce854733142932615043dff566b48123217008ba757ea889e0638
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 00ed7dec05420ec1d7cba9610b3208dde24480107e31beff1aa3b7310e2fdd54
MD5 cd200da3a244b800bc2cda6dc437fd66
SHA1 1c9aa2fd9d43d063a33ca6a7d464eb99e1cec017
SHA512 f5eccea865181309580741336fe7031351c5fb44630dc292925a95f9f7639a740cc6fe3f9c3c0ecb1071ac591f593d89a7419273d36496fdd4b87438b79e282b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 118359152ce4fa6128e582a4cda5a506a1e8a7650434f622091fbcadc7b0ca28
MD5 61265c9a3b734b47d03fcc7a3756531d
SHA1 7c6ffd21f3f8ca66d9ea77aec097c0701a9b4bba
SHA512 1b7a25248517a0205638c354d3f7a39054aff2ab71b14972eb1ee9ef56b60659157aa6d81545358600da08e4b59f7ee1d0e73a179828b1c87c01ed0792d5beae
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a6d0e41e9d2f13c6ba482e14f7d96375690a81617c7421bc8b61af5a100b937d
MD5 f8bd1c383a18585f4e1fbac9c0edd239
SHA1 582aaee9af0becb4b782912df74f00e045d4d4e5
SHA512 7875cbed59a89685331ce2f4a7565a00005df703dcb82393b8138d6e05aeaf5d5c5269fc98bce0bd194c8648b982ed5f07509d094ca155a1b33a1c02b62494f8
SSDEEP 192:n0kMGFJa8E1jQbWMOualu9LufexbvWAcu+rg:n0ZGFJahKWf+WGvWAcuP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b68b12a0c0392310431af7e38e60e9de78a29cfa01d54debb2c93e19a80a362c
MD5 9e1b1cbacb178c8ff28ee0e7882545ce
SHA1 28ec8b622e0e669f474bccc10c00da4eb82ae2bc
SHA512 3a691672b0447d7c0580844329409b7976f1852636c02d9e8c6b66b4ee449a2310265ddbceff08c14f40b654724e8839eb23060c26cb06fc94c2a343419cd1ee
SSDEEP 96:n0kMNE13Ja2wpvWMoiVmdeHwJFvWAc+UWQyV+VDCziEwb:n0kMeFJa2GWMXwvWAc+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 629940bfeeea29742b3db173f28a5f67b1bf69c7e3d8b6e1a47ba6a7f663cf77
MD5 4888badd7dd57bec710a152686298434
SHA1 2dbbbfbb1da19a685f39ae6f74eff51404b2e866
SHA512 e8535d80c055e594ef45db5740c6420fcc32b276d322bcbd56a771a83bb628d8c437c47bf76d097a72cfef03eb62c7f5b5525367d8d7a5e28f1a8a828bea1b0e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 b31e4f4e72f011e64375efd8388c7c64709bf10d2507d3854b272cb4113a2d74
MD5 112e49877875712de59dc9582ed14e6f
SHA1 5c646c7dfbb1c8a716e888389841c42e67bc4749
SHA512 5fcefbd3dc09bf5ff38b40f7b5e84f75210bf17f56f2936d1cf3876c44cb0fd9b5f7985e94e78c0981ede824dbc082479a671bf70610963eeea87e0c45f747a0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 9e3a25d1fb508fc31a28d1d229928f68776112a7fdce3d78028cd03dc585ea93
MD5 64eb42d8b6b28a4d81644927a6cf0796
SHA1 f0d66bf713028b2bddc1b07f57f0b7d0958487b6
SHA512 a3844e2b7221318185d86aff4db17c5abc4511d5488ae977d220b1ab6b75241e5ab9af697ed095706484d6f6c02270fea3ad0a00ca319822a7ac0bc21acfee24
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 49c8f0d3ddb843cad22cab586c9b9338b7bcf48ffa504634f42636eab6e54a05
MD5 8801edeaf80f9592b0e43a84c98c5b54
SHA1 f9582f7eb68ec9b491144a94f5d922fabd7359ab
SHA512 5972b959a8ccb17efb87cb91232a1c34affc03ef80100bf155fb90151ecac2c10bc7797d09c0d31f111ab806eff0443adc904edeffc0f5c2d48b834004dd5e4f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c92c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c92c.TMP
Size 707B
SHA256 372094e294bf64ba3e1ae016a68dccad3e7edf1580c30c11d27864b59dbd423b
MD5 5de443dd25ee0829aed9bc7f798db1f8
SHA1 9b59f776d0c278c2a488b20067c3c29d146c04d0
SHA512 16a54912489d5e08ba3972f190f16c456f998d442686bc161a2315d171abe75974abc7ed53beb1f1d89a59cc249d3c53d05cb1c3577a8d8f86497d34eb829d21
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5115f3d09edcca084e190e1ae583eb29d11687d37c76ad086bd8cd3a587185e9
MD5 cb0cd93a7e90a5cb0d85aa842bc30cf1
SHA1 0dffeadae62f7546c461cd6ae8b581c588b1423a
SHA512 01e79922f04494855248b411acf1d381b4a3c22443bb58e503db4230574dabe088bb4b2cce7b1604975a5165bfd2952d872c04916f9e4017820296ccb002f297
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupp6Pe2RUYNJ2soiXs4YwKsd:A9iIxuERzA83h09RZxYMnyso4NYwpgAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35f8714e0bd1a8b476f78eaf4abe76570cf5ad1ca4f53ed0030c363f9ab7674c
MD5 576497fd6e773709e042e5ecaa7c8820
SHA1 1153156f953489cda84e6109b8ff7544469617c5
SHA512 caf3d597a99c8fc8c457bde06fe4abd40c7a5238cb45257ed021851d68cd0100a70530587b5e752229cfa941ac81531bdb1804ff7258b49b7f3ecb126204f208
SSDEEP 192:FoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfe2RUHNb32W2jJ:J9iIxuERzA83h09RZxYn2NaW2jJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85108a2aeafd1e58eb428466f4db2ef55c1160ccb975b811188c00d765a2cf94
MD5 01e8ea13f7cb2b59519223c8d51997a6
SHA1 a0fda7a184fe41a80463b6d9468417527e0d95dd
SHA512 fd06a8f98a271955325220f1d0e7afe7f30977805159e52286f7483e3159e9ffff9993061a9d068a1fa28712fc34546251b501eb296be70789fdbd9a3328ddd9
SSDEEP 192:FoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0e2RU/TNb32RjJ:J9iIxuERzA83h09RZxY6eNaRjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download