3dd6dcbd248f0e5ceff4eb1d9be8bac2dca0b34d126795ff546a67fee54eab90

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

49KB
MD5

adb0e1c92db91f8fafe334d03b4e327d
SHA1

107dc8e0170d977458fb899b74baecb1e51f2f64
SHA256

3dd6dcbd248f0e5ceff4eb1d9be8bac2dca0b34d126795ff546a67fee54eab90
SHA512

ff39fa5d8fc881de61c5a0d1cd837ad8f837a171254fad76b352b7be215da851bf68e6aaf36e234a2620f1d847e389a3af5bebc441bc1b572da8ea3867a5b512
SSDEEP

768:wZ8Ah4Ft28m28U28KAvi7aIOls5unK0mv/WWLDHhOh:Ah4v28m28U28KAvi7aS5unuWWnBOh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-259785868-298165991-4178590326-1000\{CE32FAA2-F98F-4126-B2BC-18BCF704B66B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
3096	msedge.exe
3096	msedge.exe
4160	identity_helper.exe
4160	identity_helper.exe
5332	msedge.exe
5332	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3892	3096	msedge.exe	86
PID 3096 wrote to memory of 3892	3096	msedge.exe	86
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 2512	3096	msedge.exe	87
PID 3096 wrote to memory of 1828	3096	msedge.exe	88
PID 3096 wrote to memory of 1828	3096	msedge.exe	88
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89
PID 3096 wrote to memory of 5040	3096	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef39846f8,0x7ffef3984708,0x7ffef3984718
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1812 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13555947108384272232,205389930505097170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
002d1cb6887ec03d1b29000b878b5864

SHA1
73341762390c47a52c07022ac932cf7a0e777153

SHA256
ee442efdb3ded6173a527c1d98b7c24d00cdacba4d9bdfb3982479e3319fdd1f

SHA512
518bd2182fac0b5c130333c02ae3a00ed4db4615eda7baa7e207a90b6aeee05152d80611e3016ceaeb43f3499053d13718d2743735c0c38b636c37f9ecf9cbde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e63dc0a4d52a46fed1e46ee0fda5cb9d

SHA1
57b51fc83cd575f7a0010a7c33379d3ccb59adb3

SHA256
52c7e42e0fe2ae5ce2f5150d8dd4b40a722199393b6de549f2788a6c87ce1eb4

SHA512
1476c4df5c4bac28cc24bf2de1917a5e5d473369dba5fcca9dacfca29081256358f85152ebd3deddf84da77e89814f7757ddbc8e80e2ab56143bf2b623abb772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
253B

MD5
576354d456b7035d67168f4514c79f87

SHA1
b6ff52e7e1ecf665d44a29b531c856a516cf3a14

SHA256
64197c855c2da2f4ee817050e7c714e7ee1ae780ae6566d5c7ed19549969b5af

SHA512
46dd413cc619e76253425bf103c7fa4d9174641e53146f473532fc1dbff0ac60ee715ecbf89d8407611d59e9c13f70cba3dad902b19bf6a2b1be8220c1ea6328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
69aa05107ee043884d23375500c57ecf

SHA1
ec0a07b7fe56cb2afdcfd6ecb6e93a5f85fa91a1

SHA256
8690f2f9863eaa6b858533d2d2f055c496d841acf662f28dae3a4c54da9680a4

SHA512
dc9d639815d41f033c0763c49ff6085903123f97f189c4e2561ec1781d7630365231cded96fbaa667984bf238f0df8e33fcf968806a16bfa863ef7ce3278e826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
461f3aeb26f2bcb99d449afc33d34b25

SHA1
a75f4d1dca3332a37446a9ebf2db69841edfe238

SHA256
5518a501cfa597553fe8c4953edbe0f35a38c3c4b1fee392959d88413157fa8b

SHA512
b9eea08835e24c186bcfcd10d0143666cfa1b4e49b37d9a6b98c9c439687b433d7298243193de19b6110ac767770b5802ed5af5afd0ecacdee94ba5270fa71c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19b602d7a95ab7c4a4dc1100af3fa2de

SHA1
5274aaaf5f535a3016839158a4d4ca98d617bd7f

SHA256
37d0e7f1b72d52ed142da1019a8637e81b958f4e45291e8dc99f617d0c6bd21a

SHA512
40d5fc70d3fa6227862c72bf6fd99926722b85e812f13f16a282a229bd0fe9d4dce0cb2a0a8eb48c60b0b3f91da44a18f594b3e5e80a9fba785d856e2f6a0768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b22927462982a3ef282a7ad919a1d10

SHA1
6183d1dd6e5d8c30b44ae748f9bd17bf17006ccd

SHA256
58ab33fe147c6aea81b3dd60e4a7db65d9461df32aaac173aa40e8207af9f34a

SHA512
da38e7d4bcdf246865a09b91ea6c95fd9475d03ef445d7454bad426d634fd23ca67fedcd1bfae758f6e91f89dccdeee09b586e5139cdc7636f24e6ad7f9313ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf1cb514935fec7dbace70f86cc07c51

SHA1
ee8df37619e7e0a7767c54d1e5e8dbcf3ad50b14

SHA256
0ebd6d06f758b329348d393824b72fae89d443bd99d3b165ea4b26711134a847

SHA512
3e8502be0a6626f152840ea345a41fb076bdb81bda61d03da366662fc5b6b25c8180a40cd20e2e4c4168c41f62726eb1e401fd935e010ab206808afef8f81ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3ce37738d83bb1810ea033e0b65889b

SHA1
5333a6a28a18b933167323b4bf0c31b2cd123c94

SHA256
51f3659da539d17f5ac0505da12069055d8d9aff9f7b4bc85f7c723ef30e3d9b

SHA512
3068f6de44b6bb1ee5605d3ed94ff41e2d045904328e9cfc4f7381e5c66b1cbdf9787d8ea5b2123a7993507a8f1a9d9a22ec02369c07a30370635a40cba520ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cfedcd203e0f6b84f39d9181a654eaca

SHA1
6b5b08a9d569552bd46f1ea29a4df2738d07350c

SHA256
50b335c3bfb7d27bd6297a8f1a09866af5d673889b4749f55fb0b5b6ccca76b8

SHA512
0650a677dbb0ef06ba4df32ae40b9a7a1743c9098c956b65663e91a11aac552536da0a792a1f5fb5a59476ff8fa620f79501b16810e054c507a91acacedc685b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5862cc.TMP

Filesize
704B

MD5
9642865ee2287754012cd3f051594468

SHA1
6ee401378d3f4796031e51b0f37df335f9b8d37a

SHA256
233456a884a5366ab1826463a58b99fdb9a296fc24f653843c52d840dde448af

SHA512
63f3e035c0fc8cbeecff2dcc1b8b21ed559db04b0ca68a78ed4872c7c395f1c388ab6dbcb42409891de6530076940e7c625da8a09d51180de4768bca50fc3ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0377b8fbcc5f5b8bf2e5b8c34ad13716

SHA1
8ea88b9f99d535aa8ffcb3e50174b538b0704201

SHA256
cd4f4ed7e616b4c7ba19bb41f30fb9c79e7f8f2c573ddb51afaf3eecb20bff74

SHA512
e69ee683a69452b000ff28ac1d5580b661a463470c642e4b8dafd2e03d2dfaaece38f1c24741ae4fc994da3911d18085d6737e0933206fa5dac6e4086ec2374f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6b16c046c30269105b4c63394f0a6260

SHA1
0426f4b7b2c12dd4031143fd25673deeb56f995a

SHA256
a5b91cba72a3687a83cdca7f505bf087468273e2fb656b6f87b0d9ec21813fdf

SHA512
a0f3867c21da4f329c4a6e7644ef9deece2f608a7f25601dedae262aa71e3ec5f74c6d2017f39377c3c4462eebe91d9c1d65d6a90cde0e6df42b3b850a70148c

Download Submit