94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
Size 897KB
Sample240422-azmlxadd4y
SHA256 94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66
MD5 13d678cb4508da2bfafc888af33d426f
SHA1 5990b5069855e1d2caedbeb5865a63d0515a41b6
SHA512 d6dca2b5ab2a600c225a48fc7e057aea6d55f8d72703f1f2eba03e0f92dd839d50daba29a3a036e014e44e884bd8c165cc8a8213c52b1d812f59b004cdc040ab
SSDEEP 24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aLxe:VTvC/MTQYxsWR7aL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
4512	msedge.exe
4512	msedge.exe
2612	msedge.exe
2612	msedge.exe
4784	msedge.exe
4784	msedge.exe
5856	identity_helper.exe
5856	identity_helper.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4512	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	87
PID 4500 wrote to memory of 4512	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	87
PID 4512 wrote to memory of 3968	4512	msedge.exe	89
PID 4512 wrote to memory of 3968	4512	msedge.exe	89
PID 4500 wrote to memory of 2420	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	90
PID 4500 wrote to memory of 2420	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	90
PID 2420 wrote to memory of 1872	2420	msedge.exe	91
PID 2420 wrote to memory of 1872	2420	msedge.exe	91
PID 4500 wrote to memory of 2924	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	92
PID 4500 wrote to memory of 2924	4500	94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe	92
PID 2924 wrote to memory of 5032	2924	msedge.exe	93
PID 2924 wrote to memory of 5032	2924	msedge.exe	93
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 2172	2420	msedge.exe	94
PID 2420 wrote to memory of 1048	2420	msedge.exe	95
PID 2420 wrote to memory of 1048	2420	msedge.exe	95
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96
PID 4512 wrote to memory of 3064	4512	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe
"C:\Users\Admin\AppData\Local\Temp\94761fe81f072643d8f3272ac5c6abbc34021619823233d859dc93df6a482e66.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf25046f8,0x7ffaf2504708,0x7ffaf2504718
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12574810120800464917,5624370321987815545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5604 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaf25046f8,0x7ffaf2504708,0x7ffaf2504718
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14360771786239389137,8338696946759566912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14360771786239389137,8338696946759566912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf25046f8,0x7ffaf2504708,0x7ffaf2504718
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1444,14713428342019528826,11311295160198823814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2
MD5 7e0880992c640aca08737893588a0010
SHA1 6ceec5cb125a52751de8aeda4bab7112f68ae0fe
SHA512 52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9
MD5 5e2f0fe48e7ee1aad1c24db5c01c354a
SHA1 5bfeb862e107dd290d87385dc9369bd7a1006b36
SHA512 140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e477e3e8851e062dc25c4026528d97d0459760000db21bbf438d357e9494042a
MD5 6002173dea75db41d0d193f4a914bc24
SHA1 1dcce923ac5e71d980024d28f18e71d32a3c3bfe
SHA512 fc7f224556ef04a803c873a6cb48ac8677bda9c3bf60d75d79b5800133a03d76d0295c95b0fa82d61f4485e4217e7782ccbd510b0d85011984ca49f36ba3c7cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d2931547bb9b7e4dbb1625b2eaf20737168ed98ec3ba1a4172f06a2613cd681c
MD5 7856777a0701ec61dee5ac14fab6fcec
SHA1 32e42fcbc6acc9f727e3e695d0d14af6313b4d1e
SHA512 bda787308e2537b7843c6ce772d9b41eb5052ca1124d48bfea1d363fd742018ddeed92b5e723c95a589e5aff7b4273f769dc9428262d902b4f261212541f5cd8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4716b010a0a46216dd086192cea9cd5bb052626d479f1a070d1ebf8f924ce88f
MD5 c61cd2a3fd4c691c9b31af0f171c17b0
SHA1 ddae00bcc2811fcfc7d76024afd982fed57d6d4e
SHA512 f35e490fd907565a5c08cd898c545c90531406cc0be72a8279fc83a1224330573d79e0b5931e68800d82fdc6ecf40f8705b0c18d2254afaea38d5487247afb38
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 464ed583c14e3a97b43fae001504c6d26877f105be172a83d377aa994986e56c
MD5 24a3461db082b7160413397aa07f8deb
SHA1 54a1bc1c82f64136199296579e879d9d02fd88c6
SHA512 ec6269a3b20396b02e6d3d1f7f8114fa03473ed6ac8a9a60e536cc8fb4d6db83edece4c529e3545f83913baad5a5ef2227dec2f82e337827ca45447ab271a259
SSDEEP 96:nnk2vxm/YQYmqJ1+0hrCwpvWMoiVmdeHah80O2UWQyV+VDCziEwb:nnk2E9GIoCGWMXP0O2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 997d1c73fbd134872123dae431d7f219164a997d72cbaf43496bd1966d5803b0
MD5 36dbbea1f1d4011e7720a99bf590cf90
SHA1 47fbab6860e9cec3f3700ffd75a4509f8ed9d846
SHA512 c86d7e69dd3865e58ea4aba9f71f26027b8a5afb317a2952e511c63c2379656397a25425c7af3c8956b5eed73de42743b0c588a6e5abe6d24a5754dc3d7fade7
SSDEEP 192:nnk2EzGIgCOrXWM9Yj0UuFvfgqQm0Odrg:nnn3ImWfK6m0OG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 1c4f816fc019f33956905cf6f0718844efc1b6e268855a4281ed377c0ee25952
MD5 4ef754e0e3e86073d05bc3c657658230
SHA1 170791866447703e94e471bb6430a6b529090007
SHA512 de0d7d7af57bd65e7f3a6e931d234b80a244fedc730952a8bfc108c4b4d08508b76405c00a2fba55e2e31b20b307fddf1e795e6bb46911fcd6b1ad7b6015551a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 46397f217f01232b6d0efc43f28a4e624a732e6a619cdfa0fc730c757b78fbb0
MD5 5c144a5fddedf86c2c513a652b2e28e6
SHA1 758cb9567de414a922f316c22f5aa160b60c35af
SHA512 e55d6dd596d546d280c2142f9f954a03f7b880a6ee4a95ab2618d4cef0774e84e4fd53fe40f16ca5579aa2cbbeaf0eeef433d3187ebd6fbccc65010c6438b4d7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 7343ece20547f3ef9a0f72c68fadf30ff1ffe50c2e3774e870a9bad5ff5de568
MD5 de19fc4adbfea5f10fc81eeb3a092c08
SHA1 936cb04b4e32d937db9a0fe4e7be53f06d6932ca
SHA512 f112d2a55c330dd98eeccc57822ec169868cc1e4236639712d0359996abbf97eff5aa7630b88721328f8c42de5c961bd573f43b409723a79ad8776eb1f8582c5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 ed8d4a10adb2fb876c52eb963e6bb6c2dda62233dd8ef938469af7930043e7a5
MD5 62ffe5181725e483e2e1d5a054be0bcf
SHA1 5455792d8c9720262c272db90e19a9459ee088f1
SHA512 208960827bdb88caa7e8b093eb531199b2baa811be15e8c217d40acef25a663ed453a58001f1679332c2f40fd732d19ca00052b00849ca48bf99ca24f34809a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b556.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b556.TMP
Size 539B
SHA256 24e15733de2be89d152277ddd9e45eab28f2bad97dc4c6d5061d4a5c26edb793
MD5 2167db05f6a4f453875f299c392d4832
SHA1 2ae0f34fa60086da75e812c56477349ec332a185
SHA512 0949d02d62e4f3da369d4b1d4db045ba109825d512ae1e460da1ded14ab5a84c95c029ec58373b7dee63cd3cf996f0a446f6ee148c06e47ed7465caf3fadea82
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24e6dfb597588287c97221dc1988919ae8841da13bd0bb0934e2422b46c70586
MD5 2470dcbe69cba8403df674875aef2532
SHA1 89d3c75965ad6d545af1c2199b571467f5de440d
SHA512 ee24b4906c0e7752ee95fdc3cb049cf35e73a61d7585d08a80fec06ea27ea0b31da42dac9f7b7559ef451dca2fd429ab3e15eb5e21a918be8efae86c855de7ef
SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm0e2RUJce4ws7n:r9iIxuERzA83h09RZxYJEc0s7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 317acec6ae9a5951fcd66006281d02b47d88ecdd33dbdcbd3e795e0f85a9aeb0
MD5 efed90e3b9f685c0e39c6bd5180ad785
SHA1 cdd246d738005fca7cca4786085c234cb475fbda
SHA512 c82f078e1e375aea4106b2cd6030793ae5d22301f7d8fec4157e6fa68d4fa2960b0c724001cf72ec2d2b2c754b5f9eaab16351a0e2f98276accbffc7eea52ffb
SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmte2RUvce4wN7n:r9iIxuERzA83h09RZxYWac0N7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f6831f78ccfe7a60d06c96995b5075aa2d7915096c53ba1f76e2f59391b353e0
MD5 e69cb5110756ea361cbf78f0bf9291bd
SHA1 c284ec17ae5504c1e636697c21ebbecdd859ce47
SHA512 7d1caab77bc6f8912aa1f8640dc04e14a486546f13199a500e9143814ca2ae8808ef218f6f3dc8cf60b57e502bcc1fde38868eded05844acd1b43abfc949f3cf
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup89WLfe2RU2WLFajjwndP4e:A9iIxuERzA83h09RZxY6WTXWhawdAKOO
MD5 SHA1 SHA512 SSDEEP

Submit Download