1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
Size

896KB
MD5

30d2195b24191b483c4ad284d2966a09
SHA1

9548a62139fd76d96efa7bf3cc8124392a4b0162
SHA256

1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719
SHA512

c8131a27ca5941952e6d25e3bea66ab35c34b90e27acb0e58d32fadfb5e8de11930bb2d12c7d280be0742432a30ce0ee2030ac17892bb1fb77cff1cceeeef5d1
SSDEEP

12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgamTv:TqDEvCTbMWu7rQYlBQcBiT6rprG8a+v

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
3136	msedge.exe
3136	msedge.exe
3068	msedge.exe
3068	msedge.exe
2312	msedge.exe
2312	msedge.exe
5240	identity_helper.exe
5240	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4972	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	85
PID 3952 wrote to memory of 4972	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	85
PID 4972 wrote to memory of 3220	4972	msedge.exe	88
PID 4972 wrote to memory of 3220	4972	msedge.exe	88
PID 3952 wrote to memory of 3136	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	89
PID 3952 wrote to memory of 3136	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	89
PID 3136 wrote to memory of 4532	3136	msedge.exe	90
PID 3136 wrote to memory of 4532	3136	msedge.exe	90
PID 3952 wrote to memory of 3960	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	91
PID 3952 wrote to memory of 3960	3952	1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe	91
PID 3960 wrote to memory of 1084	3960	msedge.exe	92
PID 3960 wrote to memory of 1084	3960	msedge.exe	92
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 2344	3136	msedge.exe	93
PID 3136 wrote to memory of 4340	3136	msedge.exe	94
PID 3136 wrote to memory of 4340	3136	msedge.exe	94
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95
PID 3136 wrote to memory of 2128	3136	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe
"C:\Users\Admin\AppData\Local\Temp\1316610a95c06d5cd0929df4a499314e7be9219373bccdf0f3b993e813a3a719.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa21cb46f8,0x7ffa21cb4708,0x7ffa21cb4718
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8963533941540741144,16883021558668556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa21cb46f8,0x7ffa21cb4708,0x7ffa21cb4718
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5609963192573202469,10759542087708567419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6128 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa21cb46f8,0x7ffa21cb4708,0x7ffa21cb4718
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9461009159967994900,8680277317329617062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9461009159967994900,8680277317329617062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fc46ff5fe5137ad4fe1d13e223ad6e54

SHA1
88eaf5970f28d59dfc62f8b5664308a893a7dcd4

SHA256
72fd84233d53f8187222cfe49d6270871df2486128594065b3af221846545695

SHA512
39d65e99c8747d5333935e10cd80b7a8ed1afe677a39a237e65f326f204c11ff34fd4bca583712f99ce71be025bd3ce7c8add3c4f8333bad2d4e1e7202316ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2e7a6d6462ee0dedfa36d769dba09c0a

SHA1
d03023c13a40088a6895584f3ea63c1fa9209742

SHA256
89bec10c3428fa407f8babb58ebf14f2f103fd7374a2b350bb9af07e80fb037d

SHA512
0b58c154aee130a4fa5bf7e27757194367674a2985498f4037220fc70e225e1737a4b13d8d4b3ae4b3725882e14699951bd8b4a89a64eb2262df38538832172a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
47153571d256798fac759291ace40df6

SHA1
da8279b8d0ea04b70006726b68e12ffb9de21fc4

SHA256
fb5ba26cd3e8a474484a05fa2162b8a87795bcbcc1bd4846c96d511cef9c9634

SHA512
973a081b8536cac354cf986160df4335e99e93532765130ad70734b480dab6a75dd819b56a5ee766836630e74a69e2887fd09fdfd4feb703f1d13490a7de3dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
592cb62e7689a408084a5a0d35ac6f71

SHA1
ae2d75438b70a48b12304a25b2040a9d11ad895c

SHA256
d780578f6e22f059b8c0c56d4ece707a6ae55ebd08845cbfc3632665ed74a896

SHA512
87886ce1ac35f43af83ae71a31b2ca4b103ba1b33677a9b3121b35823eff1ea1fbc2c268119f7a6e29886a94e15025ea7bc71a56f7c514f28cfb7ce3c51b8f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d36f6ae741bc64297f631abd83f9d9d

SHA1
9ca733bb49523672a00b7ff5ddd5fa99c2966096

SHA256
cc5ead7957d313e8d2d93c2fbb97437a6ac1d6602b214d57a2a6f6ebc451e794

SHA512
22e915901bca18d8e4a4c97a125280b7abc640593adfc1a215e9c8fea901e9f3470887ab2bcd48f12d08938797c7ef43e911dce589dccf7ac78efe565824f551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
4b85730050e28078dc82c53828a5fe34

SHA1
5be21df7516ddb429e50f83ccfc30b447cf34d5b

SHA256
ca0a087d348a3a15f0dbf6b80418c6a99750675824990b5ed8b983b263055a7a

SHA512
ba72aa88eec7a24b54ef45c2b588a2f18e86b6c1300c81a6c8034b88f4c81bea4061d13cd3d5fdd2bafe282cdbb1ef0bbe67401dfdc06954eedd94164dd2dd8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
e6b46894b3eb197092b3503f3f6cc511

SHA1
429e5b8c6d76d85abb6f4bb636fdd703bbbcddb0

SHA256
26709d473f34cc34b688afbd213dfdb42f7d2fd81cfdbb63deb61c5a4d19908d

SHA512
0697db4193ebda7c65a7340fb8df0e3f13f56a062ff6aa5aa6ce274ef83300584bfc28d9efd99a5fe431d1d5d52387fcc5451373c51dba5706556f45f0dac877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2a57443a25831a9c5ac509f151ef0a11

SHA1
f063ba69e6887ab99d061179d0a8141ae7d3dff9

SHA256
59d2f5b922f279e2eb5fc3c13dbaad9f08e07aa8369cc8c1f6ccfe456588d15e

SHA512
e630a655b3db3aefffe171dd10cbf2cd23e7ab88ca376801ecdab660aeffd76b9f7885caad1100cd6848a7c11a44ff1668fd2550c8a188d2232079ba73392a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
daaed9a6eda22134537283846b931a69

SHA1
6706a7af2a47cddc26fd19272f5f46bde3901223

SHA256
2a4698dba75c23f8b1ff0b4aa6240cc0a32b3f81eaef58f0df707ad9950ee284

SHA512
4159847c3f4511bb6435cebbd1e821a4c288b3fd0c2d5a4215ee55e160eee7d4d0c16cd82b03c37a05d518c784e93eb89214dd1fbbd245ea5f60dfb3ee1d24b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578bb5.TMP

Filesize
537B

MD5
f87b1331a3a4cec703310726f9a6f345

SHA1
8cead0e0512decdd32cc7a8fba59786f2ca2bfbf

SHA256
26764535d262048e00f76ed642b9620e965fbbb51f83668d6ca96bd596f284cb

SHA512
2bf33243f8b9590bf0e0447f04d54f0f580ca890ab77a5f89079383887c606a9f23f56ea9132ddbcf838e55d075775c443d6921ab9864d58ced11380621a828a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e46a024f6c2ef89e9ed8f770d361fab4

SHA1
e62fcda0e0c1c802ba2d54e89c823cef7b28c702

SHA256
7142121bf15eb924382e7f09a7bb9f16323c9cb603daaa0e5ad7679820164ecf

SHA512
f4d02c9dab2eee4badc98b1c7b63fa9713a9672f86be4a58fe1d1bb2c8e3909b5a0fc9f0a1395ce80fb53f2f58688acb1035a111764b9734db697fd600cfa28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
91a73836c9a18d6c272a33bf4c7486e5

SHA1
c2627446e1aa9e24dc1a9bedc7a0f1b9a71123b9

SHA256
015849928f1c5732f0217f9b869b9f1f76a3115fe12ec5361275f08fc365d852

SHA512
be02358d375cbe485ef5d8140d204b2b03d67f5c5c83ea5779f26a8a8d4c3465c5b5eec93b432167db825f7b2f1175bed3bd7d0f4bdfdb7f1752931ffc83bc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb6b47280aaae0daf423eed5be3edcf3

SHA1
5be7a0a70064ad0faf33e3b2e7a4c24f6498d97c

SHA256
b015ba102425ff45ca01f2074e37e663868bc55198311164678a8329f5a219d2

SHA512
23bb7699d23e344bf168fdd2e38078c278e956cd8e5ea285d460a955d33c8dd56039e3f20ae2026fe1281358f6b04542ec507ede49f78f0921d74a3dda07a736

Download Submit