hxxps://tinyurl[.]com/yc5aebmx

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tinyurl.com/yc5aebmx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{1541733F-5FEF-4450-8210-3F3B77862B2F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3664	msedge.exe
3664	msedge.exe
1844	msedge.exe
1844	msedge.exe
5328	msedge.exe
6020	identity_helper.exe
6020	identity_helper.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1052	3664	msedge.exe	88
PID 3664 wrote to memory of 1052	3664	msedge.exe	88
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 2604	3664	msedge.exe	89
PID 3664 wrote to memory of 3448	3664	msedge.exe	90
PID 3664 wrote to memory of 3448	3664	msedge.exe	90
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91
PID 3664 wrote to memory of 4424	3664	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/yc5aebmx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff981f946f8,0x7ff981f94708,0x7ff981f94718
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17358155536691230969,8192159636271894221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8356 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8e65ddbba0fc8fdc8313e4bc108228e0

SHA1
8c1a1a40b12cc3990cdb86448bcf331ba1fd304c

SHA256
301ae034fd8c5ce71460a550231568a0f29998b8d05eda610f8b1a92ae00e0b4

SHA512
6ade46ef3ec4362ed67aaba9e3040844c08efa080e948f8cb30cefe16085a20f589294eae0d1ef1b11ec2a6c4630c4ad4b42e874d66b30a3a8e87a76974d579e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
64819baf0a19686d8e714240f455494b

SHA1
a905aeaf637d601ff9d41fe75ed58fd9e68f1f0e

SHA256
9795ada60819fbfa7900c7522879a0b5ef48c9b6da79e5a4a5c315bac74e27c2

SHA512
bf4d3c02f51f52f3f700fa7c2821ad034b841f70c7c4590cb13d2fbc07519e1dfbb923fd8ca92cd3fe67eb7dcc40f28e9d9a8bd847077bfebee6ca9a3d21ae68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41d6e2cad247c17be91224c6f1210452

SHA1
205cf6fbf6abe8c8cee6686b462843fb8f459810

SHA256
fad894b3809a4ce4006d3172c73e9234b38de3b431e5de97d2e397d412c24d3f

SHA512
e3a54404d979b00359e84ac34d76fc68a319d7a4232e775efbd929cf24116475e8211e31405fa9741448f98b4b60fa7f69cffd8beb8710a2f0481edcdbee4dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01e2e53f362739ed2c058f33200b8640

SHA1
cf3c08bb17af59b5b7148f0d25425e14cf29f6cd

SHA256
272a7e85ef84c4d354cd243ca6b1bb9a421874871e81a17b5b1a151163ed1dc9

SHA512
9e4fe279ff1202b8ed843e62b1ed8397bf979f3d9f27b2038c27d55ca0f7130516bffc1332656f34e3ed2e943bb4dea49cc8e7c000a8cfa46bc6746715a6a944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
1abbb6da1c2dfa71e7a557e0c150b69a

SHA1
f368a5ccfa60fcf2611c21ba2ce40ab7ee54832b

SHA256
edd6cb609a2d1435cd497e352a8523153a2a4c908bdd548d13f69832b3cae1fd

SHA512
b5c569bec08deeeddff42618ba5752d27922bca9223d3b3c785b3ff4ae7edeb00ae4601e4dcfdf6bf2d04280bd9e4b007a1d1fc458897397318c8b37d7a6f611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9526221a084b659a75c32e1af57419c4

SHA1
e043c8254124bdbfe0b112feac7dbf9b6bbd483b

SHA256
9ab1e464a7be87015a6be6c2db3827c6bf705125ce04775d9ccfec925f139acf

SHA512
f2ee3712091275c19e30a60f7f272393ac07069026df6bf7beeae0abc08f008ae82f4c9c6b7b7ab0c628b69dd1c6417a318a797ac03af4ef843ea7b857693a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f8b5839a5856b8acce8775dabd3d0df

SHA1
27f5a20c866d836c2d89887020fda891d41fb6da

SHA256
02805ca7841b8959329257ddcbf592cf82ec00d674e9407c3ca9039efbe5be7b

SHA512
b20a630ea8d1efd0d6b38ab4df2e7772b21fb94c6e59f1d83f9e9201a390f326efe9547c47aed0b09ba519c5b7a4e32995e46f0586b1bf58b4464e727f4a6d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
d039a742390d458df61ee28c62b254f0

SHA1
d194d4fa1eb1c02168c8e8c355dd00c1a58b508e

SHA256
bf0fd318ac3724536041d133ff0966ce85a369447e73fa947c48a1b306de3a0c

SHA512
7b4d1aac5f363181d7b9c190a2ba63dd92f41d722d5f72ef8302cdc316d30a2c3a0e7652d7ac66fdd8071cfb863baa36a5b24aaf8e53ec0f04b86492eda4e662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ff345f0832511bd7df41f092ff3b51b1

SHA1
ba3710d33acea7e83015096531c551c2d72561b0

SHA256
623440009577522b45391490baca18cbc4cb86928bf6707c3cc0e362b27330a3

SHA512
c38d1218e694b73aa3f5c23bf1fe216147ea9538fa92672b4dfea7812d57c17b78ea8f441e54ccc29fe938c135389d5d083a5a0d36f70182fc909f34a411da34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98ee644e83e4d3c5d2e94464b448d0f7

SHA1
2f20e13a78ba68c318b3aff3b719645376fe7f44

SHA256
4e2f84c51bc29071c3f8422a03764dbaaba7f9e54735a4a2170c5082b4340938

SHA512
95a8f68a719b9fd5e93025684702f8b5c1819bec49c2554b524eab7175971f883c758cf02887c7c6696bb9541e63546b61aec29e01e2779da6a2011e8828ac02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c432d1457b0b7ddd312fa197b3c0de0

SHA1
0f7761fc4fd5e6d87ac24f9b9fcee1be195a1d74

SHA256
c7e15d7975fb589244267dd5a4f0b72c2fe6ad68b5b428cdde406ff475eb74f1

SHA512
3d17bc4060fbe5168bcc593e95d206dbdaa681e0a1f81537465097779639d2bdf5eeae7dd5ba869c5b5057f293c9957edf46d97a6d3b1597d30257b48dfdbcdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
573937f578afa3e6a2360bf15af58783

SHA1
f32370b7032165e1143fd286c1498cccc3d9eb7a

SHA256
2ed215cef84af8f5708b2899fc610639a4bd3081b2ddb00ceaffca73ee68a953

SHA512
1ae7e6644671d66b90561d255a0ca6c1704a11cc98f32c98e6d8692d70581677967cc679db9cc38d76a8f06ddfe86d8dbc64046eb85313837bcafcb96cb5564d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4713d165cb1515082e22c64914dbbbf8

SHA1
403a092c0a1a9fabb9d34675ce062f89b695456f

SHA256
980ebc1346e580b5c71e45c9b9e353617b55563f9a6c999939f058108c0f0d5d

SHA512
42c2596c5ee4a8eaed5c7d8bd45267203a3f22b4ee8aebced93ecbb00d0eda9d4e20aedaf91bcad5d2e356986e1b6d7a1f5f1c1075fcb16f8ece2187e9bb9a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a22d20acd402a014fa33c65d59b4c1b

SHA1
40112483d4850622256baed7bbdb058abd9663d4

SHA256
0ec4bb3bcf81ee42d0a0e5bbdd8368c11776c337a0fd79a5dacc66c4a825be8c

SHA512
cb9289e1740b9a676437e2cb51d50fdf13c65cd0ef032a468fa01f548be17fb38532a17d925977066504737ee74099bdf3fbb58934cbb769c0ef4ca3990c7241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1222b347fdf42621221b2c80ae4bfec2

SHA1
bd1306b8390f83cb7ae0fe51b58c726756d28da1

SHA256
8b9612b0ad5a1fcbf7f3114bbe801c6e228606f7ee44ac71fb6896e911810435

SHA512
841f17790f47a5af095f5754ac73eb50efd3c95204b0d3340e4ec7b4dacccc7b8e93ae429da530b126f9ea0d6dcd55342be760ffd8eae1f3872546abcad07792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
eaebe7c3ec30947d1ce2af793b128933

SHA1
c20c530bf01460918fd9fdcc5f6b8528cbbc2e02

SHA256
fc7ce3420109f7408e5bad942f2b0c3c4a1bf1476873a4b4dfb4fa2cf32da790

SHA512
5ca4c9a5b61c7e1a05f76ee543a03c8326f513cab8ec7ae13f807dbc1adc50bf8f5ed71766d0a133b6cd9e3c7ab1d12cc29ed643ab581f52b3e60dcc8a64054c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d4071d285df276634c817424f65717a

SHA1
1881a96565957b422446e3e7ae5e7b2c37382f43

SHA256
02114898f0fddae0de2848535e5aa6600096cdc2403dfe6dc3b78f736720d9e8

SHA512
76f26b21b4c325ea6958825416a2555c93aac1d7a9313bc30f26e1d0bcea4b64fdc08837699bdde848a071031548e21b5489974ed0a60f0313948e8776a2c604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a199601e07f89f6738e054bfd71f0369

SHA1
0b27908f1a2b2d4089cfb976a11139f344e46e29

SHA256
5ab955c37a74ad359cdce71ba93a0ec10a8305cfb4f58bb823b8c4653c7fd25b

SHA512
39346a41f310fa72b39e197a0d48b9321e4bd00599c67a93868f6f84d44cb2ccd98fc08d6e54a37a4c842a05024bf45dcdf87aad91947862cfcd0d6da5174930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578731.TMP

Filesize
705B

MD5
f6dd65345bd6d168d54533c314f3eeb2

SHA1
57c3cc9daed6b716937f90145228b71d970db2d8

SHA256
f8c2a3d6cac2889da36bb3bc49c206f9e166a54460efca0d3849580fd845614d

SHA512
9ef8404947c37b969f944018730133df38d209c9354a299df3893f2c0d7502ac4884039179b0eed94c64c3514fcb54515975d039e50fbcbb39234e8ca1ba75da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ab3add4b6bc8e9035cbdc8f220b6f34

SHA1
3ae089b4bcdf151e1bc91fa8c20be1d5b27fb5d7

SHA256
4ddafc3d0a9f50fdfb60355e163f978ad4f58d8af0b336b74cbe1ff8386aaf16

SHA512
7115abc807aa248c10dca801aedb4cfa163db078b4fb21db95abd070159f69ae041e2bbe2de48d3533ce388b5f8b7fa3031d2fac693b89c6730ba850ad1563bf

Download Submit