6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
Size

897KB
MD5

c62d6a1e937563a6f7cbb13855b079e9
SHA1

ce11f8a68e41004b5c1289d38352f6f0379ffcff
SHA256

6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e
SHA512

c0034aa3ff15c51d87d06a0b1000a8a4d8e4c465b03afd6641ebb0eac444051e272b7b8efae2c3a62dfd44b7310814733464174ebe5c2e7f03fb8ffccc32076e
SSDEEP

12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTQ:sqDEvCTbMWu7rQYlBQcBiT6rprG8aTQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
4052	msedge.exe
4052	msedge.exe
4124	msedge.exe
4124	msedge.exe
2600	msedge.exe
2600	msedge.exe
4268	msedge.exe
4268	msedge.exe
1192	identity_helper.exe
1192	identity_helper.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2744	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	80
PID 2588 wrote to memory of 2744	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	80
PID 2744 wrote to memory of 3656	2744	msedge.exe	83
PID 2744 wrote to memory of 3656	2744	msedge.exe	83
PID 2588 wrote to memory of 4124	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	84
PID 2588 wrote to memory of 4124	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	84
PID 4124 wrote to memory of 3080	4124	msedge.exe	85
PID 4124 wrote to memory of 3080	4124	msedge.exe	85
PID 2588 wrote to memory of 4756	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	86
PID 2588 wrote to memory of 4756	2588	6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe	86
PID 4756 wrote to memory of 248	4756	msedge.exe	87
PID 4756 wrote to memory of 248	4756	msedge.exe	87
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 1556	4124	msedge.exe	88
PID 4124 wrote to memory of 228	4124	msedge.exe	89
PID 4124 wrote to memory of 228	4124	msedge.exe	89
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90
PID 4124 wrote to memory of 232	4124	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe
"C:\Users\Admin\AppData\Local\Temp\6d2a6c1ddb0db05da4f4a97162c1aef266881a8539da7362f7d72eb43120651e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff8e9a93cb8,0x7ff8e9a93cc8,0x7ff8e9a93cd8
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1708,6902793515988014377,5951473874104814704,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,6902793515988014377,5951473874104814704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8e9a93cb8,0x7ff8e9a93cc8,0x7ff8e9a93cd8
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3300598657530050430,16018402886022282258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5256 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ff8e9a93cb8,0x7ff8e9a93cc8,0x7ff8e9a93cd8
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1700,17019992162817521412,16037744065237290704,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1700,17019992162817521412,16037744065237290704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5710c39b3d1cd6dd0e5d30fbe1146d6

SHA1
bf018f8a3e87605bfeca89d5a71776bfc8de0b47

SHA256
770d04df1484883a18accb258ecfa407d328c32c0ccbd8866c1203c5dfb4981f

SHA512
0f868e4ce284984662d8f0ff6e76f1a53e074a7223122a75efa7bb90d0204bc59bee4b36c215d219a03707c642e13f5efce0c3c57f46659a0cb1e7fd2f4d3cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d5e555f6429eb64461265a024abf016

SHA1
05a5dca6408d473d82fe45ebc8e4843653ad55af

SHA256
0344fd65882ba51695a10e1312e65f08d58afca83771c9d545e181829d6b5ed1

SHA512
be5edfdcda1ba0db9fbab48ee1b643f1b03821e24048892d18033094fec14171035179e987a08dd91a1c25d91d9256837a4105f6765afd225a868f3e95050b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
04b01c95a53ae9caf55d2a65f8305e7f

SHA1
d6e695dbc41392d7cf62a28b64af3edd790fcb0b

SHA256
d86b2986892dc5b24319eaf26340a36fef89c41cccb4a3592a529cadc4ded7e3

SHA512
e201be3d2966deda9d16288341a7c303f17100ec3b870ced1284bddad50b95c3334bc3e3e1ccbc8cd6aeeb17027decd3973b72a34d4f225fe9c35d2bd17a0821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c2852b32cad00104327815d0f6b5d863

SHA1
2992bad4c96952e3f99c3d08d00be60f2427595a

SHA256
6c63f4fe651148bfde3de5b245c864a7b7dd9d039d25009fe064da00a1c6d8f0

SHA512
4bf3741c86be5e8f437225eb43b8f25b70e9dc5a1c9f7a8f85e310905fff152c80c15fbaeb99832097a0228872ee82d571b6105b777a829f2b08f72deae8305a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
35949bb73d233af7d5e7b90af4177bca

SHA1
c5bf0adfb714f73f9c2565a22917a3c567a8acd9

SHA256
362c7ac6447aca59ae6bda2a0a39e1ecde0969cb16173a3a21a1fef2543a6baa

SHA512
711b78f1b23196f60b293a1cce352254801498ef49f3b1c4929fbd859060cba7f157cd2374f3802d73e1de5a5459522fb5584bc68b6d0164b51c8cb56c376460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bac270debac5125e24a639354e2a11e

SHA1
de60db672566a874f1128d78dff9b07635dd0c7d

SHA256
715e676273449bed80ff7988c288cbefff0a0c230987acba93a462d5e0c13c4b

SHA512
c9193eee4e083df80220bce0b17a8972784f790a5acb61778ed1f24446d9541880b443787af9cf03f9aec42dcd8ce682cdc5ed8b1d0e8f12bbd7d2b8c94eea44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1152bbd9f0432edd661016de530b94b9

SHA1
6b8b0cd198727ec4d1130f0714a860c64a792247

SHA256
318f5c35f170eb178469de0bd2880bd5a1f93d5fd7f90b2742d6092cea236c87

SHA512
c5e077e7f0aee5d86c262d6808c37872de7916e4a0f504e414e3e5eb8eda6b8718493c7c5e0013a664ba1d732a9d103db1e43196cf5aabb29f18232c60cce06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
0414ba87474432a55be9e78dfa58f847

SHA1
07d1165611321c18ff6ae5c9f35fe3b8f1017f27

SHA256
624c714becccd52c748a1f40e5d4cc5678db96eada24ead0390bf9117d1bd55c

SHA512
ac0bf358538b459b8ef97cc92322afe606898374cd2c759363428b774b2e17a2e5492572c2b8680740a766bc1dd2866a58782826807330d979d75cafb87d7c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
96af467d4e9dc0c22e9d3a05fdde0280

SHA1
4b5ead16ca3ce8b912101f89fe0f86ba9a6466cb

SHA256
873a8f3c13f839c87c55bc621e7997d8b8db33b6353939eeb53e9501d5d4fe8a

SHA512
a061a5a48d2900d4e35270d051b4eef02d5209f411c77ead4e59b1e319b662d77627918cb33493a5433ac1d39ba82f00add100402f33c26d047970b0622b4a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d82e37c6babc24f169142516b41ee5a8

SHA1
e3a2171972f55b605a06a3ba73f0de11b43f2bd3

SHA256
2862112a515e68442baef3f7432a1dfc2efff02af1cf500866a40876b5e04b17

SHA512
0a0945176657d01ad48dbff2b9280d6ccb98d836530e3aaa79ffb0c3e0133dcccf89e587631c57b0e008823599dec24432e53c3eb516c028f28a13b6d1a44ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
8529215c7ff248397e73163b3ce4f94f

SHA1
ac01b6d6691cc4aa5b4f154d82154520e4329f6a

SHA256
6e66a6f267c26971846f2bfc8b4ed39463f0897ac5e614fed6ab727ac3e6d650

SHA512
5f8d0992683184c1657e1e692f4bfab4285877375bc2add490499ff823bbf3237b7529ea4daaaae7fe156a26e251fb7b10d7865de4cb9999259b0fd08ef62f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a99e.TMP

Filesize
707B

MD5
fbab4fb5cd517cd0487799661c31e3e1

SHA1
c3af14afe592f534b59470f5d5ec81542a4269d8

SHA256
ccba31cdf37a4b3853b9ab98d8a743991f249da464f9c08d9578b149f8aba874

SHA512
7ad45f7520c0e925f7f0fb8e5dd9621b2402450e40478d080f08779dce98788ca0da6d64c9fe9d8361282f395e46a16aa3bf53d9a02149ba865b722fec4f14c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
37b26973c1d2c4a3f4eb449fb81023cc

SHA1
e62095fd90d1918e9d39189e8dc794800df675ab

SHA256
d96966c0a25e3b5b65b2a2c96ea43ada6e71c5609fdfe754cdab67c0a7ea31aa

SHA512
f2ac629460a4a326ffa2daa458350b1449bd94d6a1fcd2efc07df77cadbfb85f08892cdf628ff5fe5866d8037c0c93fb798e8ada732e0fa5cb83b99ef70b76ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
57481512200e7c1b32a87945cee43bfe

SHA1
a47c9686d6f0738d964fbcf726dba32d4ccb85e2

SHA256
3d27ada9b3c557b442713c3ac243d32f3cd1531c7d4f1184bab242b5eaa0b209

SHA512
126ee7755a66bc22333f9be7776896b94de26188fd56aa9140a87d635d4ba7ba0617672139ea117f874104bd93c2935046ee3c49f373093dd931b980af9db9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
824e45a21b778d20807fb18ff86524a8

SHA1
2050980a80d2212a21f7d9fcec334d7bdbe918ea

SHA256
54a7408495a19dda972998e19dadc6f08c3a389fe18971eaac26d01ca796a444

SHA512
c1d7d87215a6372a35e376cbd87ca0bcc27b3591a66a953142b706480854d9f34b5ee8c3bcfbe243f8c9cfffbe8c2ffe8c4674b89ba91aa534ffaff8d83a0df3

Download Submit