6719420e48d36eb8dd8ac719a8daaa5341986f04aa8af1cf76faf418fc1ca59e

Analysis

max time kernel
1760s
max time network
1693s
platform
windows10-2004_x64
resource
win10v2004-20240419-fr
resource tags

arch:x64arch:x86image:win10v2004-20240419-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
07/05/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

kM3CpKZ.png
Size

133KB
MD5

b2fe0f992e56a764a725b21907c543c2
SHA1

c6fcb3319b1884855f98c139e7ec7d993944c8b4
SHA256

6719420e48d36eb8dd8ac719a8daaa5341986f04aa8af1cf76faf418fc1ca59e
SHA512

5d32da3aebfea826b50a35e3ad5f5bddf4b9a180ed083e51e393367c98fde8ee49d1d921083af7f8dfc352653968a638637e2cf7c85f153850c515369fdfe752
SSDEEP

3072:qkt6dog5aQXGIYDXo9CqmehhoDa5GJnVN3y27+j/GBy3ND:qj2OGIYMCqmehq7JnVN3y27+Cw9D

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2818691465-3043947619-2475182763-1000\{035113A0-F8E4-486D-AE8B-42CA013BCDEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
1424	msedge.exe
1424	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe
1736	msedge.exe
1736	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2284	1424	msedge.exe	95
PID 1424 wrote to memory of 2284	1424	msedge.exe	95
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4388	1424	msedge.exe	96
PID 1424 wrote to memory of 4288	1424	msedge.exe	97
PID 1424 wrote to memory of 4288	1424	msedge.exe	97
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98
PID 1424 wrote to memory of 3848	1424	msedge.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\kM3CpKZ.png
1⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe47d646f8,0x7ffe47d64708,0x7ffe47d64718
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=audio --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --service-sandbox-type=video_capture --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1640137988679510780,9268702261209298994,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
bb297adaf7e3ef72175e92e448c5d705

SHA1
916b60178815ffec4d127d85ddfb693b873cbbf4

SHA256
57bcb4ef1fa35b06ede4f57a2b14da5a659964ee49f3b0decbe77452c6708221

SHA512
ef2614a430475e90956a1c31e1226d1121ed74982d52dd1d89b63ed7a9c80b6ba6d20fee228a6a068da9a93feef633c7a2122842b8396c76ffcf802d8afe99ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9e04a68e5c955b975c406fa81fadf63f

SHA1
81f925515d4a31cdd48a6bc2d8ce5ba3ba802c09

SHA256
e1cbb20f8d1d1c732c6176d33d92af351517a704fce2b5deb017f2f3b0e3f955

SHA512
77b739bc70cf9bf2ce48259328d5dc4ed0757ace5a37ec976024355c2544b18852b0681e1f684a3ba5b884ddf46703d05275e5e1cf1b10aa8378093768c1f06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3af363af22abb67ac76a68bd6b6bd827

SHA1
118387430c4b592aeabb8cf3181c815e0fe3a709

SHA256
5ed3494a9cc0da13cf6aa822d23f2a39904e6e0105145e06075ea0af847e5121

SHA512
d0c93ad2856f9e93170f5f5c86caf4bf14b201a2e9958755849a6951154e04eff62a0a7ea813aabb7d538a6e288c3f322035e50ab38199af10a1bdf079a62a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bd460034cce0271f3a0d464927edd802

SHA1
d0580bb9f84f9f9b200fe564cccbbc711d436a6e

SHA256
f36b1ef00c5d138ba853fbed2dc5bf2a2b292d33e6ee9b73a43085a8c9e0c187

SHA512
919e6d9d05acba8be337a90c30872f2b461b254e86159422bdd1497f384229fd4da63ea47651464091efd6d634506af0474878bb91e6cf36c5152d0491a58f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d5876849df2de73a78a5872365298dc0

SHA1
5c602dadd4ce719aa2d6fd7147f3c8bf5ceb7e76

SHA256
d6c69524002ebfdfd596f84771e363b1b934f70bf4ad8f676be9fee1449a4732

SHA512
4d47ed6c359ce4be4d9e64406fdb07eadd5729cd69a08e788be8351df402784e66e5bf0c6c9afbbaecb573bbae470c4bbbda28c690fc63e9204f3355cc608424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
633de9cc3c326c0d029f92ab320e65aa

SHA1
2a4af2e53d65556666d8c565c560169b7569dc7a

SHA256
c24fea948aa5982278eb7a2a24f82e9dad3382c2d09504e789753aba84f35c33

SHA512
0ba1d7cd53fec5c6a1aae4daad2f2a81f565ebcbe500c62a6fd8380d7989d68220ef4a27db8c3a700689d6ca4e4f8e89d433ad517bf58031e0dc0e91831eaddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
483f4b87d10daffbb3c9d2c68e7a26dd

SHA1
75f662ef866fb26bd1362b3f712c4e4b570f5764

SHA256
649078096a9c8e726afa9d9fd1e64b3922ca00e99f6bbd0d63152762be7865f5

SHA512
b49376fad13a969d2f8389e7d84c6ae778d18baab89d01e5dd24b7759a76beaf1b4c4eee7882648e430d088328c7af05fd17d28fe4a863fbf462d7b28fb06a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
285b99cb002342cf4e4addcb20b72606

SHA1
9b9b62c29b03c66720138412a7a0042741240ad3

SHA256
f047d3200d0af2719d2c2be9c3b21d33113d4a979008b446c6f6529a8a3822d2

SHA512
27b11ebeb6363c205cc7f29e28ad9fb0df849a6ee41b2e03b587b3eaaebe997f7893e504662e8f270049b7bbbce7a6e47396594282e180ad40a97224868c5bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24553d348fb8bed3a37f08d441c59b3c

SHA1
4fed07423535935afb046160aa0bc4c5ce0f41b0

SHA256
10edef2cd43885590f3f94d78c4901e75c4bcfb84be5c9b838e49a9570b79406

SHA512
2cb09ab0c4eed505248bbb9ec17ab1006da546020d57c0f71cf2d0fca95f675fa0b0209b2f83c01ce7e6aa71172fd794d49ec12c3273db42d4529448d4924a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
650d2af94ddd7d0b02b479fe1ff2b572

SHA1
183c8b0f1b980d7f919671ee063d977c07cf91b2

SHA256
903f1da2c0057a2032115230c24322921c9083533c42c9290ec04b95603434c9

SHA512
b6b0562b6238758bc712c78c2356aebd143de7a7a921672cf19ac88d616ecd86261ea57e4432bed5394738e95b46e8f10d4409e8bfff3ce4a7dec480c125b54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc514172843f1bb389289a7d021c3287

SHA1
3850737948e8ff10fa531df6059b699a04fd93eb

SHA256
fe6d7ed4640263f03e4ae61537ebbf01c6c9427dab92528cc4a42c934b3d7f62

SHA512
fcc894871ca73f0fb66934fe3d16ffa4336532bd6d21764c55e30acaae8ea13a99f219c85b2f7cc5a144b9b95cb2404c93efeff48964a18f89268a73f23e25e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4b440268de91b65e1f357087a34e687

SHA1
cbe7c77d8132abcf6f4cdb2e77c0f451870559cf

SHA256
6a6e219fbb4c3dc92ec9cf07b64268d9f8b94dfea97d56471b692af28b009eb2

SHA512
c7869fbaa59bc2614f7e4efb865a8a97ecd64231ad3c291dc1dfc819f5618e386a411f01c2f7996dc08b457da0ea941519731fcd550184db463c155bbf65dfb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584bf8.TMP

Filesize
1KB

MD5
ef60831782240ff8445c8e29c6c59924

SHA1
59a6a287e58d022b1a938e7b455fb306345b253b

SHA256
443d88ea95168f3623112b21c1174514385d870c8dadf646f5d9f01b3e5f6712

SHA512
8493f1b616aab87219a08f10a7c15eb19aaa1bc91626b300f8cdbf327d5f08048ac7674b13f145bd7dfd01f0928a3937975d1fcfca21a4f910ff4b9f28c0f1b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84a3f4743e7db0fcbdcfc70b98a18693

SHA1
25d931b26f4a39b22387c86b9f8773caa4c73579

SHA256
efb4a6595d2737d5539d4726173f1f535ca06cb4fcad4090d34c6b22386514b0

SHA512
dbeba6b77a2fb628c11ed3ed4aed36fa90d229950507297ceebeb935dbc2d50641ea2449d8d81ceff356149720ab3912f7f7663e2ea41fb962e46edad023fb8e

Download Submit