hxxps://plutonium[.]pw

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://plutonium.pw

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 137593.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
4560	msedge.exe
4560	msedge.exe
384	identity_helper.exe
384	identity_helper.exe
4184	msedge.exe
4184	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5680	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3532	4560	msedge.exe	85
PID 4560 wrote to memory of 3532	4560	msedge.exe	85
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 1172	4560	msedge.exe	86
PID 4560 wrote to memory of 3280	4560	msedge.exe	87
PID 4560 wrote to memory of 3280	4560	msedge.exe	87
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88
PID 4560 wrote to memory of 2340	4560	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plutonium.pw
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd329346f8,0x7ffd32934708,0x7ffd32934718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,1778048904435415867,16180974538605422963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Users\Admin\Downloads\plutonium.exe
  "C:\Users\Admin\Downloads\plutonium.exe"
  2⤵
  PID:5340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultae6c18b0h478eh4302ha6c0h40fabd42193e
1⤵
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd329346f8,0x7ffd32934708,0x7ffd32934718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15882898483302867863,8913678178292361284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15882898483302867863,8913678178292361284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2162a8c7h2f05h4202h9fbahcaba90917b27
1⤵
PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd329346f8,0x7ffd32934708,0x7ffd32934718
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16427961818518914775,18122003751935570725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  PID:5828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
0589d249f8ee898559c6e1b30530edc2

SHA1
0f9d56264141a562cc1110a9be33eb82dd01fea6

SHA256
99e0ffb34869dbb781db53463966c90445f710771387128461e3148d5e405362

SHA512
750088fe19ea82e5b86f1dcf1aa1f7ec5e86c814cbb1dbef7df7b4f76a9ca3cb9cd04bb4173beee9c8ecea22b32e713f416f9f59bd880aedf95ee2b654693439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f8faa8264ab11b24610e796493f6829f

SHA1
9c2e5c55afdcb67c60216295524aefb21454dd76

SHA256
b63753635716d649ed5437f512e10b6673ed78ef3de5744758bbebbec0a794c8

SHA512
a7dc99d43a0d07061f856b0d7f765761c393d0f999eba6b822bd26f7c0ccdb668e5ba0ba9145268ff837dfc1e6cdaa8fc6e4adb9b8742ae97f81608c6cae07fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f94d22d07203312925029e1cfc76e613

SHA1
0667666b6d06178e24d81dd7dcdf50752777a38d

SHA256
b0a7fab98afdd397718aca9c9b2936cbf04cea4701140e2bb7946bcc2d84281b

SHA512
a84db6a61af0a92102a6513f57aaa527d9e9c57fa86cf5dacb9755c1cd9a5c8a6f8b92555e4af5b2dfd26092a81d8efd8fd7c04d67e3659c02d448c99c09d8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c45dad692cc48fb01d5bcf326cc99ea0

SHA1
6514fc3950d40f8d84057e8a33ec9f37938effab

SHA256
f1a04cbd03ae7c4264abc877ec7077a8ec4cfebeb97a5a84620caa2e0aa91923

SHA512
a286a6a4be0afe026fa37fe6a5b01835bc617c1ac5d7e42cf54e624475935bd3c5c4982917eb0baff6e68f3b6870abb97cbddba8d6acfbea0c8790621f483509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
662B

MD5
a7570e056b3b87274c78a61ade7763c3

SHA1
ff18888f3da402c92e924098fc451d2fb4144193

SHA256
10543a9c195382787f6b0aa22680e0c59eba368c498953f59cb717f24fb4ba81

SHA512
cca52a2d5b01ecf4055a1e13243cbbfa37d5ac4f904ada3bc38224c46227fe8e660116099a9c1b13be3e8599b37f287506ab31aa43fdccbde2be486248618607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5c50d9ed88a01489768eadba27f3e9d

SHA1
06dd003e6be027ba420c6a9eb07e426a64271ba8

SHA256
ab363df4e914536ca69122bcb579cb91347406dd2b9f293d5c501be88fa2caff

SHA512
3b82cede6e5455ce0657e92b58a1f9f65f633fd2253d015aca96d97e120e448f69e47012a02c1634e2db44be382f2112b149e6ad6e06b5bba71a7bf6df6a0117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae9f2914c48bac3536af604f4ec289b4

SHA1
5996c8ba3860a18896e4e31864465f18783b6af9

SHA256
bd465c892ad95e41d9780d6605f59c6986dff319cdfdd387f33a2a954dda2e2f

SHA512
4530c71c089459bb8837b3ae24b2d040985193285714ab29851e129c6199ce89917d2a8eb75ee735f99c617724066723b6f15730022a3cea2c16690f5ca76d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e38a427932da58f2941bb1275f7c1b52

SHA1
8fe27e7554731a6f2f039027912fea84866fad64

SHA256
f4c13946d07f5666d3eaf95374de0297e982b8645ef902d8a70326c248661021

SHA512
634b5d216a7985193df5e6b0be432a18066085bf6e76d2ca054d4194cb8d41e28a65d75e9d0c04d0cd3aaac047d8ad6c40d89b194d7e7d3c90b56ae3393b6d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ac72b8cbaac131f3504c4558e050267

SHA1
16a6864c074137e9479738b4f2e2e7ce18af8323

SHA256
ed4d2799eacd28300cc2c582b85d54c4082296d129fe2bc3328e30c9189d4f5f

SHA512
75be7c5634b67a03b673956d9f188360d8c3e085d14f19296f2ad03f67391ffdf1a8fb7e908aa3f18b4d30890a329f3e2df29469762a85048ea41f016434d466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e244bcd8c4c1daeb9168af53647c9762

SHA1
41828559994dd79f464ff9cf8e37ddd28adda756

SHA256
c6b5a08208fabef1ca43c40320f8b30f76f71291bca93ebb188b8c48e8fe681d

SHA512
049297c9a02681cb6298882fba64d412007b839a07881f040ff4b45dbb004479f65c0c2cc994dc8c70ff8c3528d9f46d9b25ada03dc5ff270767add5c8f91069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
983aa248a5bd85a4128548c3214dfd01

SHA1
22d437c6992d10230f1e926cc6d5cb2da645f4ba

SHA256
925ba7bb178b28fd5b6209be6f328d76c118824aa9c1078cd390b428fd51d409

SHA512
f1d26956f88077eee3513e31bc5a7ee8e67ebc2caa6617efa7f2add0fe32fa0c150084fec2f1de0ada64ebe77b4c1fbe76c74ab325459186857a4b4fb02d9980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d331f4e17309fb8085bf4d086d74ca8b

SHA1
9f23f436c5d8f442fc8af94b7bdcb797e252e42e

SHA256
a154fa08cba4962ce94c975eda5f9e4601e0a62da3192c7fb00eb7d7e7104a91

SHA512
222b72094ef6e50c3a7f027d3b70a91cd25761deb3bc35014cdadc21b4d83ade9927677b94d28311b4eb42539e129371495148c066f88280d484453329a3a1a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a1034e6009ad7f0295ea60ca0729339

SHA1
d029e8468257541712aa87404f7612e54427bc32

SHA256
2787609b3a084da2a08725708f1623df0be2910e8146c4b58d252667f9161296

SHA512
eb9e637f3709ce27867d2a11abc6677fadbab9f67d4e365368c1d0460acfc604a61762b67304b6951a013e8f18a521e4100fbe4562fc0453cf48466002bc727a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23f24e95986159eb5d752685de8c8fe3

SHA1
68edfab95e6a4c2ea55f60c9e1fd16fef5303fff

SHA256
ebf5377b577719cc18ecf8f844e3d60ab202ea84a2d19a43add217cac8d0d6d8

SHA512
0c02ce424289a3e21baa845f86b1301c3f66377172ccfaa4e03b3036c517edfd898de34f3bd89c75e9af5e0cc03c4897f060f960616412b32cabd3165d2a1349

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 137593.crdownload

Filesize
4.6MB

MD5
72cb7c6d98e9e47274733825c9176679

SHA1
8681469349254c5203a7f9a189833d22a14f5cd9

SHA256
85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f

SHA512
d18d306ca9a311df1a96244ecc67a3e61ffc8b9b465a1301263e11d500cc2f38847e922c57d4a3321196d6ceb32310113d7d790b4dfb2c05c3ff1e2af26dc708

Download Submit
memory/5340-370-0x0000016C42790000-0x0000016C427AA000-memory.dmp

Filesize
104KB

Download
memory/5340-366-0x0000016C27D00000-0x0000016C281A8000-memory.dmp

Filesize
4.7MB

Download
memory/5340-384-0x0000016C43AE0000-0x0000016C43AF6000-memory.dmp

Filesize
88KB

Download
memory/5340-383-0x0000016C438D0000-0x0000016C438D8000-memory.dmp

Filesize
32KB

Download
memory/5340-382-0x0000016C438B0000-0x0000016C438B8000-memory.dmp

Filesize
32KB

Download
memory/5340-381-0x0000016C42D90000-0x0000016C42DB6000-memory.dmp

Filesize
152KB

Download
memory/5340-380-0x0000016C436F0000-0x0000016C43772000-memory.dmp

Filesize
520KB

Download
memory/5340-379-0x0000016C42D50000-0x0000016C42D72000-memory.dmp

Filesize
136KB

Download
memory/5340-378-0x0000016C42D00000-0x0000016C42D50000-memory.dmp

Filesize
320KB

Download
memory/5340-377-0x0000016C42E80000-0x0000016C436E6000-memory.dmp

Filesize
8.4MB

Download
memory/5340-376-0x0000016C42DC0000-0x0000016C42E7A000-memory.dmp

Filesize
744KB

Download
memory/5340-375-0x0000016C42CF0000-0x0000016C42CF8000-memory.dmp

Filesize
32KB

Download
memory/5340-374-0x0000016C42CA0000-0x0000016C42CE2000-memory.dmp

Filesize
264KB

Download
memory/5340-373-0x0000016C42800000-0x0000016C42B6C000-memory.dmp

Filesize
3.4MB

Download
memory/5340-372-0x0000016C285D0000-0x0000016C285DA000-memory.dmp

Filesize
40KB

Download
memory/5340-371-0x0000016C285A0000-0x0000016C285AA000-memory.dmp

Filesize
40KB

Download
memory/5340-369-0x0000016C28570000-0x0000016C2857C000-memory.dmp

Filesize
48KB

Download
memory/5340-368-0x0000016C285B0000-0x0000016C285B8000-memory.dmp

Filesize
32KB

Download
memory/5340-367-0x0000016C426F0000-0x0000016C42770000-memory.dmp

Filesize
512KB

Download
memory/5680-302-0x000001939EE50000-0x000001939EE51000-memory.dmp

Filesize
4KB

Download
memory/5680-303-0x000001939EE40000-0x000001939EE41000-memory.dmp

Filesize
4KB

Download
memory/5680-259-0x0000019396B40000-0x0000019396B50000-memory.dmp

Filesize
64KB

Download
memory/5680-326-0x000001939EF90000-0x000001939EF91000-memory.dmp

Filesize
4KB

Download
memory/5680-325-0x000001939EF90000-0x000001939EF91000-memory.dmp

Filesize
4KB

Download
memory/5680-323-0x000001939EF80000-0x000001939EF81000-memory.dmp

Filesize
4KB

Download
memory/5680-291-0x000001939F200000-0x000001939F201000-memory.dmp

Filesize
4KB

Download
memory/5680-275-0x0000019396C40000-0x0000019396C50000-memory.dmp

Filesize
64KB

Download
memory/5680-311-0x000001939ED80000-0x000001939ED81000-memory.dmp

Filesize
4KB

Download
memory/5680-308-0x000001939EE40000-0x000001939EE41000-memory.dmp

Filesize
4KB

Download
memory/5680-305-0x000001939EE50000-0x000001939EE51000-memory.dmp

Filesize
4KB

Download
memory/5680-327-0x000001939F0A0000-0x000001939F0A1000-memory.dmp

Filesize
4KB

Download
memory/5680-292-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-301-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-300-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-299-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-298-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-297-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-296-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-295-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-294-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download
memory/5680-293-0x000001939F230000-0x000001939F231000-memory.dmp

Filesize
4KB

Download