66f77d12b7916b578ec759cdfd96e6dfc7e5cf15d7eca3a217a1f482c666b0ff

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
Size 896KB
Sample240510-c6sgvaec4x
SHA256 66f77d12b7916b578ec759cdfd96e6dfc7e5cf15d7eca3a217a1f482c666b0ff
MD5 50c4e10b1bd3177ce3e60746c3645680
SHA1 715982e5cccaee803f79711f8d97eb418a3156eb
SHA512 577f130a539b4e2ca44e369ffc7bcd267d8f0df153e9f1e4e7602e2577407a2f23fbf5624e30966c7204ae36b94a5c415840cc173657392f22443970567995ee
SSDEEP 12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga1T1:sqDEvCTbMWu7rQYlBQcBiT6rprG8ah1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
3252	msedge.exe
3252	msedge.exe
2664	msedge.exe
2664	msedge.exe
384	msedge.exe
384	msedge.exe
5440	identity_helper.exe
5440	identity_helper.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 2664	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	83
PID 4080 wrote to memory of 2664	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	83
PID 2664 wrote to memory of 4964	2664	msedge.exe	85
PID 2664 wrote to memory of 4964	2664	msedge.exe	85
PID 4080 wrote to memory of 4624	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	86
PID 4080 wrote to memory of 4624	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	86
PID 4624 wrote to memory of 964	4624	msedge.exe	87
PID 4624 wrote to memory of 964	4624	msedge.exe	87
PID 4080 wrote to memory of 4024	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	88
PID 4080 wrote to memory of 4024	4080	50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe	88
PID 4024 wrote to memory of 3752	4024	msedge.exe	89
PID 4024 wrote to memory of 3752	4024	msedge.exe	89
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 3536	2664	msedge.exe	90
PID 2664 wrote to memory of 4592	2664	msedge.exe	91
PID 2664 wrote to memory of 4592	2664	msedge.exe	91
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92
PID 4624 wrote to memory of 2572	4624	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50c4e10b1bd3177ce3e60746c3645680_NeikiAnalytics.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e95b46f8,0x7ff8e95b4708,0x7ff8e95b4718
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6867008204616340774,1338534253630734535,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8e95b46f8,0x7ff8e95b4708,0x7ff8e95b4718
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8923083988929237458,8438048514834496984,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8923083988929237458,8438048514834496984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e95b46f8,0x7ff8e95b4708,0x7ff8e95b4718
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,16023317135551082676,6826809114077240517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,16023317135551082676,6826809114077240517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 40f7e053b90eece9c59cc1efd8264064fd0b76b0b35b76142591f9f45ade18c0
MD5 7a09cc52f51ba2be9becda2422bba2a5
SHA1 0cb6c4055da66b38c5f5005e87008d364ef4fcfd
SHA512 6075ed6e4492c4d1438770aab5542385cfd9983079e97d6bb9a9ef885c3f55f6fbf7a075564dc0ac2e012261f98e55db4cb9ed39b5a3a8b1f38b718320d69ac6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 5a1a1b7f01fd9e35dca4372aacad0b1e46762c90e799e45c515cc677c107823a
MD5 63cab324ad59dbabc2e250777b9c9be9
SHA1 3093a89c0284e06792b0aa57bf921bfc1522918c
SHA512 87345d59c499621f7ead13a16de4c8aafbe973a0727cac7c31a62c59c0be39466147d2dc046165ce479af02cf73f45c5996504be18b535370d89a4e9dc7375e9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9993652e525e29463b6b90b476597c94cb0a129833c3cfb709aa3a860ddf7853
MD5 aeba4d13c8c7011de9662ce8f4c7ac87
SHA1 97ae35882ba7af523787db0e5e8bc6705ab1ba9f
SHA512 e4a4694276da4765b409b7030ee3b4f1fa84ed08492fb0f2447b59ed4499dfef443eb6ae10a79ca38e11bf43069d7e9b36995f14f689f8da3d04189db6a6ea98
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5306b7b5ab99fcf756a49110a3ef6ca83f7774bbabf4cff5ce32d0b7e1545e8a
MD5 90c153e5ebd1ea0709dfa2bcf94522af
SHA1 e10fba0d4407a4dbbf954def03d8742e357e4219
SHA512 879937c29a870dfa56c7aaa3e3f6371f99b4010f973fdbd1fd0915270d4361e3f11f03046d08ae55a7ad94fdb93d587be849b81c832f927646d7f88603073255
SSDEEP 96:nXfkHnT41eRLORwpvWMoiVmdeHm0q3WfEUWQyV+VDCziEwb:nXfkHkQ4RGWMXu3WfEro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 42df14d5710e1a663df25b7e70a03261f672ca34149e358503c43e671409a86f
MD5 d153f9e9f2c774e9f8b2fc5d7c4fea21
SHA1 bd46abdd7aed6d1e1e697056ed7ca63b00fd8749
SHA512 5eca86dd1f5cb1937758873350dc010c7ef336b9813e8a648ae1a88306c4c664b61afab1564d2d5bed12ca5dd09088180b70bcd8cd37d604bb9473003dcb4a53
SSDEEP 192:nXfkjkQ4BmML18BpWM81u4SkutqmYuwP2xLh3Wf+rrg:nPjQ4gWZ+x+IE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 bfe2e05f031104696f427970ef3b6e385e635dfacd2bbda738d2bf559bfcbc4d
MD5 d58f6117b649d69426eb15f0b370359a
SHA1 6e861cff025dc9e0e7690f6bb53dea76f2dab4c1
SHA512 6bb9592c72dec4f0b65867cbd0f881c1555a81fa90af6de4d34fa037cce2420d57019e2694ed8a7e9c312d2ab199cf0a65e74c26a9322720c129534a61d32888
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 28bfb94644bb1fbe19d20e68452c14d110faaf54fda1de7996671c7dd4fc93aa
MD5 962ec32b0ad0348601b49795671893a7
SHA1 4092d421e51af73ab89938efb69121ce15e45c02
SHA512 725b18de92033f47af3e2df68f853e08d76fce6d6af4b74ceaf6cfb9fb25b2976669a7853b0d45291ae070516e9028ec664666637724ab2def3b3068925efb34
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 051588a83f70c8c93d87a9d42e63d3257d3b27946ad55d6b0d81a8cda056b7f8
MD5 de53b372c5cdb8117319f8353ef564b8
SHA1 bee0c1d8b402e24191312d3eece53c44ed065328
SHA512 b1e27d3b4ca6e8ae697d87bd764d4d0275fb746fa6e956606a97e0a4551c3fd4289ccd3a5d27a6d13e254e4af8e2d382467d631e62e4b8405a90ba6411ceab26
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 5e27f964b7238e043160eb9c3065b8a56c8ffa06b85f77e153dbee98411a22e3
MD5 0f77024ff9c38799391b5e8a3e234495
SHA1 0f2af51734fc8ce9616445d6f2815aa8fa99afaf
SHA512 0df9d6ab090e0eb7111d3acf47185d1d89d21a88e445341fb9efd95228a6f1bd670e8a3a9686dd6c713e3f9520ec4a7e3f00b19c20cf3a7df1c68347de036af7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a99e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a99e.TMP
Size 707B
SHA256 7525bc69da590048dc6bc8c48a1c7c02bc3d3559284898dc5154336f10bf2770
MD5 725bc85543f11bdacaf1a6896d0cf92a
SHA1 11b9cadeb5379657784cbd39f8d012b0e5f59517
SHA512 97b1a4de5648a2d5d921a80c85e1a25c83c31ac52382b3d1a448ef32800a9ab83a87c9ddff8cef7b9a9d2de685540e9281feb60be90f88cc649f0fc2ba63cbb2
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cab4e326907d5dc8fad66dd5583c9c5ce039e8048bee70c1f9c8cc94816b5f3f
MD5 fca12d86d4daa7f17f2a672163d9ddb7
SHA1 78e5c88dac8dd651856c06a8848211a0ebc560b9
SHA512 2e99c8844adb861a47698d7a9b9b85d71f8f976bfc67e06c695d4769948dfe969016d822f0b5e37114797d7314e82e518fd04a7b5312f55c3365efc8e8c90db6
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdW0Be2RU6M2Xzu3P:69iIxuERzA83h09RZxYVXuP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a316827220c5e5cc1647b26652e403a23f61a908cced5c89410313903a838f7
MD5 3cff8bf3ab6450be0b2c82497f3545a7
SHA1 a0d363cd2319f1ebc2b10003fb4977cb3a18633d
SHA512 02bbd7a33e1e3daa7f2d417d149326a62a6e07cec34b8f82dd2eb8d397ed9367ad9f5494b91afc679c2a722270eb58cf1a81340977c7b266ead3efe6b7867602
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdW0e2RU6yXzuW:69iIxuERzA83h09RZxYFEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fd89083442b0bcc13e3cfeaa81d35bdc9997f56ff1c02b9086517cd2ec281acf
MD5 aeed7008418e57d9e2baca48c1ce9995
SHA1 4d5a0d58368857eb437539a02aa2beee3fc03ebc
SHA512 f6cd3f2c744504e74e3676d85a1f6c1f9866c79aeaa5a6bed40e476fd2343755fa0466d4172132b8f896fc52d0270256723592cd8e69e911b87ad49b5de0a237
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDOiWhe2RUt9dIzuW+Oblfs:A9iIxuERzA83h09RZxYmZz/XDafEBKI+
MD5 SHA1 SHA512 SSDEEP

Submit Download