e3c25873d758df259fadb2cead66db5791861be724fac47b320124a7f91660c4

Resubmissions

12/05/2024, 14:59

240512-scprvsbd6x 3

12/05/2024, 10:49

240512-mwrgxabg4z 6

Analysis

max time kernel
1754s
max time network
1687s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

027.webp
Size

82KB
MD5

260711443c570ce77cda3af52064b38a
SHA1

ce384e4aa3b643af84ef641a98c6859ef8ed86cc
SHA256

e3c25873d758df259fadb2cead66db5791861be724fac47b320124a7f91660c4
SHA512

7f8d2e848a200ec42b64b8a5abc1cc2e4c22dec3624ce1f991d5e74c363bdc132b4e453c2569d0bc6ffa5ecf39c224adf2139f4b024b04850a66893089d386a1
SSDEEP

1536:1KGblhYhaEucC+sXtmjCqWHGa6Urmf8AncZwhvnDA3HKP/kY:gGbl8bu2s9JHGa6UrScZwhvD9/kY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{5EDEE2F2-5761-4F1B-A488-251582D41F59}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
4920	msedge.exe
4920	msedge.exe
3436	identity_helper.exe
3436	identity_helper.exe
2544	msedge.exe
2544	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1152	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4920	1976	cmd.exe	81
PID 1976 wrote to memory of 4920	1976	cmd.exe	81
PID 4920 wrote to memory of 2128	4920	msedge.exe	83
PID 4920 wrote to memory of 2128	4920	msedge.exe	83
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 1496	4920	msedge.exe	84
PID 4920 wrote to memory of 2960	4920	msedge.exe	85
PID 4920 wrote to memory of 2960	4920	msedge.exe	85
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86
PID 4920 wrote to memory of 1832	4920	msedge.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\027.webp
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\027.webp
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6f0146f8,0x7ffc6f014708,0x7ffc6f014718
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1360 /prefetch:1
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15632107228347682428,9757682085772391025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
    3⤵
    PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b90a0d4-5728-4723-acae-f5a552fb327b.tmp

Filesize
4KB

MD5
de3110c66210f1bf9b49ef2ce6213a78

SHA1
becce251920935175a72543d9aa8ed87100c3070

SHA256
08c5f8aba2ba2a0b6a5c9380d8ff92ee50aa8f26c529129c9435587dfc9adf67

SHA512
53920ab0587942b81c51f001453ed5ad7bd3b2bef80499b5410bbcd394b361e3883e19152664f3a61232e119f87df42777002f7051f84c4f0712303638d598ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
850KB

MD5
882a083162121327dc021f0102a8d52f

SHA1
dcfbb725224ac2fd5d10daf38d1b8f0ce2d067c2

SHA256
dba3a0ef9cccfba7e07c0569cb1a448f9c5a96a1089ab8b56ebf1f5f3c0c4c3e

SHA512
76a91264267c2c93f08ef33cb56e0a7c84672f7f0b61f38eba3150829dcf0829ad936395aa889417cdcc4847cbceda7100f514e66b19efcd9a98d5ad91afaa33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
16KB

MD5
48c80c7c28b5b00a8b4ff94a22b72fe3

SHA1
d57303c2ad2fd5cedc5cb20f264a6965a7819cee

SHA256
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

SHA512
c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

Filesize
199KB

MD5
585ac11a4e8628c13c32de68f89f98d6

SHA1
bcea01f9deb8d6711088cb5c344ebd57997839db

SHA256
d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6

SHA512
76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1618baf932d2bb242537111825bbee33

SHA1
1cae0f1e1142c5ee3568e98ce7e3915e3701ee02

SHA256
c79bf24322d33b6915020994da0b5365cea6555000adcbe982015fcf62a624c2

SHA512
982c13aa3b3b7aa2f4f79799cc71900072eef21df3073c00465a6f4f1679159319b0a0f9cadd8e4ea361f5d349d9f8711f03b8cb318168872351ad5d1e779f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a4175f4eb11dd2d254379f5526b56a06

SHA1
d6e668de71b81a0702f46bb623bd0aab9205e7f6

SHA256
0b09005e150a15f72ab1ad6c2a98cd8c376bb5da02ea08f56bc915c19fe986dd

SHA512
21112ab1e025d27e038741ec96f7b3e3d804b91bf534bb7189b250dbed90acdd495ec7259ef4c2fcdeef82c9a4297ddd87211666ac9e6aede5670b7533b361c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a72c17ca1328aff07bf41e3f04b8c03c

SHA1
d81ffa15140a8f09ac873fc01f8a8ec97ec5e5f8

SHA256
2323726a1e929b908b820dbef2f862673a53d832380b39ed9e56874708d71241

SHA512
21b3a3cf8100eac8db13a29d91498e43986a2c1fb793736d9d699cc9a173ee22aa80fc3723693f7f15285cb44a44f1c2c7408082573f6f55527d97e75630aa8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5682c82bda4c42df08d241644f2c8aa7

SHA1
df3748f93c6a38b795db23585a8ecc3ac9dbb254

SHA256
b1d1405421dea57b433968f73610c4e73ee1fafe4846c3ef8f40316a67fad827

SHA512
3bd8579b1f9a3b99b19a5ec64b4f11174e0fc44516d4de98426e7f1a3d0aaac89d7a3e2eeef825d54d7e8954dbd4aa2f4aecd02ae4e9c073e49678761ff4b3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
80da204314157490de1524c8f9ac8099

SHA1
245d8387a489650ffcc3bb4f3d5633e8f5d3fc3b

SHA256
1ac592d29c241ab78ec68fc83b2c359640f4c6e6f5ed664b2e59a893124b4b3c

SHA512
92867635e4171a6a16db0d6863b4736a2a493657e2c9cfa1cc9d3b20aed9877ea5637949c7c854e9c2df7bfc8c8d681e0d2ca0f5e2869320272ad73cabdac034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dfd7b5cefdc298a7e843a002ab62f3f

SHA1
064a0bc10cc05190081d216d7f701395af72a8f9

SHA256
af76caf547347d295d1c23db35dd434a4181b2cd3a18099fc26c9ee4990e0723

SHA512
9bd5b41d831e62dcdd09694e25e1350d3354c6fce78014c82bf43405eb2c18681f12be31f8df055a76c14ba61e0a44857f48d7b6e66a5c5af227a0d40e78884d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f37210eb262697bdc61db238bce9921a

SHA1
ce96842140d2c4cc053f6c042f983b5480152c26

SHA256
a0e59c6eefe44dadb03202da6769edef98f6c0a6bc8f164a56b02183cf5ebe39

SHA512
7788dc4197d492924904b6b63dcbc070b9f6b3f37d9505339e9769dcd273c293a771d004a7cfdbf8fc9863917b313bbdcf8c5893403a0c701c94dc713275aa8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76d6143639b911699c8ba0f348d4cb40

SHA1
e03a5ca6904e059422fd65c764ce1a88821a8514

SHA256
76e4dfcc6dd15fa8faaea9b784f4e4f31ce4225b88ac2dc13174a84f6e8ae433

SHA512
5bdd39f6d559485d060e74f84275f7a8168b9aa2acee0e3ac5bb52db4eab0327d634b609b475a95e4d25989ab6548af83b7210283f1e3e3ab1151a2e99d9d3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dcdce9c24108fed46a5901c93123c15d

SHA1
ae9ad1672b2c5f8f4c49fdb3c4b6c7d423245d66

SHA256
59cf8a3b218d60842b5904db89e23015867e19c651fd70adc8ae08f1db175d8d

SHA512
2a431b0452bfde6fc796d71857f6605c9a76e6bf0e8b17a5432d6871dde79b580d4772a6336434365519df26bfcac02fbc7d7fc31f5a7e433c5773f6937df5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
33d9a0b10e8548228b9bd853879cd43c

SHA1
4b0fd014d7d3b6e55d34705b99177fa9fcf02602

SHA256
57b4fed71dea90497785320118aa26cb6f872aa29d872d9b369cf876f670e767

SHA512
9957059984ed1cb67695d11aecbfc444d57ab423ab67ffd6515413710f1c12237296ce57ba7b3d60d417f97a670c4a3717baf0f271954e9ab1472f809394c896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e4a93f8947e84517543e39f5804ca62

SHA1
985249965ee3715999df2b5528d1b4bcefc662d0

SHA256
bb923194f0a0fa1346a653e5647918252fd55b072c870b71d9da20e819b0b936

SHA512
26e0524d83ae1153f42fccb06b63990be35167e87a07f48e1ec903c186697108dfd376b7686c3def111f5c473148afbe922349a5e0bb6f6bf6d460167a116a4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b64f0abf4575cc79a5f3db4b08e07840

SHA1
9fa2e339a77d4c206ea7713bf07c21aa48ba9fae

SHA256
a3acca36bcfb1279e45aa6092f23a66113cbe5ad6136378bae7f191dec6edc90

SHA512
bfc88c4bd7fd2b3e1c3761f4aa3d163d8dee97925ef231b013632ff4e3f51a5c5b05f521cac8f433358210774417c1feedd1b832cc27a698e5c6426c64de5eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
ffee45326f22c7f1daedc9eefb638e39

SHA1
70e44149f9374499aa924dba77d85ecc774128b9

SHA256
b9241dedfb86f3a69a67dbf646c699ba76ecaa1c92ac08866255cd2b229175eb

SHA512
53ad44a2986aca67a927bc0d2cef4be77ed0dcd2a39f968b90af7247297c60fd464d42a4ab6d2d60d5dc7c542430d553ffca356a8e5c4a4a31ebd6c726f06f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e8c5.TMP

Filesize
48B

MD5
6cd1b01d81527926a0844c037f59c601

SHA1
f823b527241fa36593740d952ca2699e8fd351ac

SHA256
3a0cb7ed21ae881a1d3736fe38e94fabbed15472feddb0c9895317d2ff94e0cb

SHA512
8fa5bead0db7325de3f524f4d2b238d90a97e5a48850f0cf6c1e92df577be06d6d963b2a40211f89c0b9d5c9df295c9b53392ca264209c826db2b180663c053d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0f6b771cfae8cccbfee3b7f6ecc9168

SHA1
566c096c791b671b0cd32ee4ad4f377e2ead5855

SHA256
094f26ef46d340706c2d689926cdb3e88f0786cdcc01a5705d80e76fbaac7ab8

SHA512
7563c8adb311d4b634388469410d85538ed9f58a9a29b2ca283efba06d35f4f06db219deed3795961478d94bf7bb1d60393b3a4f865e44c83868b864f9105efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e3da9e85f446527758b8a5d7fed66000

SHA1
9512e7bfb7009771a83b523b66a6358b2cc28634

SHA256
53afaaa8113e79a936b8081fce94dabcd5750d8b65dd6f981ed0bbf114c67211

SHA512
6891f3e9f608c5c8e15f471095d8297a0574581f1c925e0e4acf639b6547c899626412486bf7961c1235836bf7f25100c88af4787179bd33fbe25f7765d31484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
14c322dc0ec1a2c84903c7ebef5a3f97

SHA1
a0a514f895a31f3457656d53dfe939db96e98d4b

SHA256
d36b03f3184a20a046d2d0466941b4b0ca869dc484a76ee0a3165dd43070c488

SHA512
229f968204c9237b145ca9a0c3502a031dbf299f4bf8ad02624ceeee6de3d5d76914d93a1341ff335544a5236131879581835efccded9c3645b479692bba7def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a29de02155125219fd6513cb084a795f

SHA1
ce46eb40bbe84d57d5ffa867a1d523eafa80ab85

SHA256
6989094da3e29a4b31156359bf99fab5c8a717f269752991522885907fcb2cc9

SHA512
a8d34bac547adac8603f95890a1b47e591ae3c6d9b94043b5b5ee542487a1f424f686088c103ce9631ee4fc084a7f54d06c7255c89e091b677379277ffc773ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7187e2639e9bfc78423ce1b56685cb7a

SHA1
34db9325fcd9e314762aebb2d065698f6ecb3483

SHA256
22b72d89fe7e6c39c153e1787493239bb9de32e98b38c7b0c2d384bbae1aa6b4

SHA512
e545545020820bc7898a567c718e1d00bfd0f307de4892ec34ee32be2ac5ce3c19bf41d921a42c1eb53a4e4b78122cb8b86920990465372250b53da93530e2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83407fc33b5f483b079cb0d1773c6eae

SHA1
8527982fd58030d2089bb85bcb1c9efc24426693

SHA256
a129eb667aa165c6fcf7aaccdb3e6cbef048ac50f7497a0f5e5afeb232437f25

SHA512
bc637450aef0397a87af6b6366b48cf5ea8167d281ca5331c9b2d473b46e49a0ad5ed61dbd14971e623550072fc483a54f89fc7acb40c12bed1acd05ca81e896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bc85.TMP

Filesize
1KB

MD5
3cef196e7cb032dfa0996c2bea087b78

SHA1
d965ab2d0039d192a6fa9adbd0a1b167076a5a96

SHA256
368f7da197042bd5b42e8b7f0cae063d1e942eef843990b6cc6a87672fe9be7f

SHA512
02c274b017285740a0861bee04cef653d8c6cbfc93af58f712201f860e758033ffd67c845d4aade440b270f720353be107e12a0fa23805c967f1a4499f0ff91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47d2385fd95f63ad416d07cf47af2933

SHA1
6bea203d32ec8529c268bac43ece133be641cd08

SHA256
23e01e020889ba500f20c446e3ed52c0f87b42d75b84dd61d7740c995aa6c026

SHA512
1f2b28b24e70aa66e9626b3914b05a9e46f3231cebaa10e84d0223600afeb7b6493752841b0a6a73e500cf4768cd8d0dec7142977fc1275da5139a9aaadafa45

Download Submit