5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
Size 894KB
Sample240531-bmtecsaf44
SHA256 5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0
MD5 81acc494db42cf18906782c25f12c608
SHA1 7df79e3a2dfa5e232a7bfb1090dc62fb669df075
SHA512 efb1c41ae5d34dd710e44e1d46885ec42119f6475325d6d047a949825942db2106b72c2f50599b823e70f9e8a6ceddfb2300c447a5387a10f7ce0c7c842daa28
SSDEEP 12288:lqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaMTD:lqDEvCTbMWu7rQYlBQcBiT6rprG8acD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
4532	msedge.exe
4532	msedge.exe
1396	msedge.exe
1396	msedge.exe
4876	msedge.exe
4876	msedge.exe
5428	identity_helper.exe
5428	identity_helper.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1396	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	83
PID 224 wrote to memory of 1396	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	83
PID 1396 wrote to memory of 3004	1396	msedge.exe	85
PID 1396 wrote to memory of 3004	1396	msedge.exe	85
PID 224 wrote to memory of 2624	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	86
PID 224 wrote to memory of 2624	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	86
PID 2624 wrote to memory of 608	2624	msedge.exe	87
PID 2624 wrote to memory of 608	2624	msedge.exe	87
PID 224 wrote to memory of 2512	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	88
PID 224 wrote to memory of 2512	224	5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe	88
PID 2512 wrote to memory of 4192	2512	msedge.exe	89
PID 2512 wrote to memory of 4192	2512	msedge.exe	89
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 4744	1396	msedge.exe	90
PID 1396 wrote to memory of 2228	1396	msedge.exe	91
PID 1396 wrote to memory of 2228	1396	msedge.exe	91
PID 1396 wrote to memory of 1808	1396	msedge.exe	92
PID 1396 wrote to memory of 1808	1396	msedge.exe	92
PID 2624 wrote to memory of 396	2624	msedge.exe	93
PID 2624 wrote to memory of 396	2624	msedge.exe	93
PID 1396 wrote to memory of 1808	1396	msedge.exe	92
PID 2624 wrote to memory of 396	2624	msedge.exe	93
PID 1396 wrote to memory of 1808	1396	msedge.exe	92
PID 2624 wrote to memory of 396	2624	msedge.exe	93
PID 1396 wrote to memory of 1808	1396	msedge.exe	92
PID 2624 wrote to memory of 396	2624	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe
"C:\Users\Admin\AppData\Local\Temp\5b5e5de9aa63a988a1be1236f231512975b249c566118467d9223c0b013008c0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a86b46f8,0x7ff9a86b4708,0x7ff9a86b4718
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,13088639506653671619,898125703575956068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9a86b46f8,0x7ff9a86b4708,0x7ff9a86b4718
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,12711899069021515563,12231386146027746202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,12711899069021515563,12231386146027746202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9a86b46f8,0x7ff9a86b4708,0x7ff9a86b4718
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8904822650898227783,11504895628886100271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8904822650898227783,11504895628886100271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 288afefe6e825a0ed1a37262afd8de8bb30ff5e1d2333b61a04ccfd3db0cb7d3
MD5 10d22e183bad8610d5d981012555d267
SHA1 9cef52e26b4610176bd8aab9d106fc0fa0ae9612
SHA512 2a69d261a766b063e2a4606cae5279d61fe5e80f64cfa8ad2b41a8fc703a8c7c1d0d086fb7387346757262d2788e00cdac51d4dd12a9c9446d4901f89d2f6868
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 011445c156a106c4160672aeb963561e18219db8990680586b0bd4933b0277ff
MD5 f4e7919357bcf1a9ca2dd9449e25dcb6
SHA1 5aa66ae0c6b7baaa0780a82fb4aaa617d20701d2
SHA512 62e842412cbcbcc83c0f16b0a37c2b6a4213e42826fb23f9f9171378f9fde4c16c96325e96afb7381c2466f2de81ff3337c8607fd6a9db3bd96526a46e30e512
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 753fcf03d607e0e88d0227beb51be001f6fcb11c481024f3c882466f10a2bc53
MD5 6dcd5adfa5c5581736647e118d723dab
SHA1 aeec80cd501b5a8b8da29ca5e962a435f73a32ba
SHA512 6c52ced58c132756c6f7652ecbd4475f007e50da75eca0d65315a4f423b8ccf7bf5f4043c3cdd83e867cd5570ad19b61896cb17479d34ecb4f10860ff5a60f15
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1dd8013e036378ce71b45e367d466b6d0992031160d0c01d13446e4731ac5589
MD5 7db352f893d602b0f355d00e87408ce7
SHA1 fda94ab9cc8a61f5e0f5eb8bbf7925e3a843b524
SHA512 4bdfd661bfd6ad960aaaa8bd2d42dbf7290eedd1b0796f61c6a0c66fc23788eaa147049eddd32cc9f2f786ede0910d16f47e6d8ac0fb5b214f1f97ff6f7495e3
SSDEEP 96:nFkvl1U4juwpvWMoiVmdeHvSS8WsqUWQyV+VDCziEwb:nFkdu4juGWMXuWtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 fe5595924c0e80195c2123281f1699989447ba27c98ad0ec22a85e94857373b6
MD5 7876388312fef30fa913629647ab6fe2
SHA1 9d8f13d6f2698d35e6b8287a960b31d8de4af146
SHA512 edcfda9e4cb5b87a6c28be532f4221a3137b5b15ddead07d744e844bcaa9d05974b65b2c31e5ffbe62d2a69c9fcc78a47b41c2a9fd61379b5f0df1c515b445e0
SSDEEP 96:nFkjl1UojuwpapCCCCWMoiVmdeGuK1x5YuE91ou81xxvSt38WsqUWQyV+VD7AiEc:nFkZuojujECFWMWuKyuEWu8zxPWtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 5c778af6d44c776edeee87314527fc00f833373850239f00196a53410c91248a
MD5 1e9fbc86f270bf4cc9319a11e8c43fc3
SHA1 383675b9b28464040b2ff00a2730ab9222153565
SHA512 d3313a213af5f3f1d6a9f18b759a1c1153e496fbd60a8cf8c2c3be61fea19df8cc1d4c85675006546087779611905976ae2e4d30443b9fcd1a6bfe6c58b95a81
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 c105cbd58d39d83867ad1567ee22a2117b0980c40a111c94bc269b130e47ba32
MD5 3b3e003a4f9d95236abf2ee161943d4d
SHA1 2263dd0016edc722814d8de836baf519c6b79c99
SHA512 af5b74d13e330d2608b36b28f1f2c48a6f5d4a64b6690f8cb44e782847a54befdc460b62aba0234b0a60e0ddc654907567a0a239033d7b4b6acf8b5649cfbb7b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 5f305a12b37a136592c3e923005cc49c20efdb0f530b97bb260fd3122322bb85
MD5 917b0b66a2395c6b094c4c462805d5be
SHA1 9aa0390ab04323c9563f17468c4de1db689ec967
SHA512 25799b6d0f2883f24f9f7d869024176da276a068e7c16c9ea6868b1d0a7669d00e91470a3b6860fec1a4aa97954bda5754dd130fcf26dc665fe6ac9d659aa2ce
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 02c244a0da7a35249364df00ef8a699223164073e075df91f1bbba55183aa529
MD5 70b3488667028249e44eb374564b7a73
SHA1 8146652504eae88b6fd223117072e22dc571787d
SHA512 8100e5af17a78fbd8c5570a18710ad1fe1a20f838b24795c67f81ade4e0a2a99c93500e617f372d03ec47f8ffbb42c9ab61bce96f4973e44915f08f21d18afab
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a587.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a587.TMP
Size 707B
SHA256 114a6dc4d1cee2dafadc68820153afffbfa193491426df343c60b4f49b9352f2
MD5 c6d2de6ab6834ed1be950d96a146af16
SHA1 ba11de9e15c905b775c997e10fd5c4bd5e5e2a2b
SHA512 12ddbf4d969690f5a53394760d33044e3ab69d34fa77f15cc5919cd3618a29e06b70f8f107b845bdb6b1a5a86c64810f5cf4c281321569fb240ea9fb050ecda7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42488c802d6378d4d216f14753af6a5a742cfdca8d102d938283c530a8609f87
MD5 f2f967dc263e1bf4f719aa0aa5c56cd4
SHA1 6d828841e2f108f81cd48554dadf81bd496c929b
SHA512 2bce9b4ed91e817020e864ac8340e8dec4ccf56f9f8d5fc67fdeafa2df4ccffa144d133b23a7c1c16fb8bb655f88fb9b1a0d01ca0e3ac6dc5830f5c40611d63d
SSDEEP 192:koCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiWe2RUl4uf:E9iIxuERzA83h09RZxYi46f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fadc88429616f698910c53c8441fe36640038eee69221acb790274b36e9b0b2d
MD5 a2647238e36934224548810d04dfa9cf
SHA1 495b0778aaa2241a141565742a427f63ebff46ec
SHA512 44a2e0119c6b65c7bf05211202be114cbf41a505d25f3cd93999dd6e581faaa3a606487d50d2e7404fec5cf732cc8b8f9df9fd0b74a2ae6cae53da7f61e6c318
SSDEEP 192:koCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupipe2RU24ug:E9iIxuERzA83h09RZxYi9dg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 949571cb651b0e54738e84e190d3413a88b55ce9b16e33409ce26da5528cffed
MD5 9077aa4dac0b369df4715b8b1a657068
SHA1 f2e9db1883aa06bf9d017a65ed5d77c94329f1ab
SHA512 4da243768f121dd04ca52bc7530a304be07d0329dacfa4c9c6f46cfe9d5a1ef07bcec17f7659c399b360cc202db9c835de8240b6f5b148d04bacfcb3e2474de0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppUde2RUmqul3z2OMDCRHq2:A9iIxuERzA83h09RZxYpU5RlaOMWRHq2
MD5 SHA1 SHA512 SSDEEP

Submit Download