dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
Size

894KB
MD5

36dee2205e405d97287e8f0d13d9f4e0
SHA1

76513e265cc8f630548853b5852911b340616c18
SHA256

dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c
SHA512

33b43092354b3e09165f1111701b95678a8c9e1245d0b52566867fcb8eafe81cec26240628e7af3bc9d9f50d17376118596135c33e0a8b48c7aba65cf3e27a2e
SSDEEP

12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4T7:vqDEvCTbMWu7rQYlBQcBiT6rprG8aA7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
60	msedge.exe
60	msedge.exe
4736	msedge.exe
4736	msedge.exe
2084	msedge.exe
2084	msedge.exe
5268	identity_helper.exe
5268	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 216	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	83
PID 4680 wrote to memory of 216	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	83
PID 216 wrote to memory of 3924	216	msedge.exe	85
PID 216 wrote to memory of 3924	216	msedge.exe	85
PID 4680 wrote to memory of 4736	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	86
PID 4680 wrote to memory of 4736	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	86
PID 4736 wrote to memory of 4776	4736	msedge.exe	87
PID 4736 wrote to memory of 4776	4736	msedge.exe	87
PID 4680 wrote to memory of 3040	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	88
PID 4680 wrote to memory of 3040	4680	dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe	88
PID 3040 wrote to memory of 4276	3040	msedge.exe	89
PID 3040 wrote to memory of 4276	3040	msedge.exe	89
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 4556	216	msedge.exe	90
PID 216 wrote to memory of 60	216	msedge.exe	91
PID 216 wrote to memory of 60	216	msedge.exe	91
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92
PID 4736 wrote to memory of 4868	4736	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe
"C:\Users\Admin\AppData\Local\Temp\dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa75d046f8,0x7ffa75d04708,0x7ffa75d04718
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13649677845052928796,4537188878709879184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13649677845052928796,4537188878709879184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa75d046f8,0x7ffa75d04708,0x7ffa75d04718
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2333214119254815526,12489188889953918490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa75d046f8,0x7ffa75d04708,0x7ffa75d04718
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4406998616278368709,2437375823383065019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b75868fd8a82327b5cdd64e63d2d292a

SHA1
33c2c9b1b567b9fdfb12a46efbb2c3ae5c73d64b

SHA256
461269067f933ec5048e71fd3dc6ac5057f5a814de04c539d33894ca33850c15

SHA512
ce4a161c9107d44c369dc6e6f4f14a25370e53083ab0a55a8e3836c518a8c7f4110737c1dc87388366c9790b52f53eb21ad1ccfbf2a4dd9d8e0f7d6cb59a6eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c29a4f4b7e76dcea644425ff0e9b9c00

SHA1
6077789a334cdda691216c938fc8b58c88fab4c7

SHA256
83600e2d029119a400262e715d1ce356302637c6f8c27c7ccc03d669b962cf04

SHA512
71837285cead5d74750939190489bec5a8ee54f6d64efc08e0f00e975fcd1533ae9d3e66ae1f007f34df4b66a300f1bc89507d61b2d6e99b2e8ed695cc54e243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
be5bb56f30554f429d41cbcdef3862a5

SHA1
b08166b4afa2b3c18d774796f687cc0980ffde18

SHA256
091d167f3cb24f65e09bf40cebc864412f986f6d29bfa75f4bd3300945ffa270

SHA512
b032ce1624395df91abf932b374749c214a3f847fd47916021e8c2a40d855398029587c2fd3daf2f0aa38f57e47b19d2fc99bbac30ae4fd2e1451e79d1fdb47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c821689fd29f63042c1c8555bdeae2be

SHA1
38471dce8aa97b62245bc5c0d6eb67cc8c7bb021

SHA256
6a18d0668ce579667fb1822e8b07297d30c4da9e103beb99c364fea6f1f38919

SHA512
4f7dd0f7027594d4eb7648dc65d9fcc31245b6e08d8cba05ae4f64ee9f5d189685bcb18de57476e11bc0ac01456830af1f073b1d5d990f16bdf9614e008b91c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
60705721624c56087b88c00d1772c7da

SHA1
db4a33e636a7c235c5d75970d6a6e67333f03bc8

SHA256
d8f5879fb46be0b70ddb425bf09416359353b107464f99478b78302dd755a862

SHA512
ffcb367ce2f665108c8320186e8628f99a8b5a4af1574204e69c613602a906dc4cb016108d6c0d75baa79361235b215b0cc17a873601ec885ae22867751d3cd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
38a35eb1585d2a0ccfb1e53e3708d179

SHA1
83b02f30f12622155daa94005924638ea16e5379

SHA256
1875ca4445e3567819f3928b1717a6c408cda2e9e74c7d36712eebeda8550c4c

SHA512
02022817d9c085f0112b59a55930b90dac798e75c19493b060cbde96ab448c90513ffb0297222d152a464997113084073e0ca31a58367208d4464a8314816e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5a576fecc6750bb599f833283d595342

SHA1
c3bd2f68f625dd9e119d9604d8d32db9343e02cf

SHA256
1eaacf4e1f4d7b57d5f2d5a1aacb814bf12a91abbee3a9d29aae60f64e7fe605

SHA512
ba4b4cd4ca406b12924d34cf9072312c72431622076f265bdeb1c95096ee1755adcebdba53219bcd983f201c11b8cfb9aa17f7d37819ac70ac6e5e9df1f13365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
70f0a19c9e669eb09f1974a0ec710004

SHA1
3970e332f389bac95595cc1dae7889b943dd43e5

SHA256
7a0ff6fa54ac1efde402a4d662741ac7e48d884449ac92d938d03e6c0801bd4f

SHA512
bf46c37623546cce885ecad8e10bff9edadf9804b65a4e16f2ae76934a3f1dd1b96d7f08030d5add0d7ac7849a5e1ac2653d2916b2e5a2e119fca5aab2c70280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
7d9c20b73391aa10957e63822f1efe8b

SHA1
e84caa29b9eb4ec0290dc04e401c0681db1eb85f

SHA256
66353b89699d19906a29644a56f6108f51708bf0c0fc4b138d39e7c8f9d7e738

SHA512
6bb166097e3d9ee5892d0348ae62cd1fbb0c105599fe807c445a44136944874c4908b2921cc807528794fe3edc68ea7090f969e0a54c5455b65f8e14e1792253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a98e.TMP

Filesize
539B

MD5
b1ef8cedd7478afbe09e57020aa7df8f

SHA1
c653da6b11a8ab7d0986111ea8bb4f8ecfd7e999

SHA256
a61010d43e96adaec4c0e6d66d632846b579b99634f4b813f720bd911fe41f8d

SHA512
eb31598e063ef03a4af282091d8c425483fe4d36cced3dd0b4ea4006b69047527ab8317afddc91f0d252002a469aebcca2be2361acd7d4ad00c8336309fa784c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19c3cde801694541a1fbebc73a96c649

SHA1
5ed63802441b9f5caf69d9f01b3ea0d3b4f652ed

SHA256
56b0c67243148f7b7c4b57a9331a72a614ccfd97073eb39e3702a00bf42074dd

SHA512
a268e572ff65f9677548c3fd391ba81f2792cfb56f3de6b10f414c0694fbef2fcf925dbec0dd780e0f2fc56f64598c8aa3264dd0bea0922fea67230491d17840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
266bcbeb645d8802867d213554667130

SHA1
5e6b3abf1f75377a6685f02bebb706d0593ccfac

SHA256
1f526806a828a6a2954a237128d2c01be33c068e2eaa02c15c5f17afe937d257

SHA512
315897fd3f25a254d4c309b363752f446cf710687b801aa58377e8d271a117f8d044d304bda276f44e0b5f53cb9c96c345676df06e7aef42253e7013a9a7ac9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
cdc5bbc698c5fc868066c4e82b10416e

SHA1
2e274126ee657aadfb6a2d20a7be0668cb6e29dc

SHA256
7fb53e3ab2e1785f5bf61f4d533460885d005e5e3c645cefee6b921ac70ae031

SHA512
a06b4488c5f2d8adbc1ba544d402bbf868736a05c5da677158d79bf90d061e2ca7fd7e47c79613435346858d3107baef8b844e4aeaecd002b125d236b2b2c981

Download Submit