b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
Size

894KB
MD5

a8df8179730a97675c47db4fcc0dc789
SHA1

87cb3179503cae8548ae71f6d10bfff211779254
SHA256

b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3
SHA512

a30691f79cc611bf66fd03a9892ff41072e30e5e898d08daa4eefd3f26ca0cf3a06cc0e6cd3dfcd3bbc6643435e072b3b4e5ce6259082b5d70ee8be2056edc35
SSDEEP

12288:GqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Tz:GqDEvCTbMWu7rQYlBQcBiT6rprG8aAz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1096	msedge.exe
1096	msedge.exe
948	msedge.exe
948	msedge.exe
2600	msedge.exe
2600	msedge.exe
4956	identity_helper.exe
4956	identity_helper.exe
416	msedge.exe
416	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 948	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	78
PID 2184 wrote to memory of 948	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	78
PID 948 wrote to memory of 2552	948	msedge.exe	81
PID 948 wrote to memory of 2552	948	msedge.exe	81
PID 2184 wrote to memory of 868	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	82
PID 2184 wrote to memory of 868	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	82
PID 868 wrote to memory of 4576	868	msedge.exe	83
PID 868 wrote to memory of 4576	868	msedge.exe	83
PID 2184 wrote to memory of 1828	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	84
PID 2184 wrote to memory of 1828	2184	b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe	84
PID 1828 wrote to memory of 4808	1828	msedge.exe	85
PID 1828 wrote to memory of 4808	1828	msedge.exe	85
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 1980	948	msedge.exe	87
PID 948 wrote to memory of 1980	948	msedge.exe	87
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88
PID 948 wrote to memory of 3932	948	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe
"C:\Users\Admin\AppData\Local\Temp\b8c38f7109da67fab663340401cbec4bec7e8a45ec2e4cb49e8b589ebe9115f3.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b7593cb8,0x7ff9b7593cc8,0x7ff9b7593cd8
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17190743349773698727,2423169308597612613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5096 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff9b7593cb8,0x7ff9b7593cc8,0x7ff9b7593cd8
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12021101234846397604,10910126281686081714,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,12021101234846397604,10910126281686081714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b7593cb8,0x7ff9b7593cc8,0x7ff9b7593cd8
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,9343581642639788425,18309044605761779995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df879155e58b96a9a083436d00925772

SHA1
a07b71807640a130c2ab9da1db0e9b9b15cc074a

SHA256
ac335bcdf5174b8c75bf33dbbfe9cdd59c0fb559415944b48d4ca14181323198

SHA512
caf0ad26b0d2626226a0b6f8fab0b80284ec8dc86c46b750d92443ae2c78b5a8159fb712acf3aeff1717a6b5bf5a6bbcb79a9b4955501909c56dacac5eed942d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f1ee5dd52dcff372ee577e0c4d6ae2f

SHA1
c42db55f4d60f1380dbc954fe46a9ef5cfa02df4

SHA256
67fdb353aff067b0bb04923a2b9b7e3636f95a0969fd917b07fb9d75b50d4e98

SHA512
cae65bf524874cc3fea37499c8bbfaa0878181fca262e4973891f5fe66323943c40e0b48c0178f2e5db69191600630fbddd5cedde0f6bbdc87da587dfb519241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7de9c5b068ae5fd2c67d301401cec90e

SHA1
84e2ca046d85411bd4c32219555129d3ac5d9c16

SHA256
514795839a2a71bb35549c8700c8c1e0bb6825573c49939d6f08aa1e85456329

SHA512
ab642c0329c22f2eae51fa135885fb8da475de61a43a103c0c452e56639b8489af31e9506076f9c03c637d904593b53347410e192c4a06b0fcaf3e3290c15439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5982716234fdbcc32d8dd4182d318261

SHA1
e0fa8b90c18489734089e65c157260fb4c361dc5

SHA256
15fcb342dd9d320ec37110300d0528d9cfe3dd05547f882001e3486db38ee67e

SHA512
d79b380798175d88991ca0b59c4e7e52c4341dafaec3411503cd819a9ca7a3d5612233d1835f2d4eaa3082d302fe95717a363e76f2756be5947b1bbe8539940b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55f18973e96bb0c04ecc5ceda3681ff6

SHA1
ac687e0310728b8e5eb491c02595ca36aecfc211

SHA256
1fcc2492a19f4de458d0439aa5414950fde584f854ef28baa47de5f94e55f184

SHA512
fdef8506ad5eec13bd5418ea717e062f3f520fb41ed0f97722121a8cdb0e6fa911d3d25a1b65a93f3ca3600d0e7c5ca0faa57c62cfd25eb9b493f098dbf0f4d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5e760ceddf586e23255e67a5da991b50

SHA1
11729496dbd5e29d075ac0cb1358e81a13ab90ea

SHA256
a888e1c7f1c1e664c7b82cf2289204c8e9b7c5a1e0e9b549b5ae4cc31e0a7b29

SHA512
d037a0b397e3faa8bc342bd19b00c38f027fadc89a8b9064e778e7c8e8bae975ee4765eec611e9f326c4311e8e33f4eba5485b14df714ea2dd0db84487deb8dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
888e30a4a2121467990eaa4caebfb9a3

SHA1
ffff4e7ef0990da9dc10218d34f1e520fc77f197

SHA256
b72bc270b5f8cac0d726cdaeb408332f7d4959ccc23559d958778636751ad26f

SHA512
e2b52d60d18cee2630a9bae2754f1dfdb8b1203f6a95beb823c6eaa0624ede0620a2eda5d47ae4b09a4898cd80b04ddd92cf02fec0cd4429d0933e91e046f86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
9e275a469050efd21a8d119cf2668cb8

SHA1
dded995df89c91d1b070816ea5eb3a005a4eae03

SHA256
54250f1386147b4f5eaa2f2624f458dfacb8188285defc5e0bd814e46b2d6708

SHA512
70c41e2b96d15b6c8681acdb778b03f82157500aff687ed77cc11e074fee26f103b74bfd0fe038991f50db11b106d9328cc71b8f927ed2f7f0f84bff2ca3fb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
46838a8955da1528c5f8e80ddd3e12f1

SHA1
70520064d11ec328524037d9bf24bdb4a4cc0c4d

SHA256
7438694719b2c262a1b8fbe0e93c785d074371d664234f1afbc7be2605035f99

SHA512
1f7ae0a3079503226290b041e34030f6e152b514d0458d671b2c41698cd304fe88218c5027b714dc7cb0d63f2480d63568b4a5e8aa6e81db1c87f467e7845d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c8ed.TMP

Filesize
539B

MD5
61147c9e7e7aab70452f0381ea7ddf88

SHA1
a4e688d0701bb785a64fac064a353541b15aae23

SHA256
2f860b84264b3da3fe6317297148227e222407ff737ea4d208a31aea746588d9

SHA512
2e3162210de48f1576cb6ef8f95a81775b38ea9460265a9c614133eefca939f4d440d0df0a455123590bf26f91ec6309c2b73b18f8dfc6a5bec9d620f7723e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1deb0deca9a45adcdae787bacb57cde6

SHA1
81aac140ec14ef7a375430850e170aa21d48a168

SHA256
dcbc800bc3f9d6ca18653abdcdeea8e3c120d4fc9a1514043236093553047b2b

SHA512
d30daea0c861f5c34ad12a0a0c38334dc105d086abf113b42c36973f93f6be100b7940c2724f2c9fec195bff84b0bf786e93633fa69f6f4d60ce977bb8d1695b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a818e1edf027ed3b42afb5413ac557e6

SHA1
ab94d16420dd704ada121329e1f13e0dbaf817c6

SHA256
edca74df801523f4775912f57af40bef80c630c7e767e628e6b4f7629f6cdad2

SHA512
059b7774c5d6ca9a30ebd8256d5b73f5b708b6fc15acd87e758490106ea257c97b54831f0154f10f377e8c7448b56a23e16179e7d782947d4485eeb0fff1a40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
87239475ba8b8826a8c794054cc1613c

SHA1
e46fa06e208500fcdaa6aa308352f59df1051433

SHA256
1544da8293f9c27fee8d113c8c8570345c29f173862701b5ce929f2d388368c0

SHA512
f563856b4dd52f81047a8fe6cacbd1979c3d487164310df30b5c3da6fb2f4c4bac6b6b15589f155f72bc6c40ca4a7bf7b6c240977632dbf315b6656c94d05b22

Download Submit