58cc5757bb129557652797ea92aee701de5c574b22fdcd5dcddf141caeea3c02

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

taskhostw.exe
Size

110KB
MD5

aaa6ba42398b2d70f12f00a110701041
SHA1

ced61e8f26b48188e1aae8fc629ed45a666348d0
SHA256

58cc5757bb129557652797ea92aee701de5c574b22fdcd5dcddf141caeea3c02
SHA512

9bf01f585125add531b3ea912bdec980aed0eb53a20dfeb06be4cc5391c8fd75e8622e7246a499ed1cd5434ba7f50f058aa23938c2752d27cdd6e63bf788086a
SSDEEP

3072:DsyzW5Y8Vvg6vz/J+x+fHz51TYKsQEh23:JzEY0xzx++fV1TYKF3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1184	WINWORD.EXE
1184	WINWORD.EXE
4604	vlc.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
3000	msedge.exe
3000	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4604	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
4604	vlc.exe
4604	vlc.exe
4604	vlc.exe
4604	vlc.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
4604	vlc.exe
4604	vlc.exe
4604	vlc.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1184	WINWORD.EXE
1184	WINWORD.EXE
1184	WINWORD.EXE
1184	WINWORD.EXE
1184	WINWORD.EXE
1184	WINWORD.EXE
1184	WINWORD.EXE
4604	vlc.exe
4564	AcroRd32.exe
4564	AcroRd32.exe
4564	AcroRd32.exe
4564	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 3092	320	chrome.exe	87
PID 320 wrote to memory of 3092	320	chrome.exe	87
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 2728	320	chrome.exe	88
PID 320 wrote to memory of 4736	320	chrome.exe	89
PID 320 wrote to memory of 4736	320	chrome.exe	89
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90
PID 320 wrote to memory of 3544	320	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\taskhostw.exe
"C:\Users\Admin\AppData\Local\Temp\taskhostw.exe"
1⤵
PID:840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffc19ab58,0x7ffffc19ab68,0x7ffffc19ab78
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1892,i,11211414413242716689,3094091857308582714,131072 /prefetch:8
  2⤵
  PID:1724

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4516

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\PublishUnprotect.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyConnect.au"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffebbe46f8,0x7fffebbe4708,0x7fffebbe4718
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14160147431341954856,7557118266895964914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8bee8be0abecc4cc78cbcf2e3d7424a7

SHA1
d94ec8470c6a6a3078f84c1b9fc6208d1ddea1e6

SHA256
a46a234840f9d7915e4c3414db2a889df8b6e955da45ef44da7a4930407fec58

SHA512
61f13c54c7e8e2688d59a37af7396be26fd14b3f74bb042530ae5c974643918609ea7132c806204814c1f0f3f1811f88cde2a855aed73a187bba5aae09018462

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
c66cbf1e4d71b56188e251077de12ec7

SHA1
f5a304011a6a896555e32cab4c776c77c37301bb

SHA256
cf01c16d09f1ae86c6c16ba0049f7acbbe51a28f45dd078734c9442597f0df7b

SHA512
0b4eccf7f0add2d818c829c2966340977d4e196af165e8338e5a00ab6b5213269f896c6715025e6e9b095d8364360cd63b0b85e271b6a1b0167ca705c901a8b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0d47c5bf55e5b7a85e377680dbbb4499

SHA1
d8972193748fe9158f2dfaefa50d4154e535ebdd

SHA256
489f354ef7c96606e0985860b20a2499fc936615eb035ec2b12d68c17806063c

SHA512
70a741b4a2362cc65e0dc8c060dd67967aae6377cd7847d46af9de154eaeef05eafe49a2e3c9f46cc446f4df46895c23479171bb20470bf56cf0aeda290aed4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
a03d9fe0635c764489c42fcff646a9b6

SHA1
2b57ced1e4149000fdf60573da3c4ab919566356

SHA256
e7afd2856a118d77681de5066737373be1328e276c509730bd2f1e55de71972f

SHA512
fa955d9d70a3e02e6428585dce5da61632bc5ca47a23cdea0c15fffe32e1d327674258767cc5f257fede7b1a5d5dac922c333bbbb9cc204526382056ad6d6c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57a7a3e1-86ad-4ff6-8ca5-540bbeedaea1.tmp

Filesize
10KB

MD5
0c34ea08e6bc3811ffc43d431fbc0144

SHA1
c403db8dc08b18e442ac8588df8f6eaffdd7b2bf

SHA256
6a7f21b1378e3ca3832e129ed27b5aa25daf85a80a3be193a3d27d0f4cbaf93b

SHA512
f15f4223fe9022e47239e772a6465ed22758a506f9466b22dd9bfc1f830b3e592c5c4b15f14b7baf1c65ab36d814c0df6869eaee70b07064ad6c30cfc47c9928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e12f27dae5c7daf45f2353b5d5fcbcb

SHA1
eebacbf1b9a146000f2d762ef1def3bf8d98e55c

SHA256
1b6c80cb074579dc1170d252e7897d35473d97ca7ed8cac062d7230a51a9b07e

SHA512
a1b9dec8dfc765f154f3478558844bfe7eecd9d7b2a0379f13386eca0db70551b1f019fca8b45eb5caa5a986a321aa65abd75cf7ad9fbe5a30cec44becf0cca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bebe164f6e03ebd3fab11ac16082761

SHA1
4c0adc2573990ffc972438981e00876d55ad0202

SHA256
b3b926fe67578652ca4670d41b875216a32e7feea6e6cf02d77b97cacf94ab29

SHA512
28175fc3fc758b939580da240fe0d070fb941c65f4d9ffc3190a7a35420e649cb071b047cf7adbb52b196ed4f92b36482f264c0247a0e0864c09e60f6e78b651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
838007928ac115a809dfc2fe21f82694

SHA1
92f9a3e4dbce2363f00eadfe479daaddfcf18841

SHA256
d4d5308b7d22c1d11248ac4242a6691a084ec04620c719af78b8d5d707cbdada

SHA512
5471e8fcb865ee280f76b00546071ad370755670848e6dbe89716cd829ef0103fa786d24f155e6951dfe5ff7786531296182156dc1197109f9bd0bf04f3014c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
c6a0076a0b2ffad54ea9e1ee9affb31e

SHA1
e882b7fd0253f218b7aef9c3ae4030dc6e16c317

SHA256
77e166e96bf3a35e7e50c6321dbdb0004daebe1c260b69caa6e07fd4a5525541

SHA512
b7975a9904256c0c7d38bacb57fd1080afd95f32671f9f0e50b8f8e88231022c9e4c8462dbf50df02816e070dc0fc2fb370217c28612d5d84034bad5a4e5174e

Download Submit
memory/1184-130-0x00007FF7C85E0000-0x00007FF7C85F0000-memory.dmp

Filesize
64KB

Download
memory/1184-124-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-127-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-131-0x00007FF7C85E0000-0x00007FF7C85F0000-memory.dmp

Filesize
64KB

Download
memory/1184-159-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-160-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-162-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-161-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-163-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-119-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-120-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-121-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-122-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-128-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-126-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-125-0x00007FF7CA790000-0x00007FF7CA7A0000-memory.dmp

Filesize
64KB

Download
memory/1184-129-0x00007FF80A710000-0x00007FF80A905000-memory.dmp

Filesize
2.0MB

Download
memory/1184-123-0x00007FF80A7AD000-0x00007FF80A7AE000-memory.dmp

Filesize
4KB

Download
memory/4604-182-0x00007FFFDCD60000-0x00007FFFDDE10000-memory.dmp

Filesize
16.7MB

Download
memory/4604-181-0x00007FFFE18C0000-0x00007FFFE1B76000-memory.dmp

Filesize
2.7MB

Download
memory/4604-180-0x00007FFFF7D50000-0x00007FFFF7D84000-memory.dmp

Filesize
208KB

Download
memory/4604-179-0x00007FF6843D0000-0x00007FF6844C8000-memory.dmp

Filesize
992KB

Download