hxxps://free-leaks[.]com/s?vYer

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://free-leaks.com/s?vYer

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4948	msedge.exe
4948	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 912	4948	msedge.exe	84
PID 4948 wrote to memory of 912	4948	msedge.exe	84
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 1652	4948	msedge.exe	85
PID 4948 wrote to memory of 4368	4948	msedge.exe	86
PID 4948 wrote to memory of 4368	4948	msedge.exe	86
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87
PID 4948 wrote to memory of 4032	4948	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://free-leaks.com/s?vYer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee95e46f8,0x7ffee95e4708,0x7ffee95e4718
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2989669016563512822,17696867649440487123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
21KB

MD5
2cfc011b6717079799e456b6fb67cc1c

SHA1
0d8baf5af08c6bbeb06e4fe84a68df0a1c1b2514

SHA256
3cf3c93338a79d1f399cc2e5adb5fff0592cb4f93dd374fea9eb0423e1a5570a

SHA512
5ada32ac159045406e87dd2aa151ebf8c8eb49be7b4ac441111882aad8821cf342b034a7b6d8a81ddd8904fdf9110041074268e0f5070159bf290531b8ffea7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
27KB

MD5
c984007d060766e41c7822ba1429658b

SHA1
b016cc7dd0f8243422b7bd3636c6f45426edc234

SHA256
1a5ce05e4a177d78ac9565c1104e1fd113c41aa5deb202442e48c102d22955d9

SHA512
7720ac3ab724bafaaaadd5892fafe526fef0d4cf9618453a5df6dfcebc35173a980aaa52f7ccff7afea99cdc39fe81ab7fed4cd2baa5dca89d07b8befa3480ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
23KB

MD5
05aa4ed3532dbe1043d2a073b24877d7

SHA1
c7f4138e0bd87c3b8683ed9191d8bcd76408c0bc

SHA256
11fe360ad80e52d7194aa009472be9bd75ae230b9f7c8206c60b4d53bd2c9766

SHA512
1b69476bba1f1d51fe69ee1e2b4b2ccf08320d3777a0a4817c56bbf8c4d29726cac63ced1579ea3f9a7f1220ce7294f3de0e0baa470a367662432c25ebb8c601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ac365c89fa34f6b53d74b9840c84b62f

SHA1
f139e6eba21ee94ead64251042226bcdec4c1361

SHA256
f96ee4ab3073ff32d3273d736b9defe9d3aca73bd966c633c97550d0bb95ecc7

SHA512
11929232c71a7a45e0bd98e3434308b164442a70b501eda422a5724a7b531665808bba71dd61b82021ab0d16d093e976a5be27be8776af2b0ec3c11bc0de1bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
df19e92b179f07dcc245332f2bc4d4d8

SHA1
56e2fd542c023877796c6aaaaf9f0cd19c55d4ab

SHA256
7c119074290cd852ace1b2a82866e44b73e23ea02c704f60ced1bed3e05b6dd1

SHA512
2f63cbeeb435bafebdecbdcec152d5d80f6fb49483dfb6c72c3a78b561943c254e16e04f2f2e6efd53427d382723b8528573edc6b0f0052fcdae95d87e10b15a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c826758cc4bf8fc9d5e1067d73b5898

SHA1
a8b705e005461fd73b4b67cdb87c32e7e6b1e19a

SHA256
28463eef11b3c53dce88443b5aa0b470f0595d3cb8136d8d26adc47120121427

SHA512
cb4eda0690b55979287c338dcec69100eeae5ab3ed5c87976a6e651511bbbc5c18db9f495992195902a92320220a1ce2fc73741a298bae84ce69c006fc24ba90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
baa0c799f10df07e09f55db05f4c1254

SHA1
477bbd504c240a2995ae7ac3893b3b2f8aad337b

SHA256
9a7549efdb15913c86fc9bf4977c474b2978db651048b07eddb52489a430c8f9

SHA512
a72e1cec213a9ce5c96f3898c5e656fca3d55d3a2b54b3503a0931b17f82ff66362f5da3115c72f15da0608d0c362ca7dd73c7f2a51e979170399f9641b00af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f7f7f1d959cad5a1f2980acd8aa0a50a

SHA1
ef62846786b058f1df687e65ea6f75ea9286e317

SHA256
1ddfb704221174c22580f3e472b7efcf255036099f952d9431f35d9550d204b4

SHA512
801abe4596183044be03e127d6b82d87065811e7f7bd76412e3647ccff5e765f9e253c280017310ca4945f52754428a2a0991e300c601ddcf416e4d8a876fbd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\30bd07fc-5ee0-4099-b2c2-8753f92a90a0\index-dir\the-real-index

Filesize
5KB

MD5
bb63b27b31f4b0b4a392595e745d894a

SHA1
8deb2ba74a3670ba1b380a712cedf93140ebe7ce

SHA256
38f6a0f0dedbc9db75471701783b66b8e6ae54e413ce276499512b831469d1b9

SHA512
6c96f5c1b8dc00b45f0f9015f35ee98ba20e6245a8da48318e594f6853d9f7c155e6ef735e684819754aae6f2b5eb2606a8e1e34b9e48e555676d70708f20eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\30bd07fc-5ee0-4099-b2c2-8753f92a90a0\index-dir\the-real-index~RFe580de6.TMP

Filesize
48B

MD5
be695caec4a0a5f6c99f22ba02301c29

SHA1
efaec6dc8392d0e91aaf711faa7570da500a9cfd

SHA256
2dedccbef842ded09187b74dcfba9b54ca0d38e8e62e2791fbd741053327f18a

SHA512
abbb71d76c503b02d9be2011b388dcc41f8f8aae4a7f537c201a8d8f59f95f5a9e64b9d904fb07039cd35d01d89258ac0808318727fc231c35e82ee63f70fb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
5705d96494040ba8f278a3712adf5354

SHA1
4d74244b91dcdd21a7b81c03fbcb3e46bae773b8

SHA256
8766f11ed94ef1626018bda9b4340f9562bedde5d21221e426b6197122bbc790

SHA512
5cbd009d466d1d2fc5b5cf1a0f71289279eaec30f4f0f3e8ed52aad29bcdecfea097216768023af2a691a9428e4a2852bb8319cd2a6513f59bdb28f0e27a5b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
9279832fd2297167fa7f970c05bfea1e

SHA1
9c5a49ea0ee3a2747f229c8d81223cd364af7966

SHA256
7cf4245c3614d8e2cfe56299f05ae9fea5622f70b10f27aadc0a1e9d5106adb9

SHA512
772a3082830760adca833f73590acc8daa82543b1513d546d35ea5158b9aff8239b23a6d58b28a5f455dd18456dfc8672d4df159c33ff5ab141be6bd862af682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9b4ef102c57a9138075cc6d792b89ea5

SHA1
ea829c36269885e3e9a8ae047ba96c5b2dd566f0

SHA256
6d77146664c69c43b245d4c4dc6c839b2f4c7a7a3583327e9a17372b28a0bf1f

SHA512
6d6e8f64a601f311700fa3ec85fae62374df7179d6e8e03651e1212381ee84b7e8bd1aaf1464da3b12b543fc8fe757f0ef2d2030e172d8f34b87c957f0f68b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b621.TMP

Filesize
48B

MD5
3715ed636cdbcd548af25e8d3fa21651

SHA1
f6120f3d8e820867b76fd9e32da5227594f03077

SHA256
850627c92f0360a01ee2bfa3e2f0f7d0bca08cd0a0ab7c5064b376774a68a22f

SHA512
2f7fa8a3cc09632b2e52906fc61122b8b03c68b6a0f387af60448632b42190f23f94ffe0551181b725434ab168714887eff5d1da43c94945f62c52722d27acbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e379d1967095c90c66fe13539953af1b

SHA1
999b4b74c3338f62f3a42a68f88f2d071ddd3ad7

SHA256
14a69a65defcef3cfb56bb1e09f69b438198fb26c2a00298d76043934b3ed800

SHA512
3eeb8ffd0426ea9d04d118c8e670eadc45a3c8f15973f96bf94130d193cf9271ed1f638a25bd22c891c3be54100eba536670b89063494303beb126a0e0e2cff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1b41845bf34c2c26e05acbee025a602d

SHA1
49dd002f5db2830061ae6fd044dfc338e951af61

SHA256
1bc1312816cd4a43e4f97026d328943ac48807536c2b31b332e1c30a99ecff0e

SHA512
58cb6bbe39f0b6ddc5c5ddfa412fcc017500ad610ceb5c296d8c91f044d7f097e277bdf9794b4a312c47663b5840dd4b678b97f9f754022cab3826f811e484c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
16ce84c5d576e0fda37f9883571821bb

SHA1
9a3cf171a642d1a89b0e98611d47598634a99ac9

SHA256
1638a0db0a2bfcda077a389c9eba5361b847b3b7e4d9e64acb37e02786e48b8c

SHA512
b042bdf0bde01f8b9f0fd16b085cba1e4650032c6304b1db560468bd1d235805f7a8b999bfe7574851f795bcdb47c0787e858650e3a1152be458c9059a5dea11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
73f1380db24c2f33b5197d28fbdd98f2

SHA1
abec9f207045bbba4dbcb1fcfbf81d38255a3845

SHA256
5ff60d9ae74ac7f980b435dbba6ef8cd23bd6b45085b6c00efa976c6657e87f8

SHA512
64029b6a5bc657b44e08d7b177e993872f218be17251ab7178710dccab5b75781ca0c9b04bc538d8c8d8f94ac5006d4190cd0d531aaa845ab12365351a3b4361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49831ff772354c6bcec6b972db3ff1d3

SHA1
14b654c468ff5516e2470b583cc65f6ccdefd389

SHA256
ee5e84d61a716b7f4b07f219d9360956719f655a2ae14daf9d513e2d7bcde52b

SHA512
9cf374197aa5d29b664ed1db3d572c449215f385159eb2e8587b95d4cda0ae895ca1b81843b15880dec06d2ed483d06637945733f3afad142880b8ee56f87f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c00b7f01413b797db94fb5a1e866a6a2

SHA1
a5f1d1aedcab4a23d248b3a74af27f980d7027cd

SHA256
7b6a181eeb910bc24dad470a3faf1421df365df9e9e678cb7fe735498c4f0e9a

SHA512
1a162234313127242699403b014dec873fb32104deebdefa77b9a457617a55c8ed794ed4658fba581b4cc75dafa4359983b14a53e6c93a83f1ef4b543c763f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579606.TMP

Filesize
1KB

MD5
98dba3ff2bad025209117e9a1d609e9e

SHA1
d289ba781e9e788f642d83e50eeebdc317f73ef6

SHA256
2bfc5f0658fd8bf22fa4943d8dd930c6459c780bfe37fa733ad3e53355b0bdb1

SHA512
a0c9ea56c992496b9205c13fe25707376a498392727204d9166c450c2816aa97173773f1f2719cbba491ab44284ea40b6c31269d2e235d091aee65c7d2a72193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cde8a00f9027b0cbb1d3d834d2ca7359

SHA1
012de19d8f7601f0eee6c5a731920dabf4e951ed

SHA256
23e75f3b0671ed43a23bde1baed840760e7746ec363bee0ac85b851d7c2da72d

SHA512
b81cf4cc10861883c8ab1515265d11566c35553d80f93276d9e83955b81e8033737f065198708b2a41467d10ce873e8a65447fad7adba89f51c98986c9ece54b

Download Submit