dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
Size 894KB
Sample240605-enhk2adf81
SHA256 dc763de0c256166e9fb83aed3fdf28935c14b1b04f7798ab513b940596851d4c
MD5 36dee2205e405d97287e8f0d13d9f4e0
SHA1 76513e265cc8f630548853b5852911b340616c18
SHA512 33b43092354b3e09165f1111701b95678a8c9e1245d0b52566867fcb8eafe81cec26240628e7af3bc9d9f50d17376118596135c33e0a8b48c7aba65cf3e27a2e
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4T7:vqDEvCTbMWu7rQYlBQcBiT6rprG8aA7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4812	msedge.exe
4812	msedge.exe
5012	msedge.exe
5012	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 5012	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	85
PID 1212 wrote to memory of 5012	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	85
PID 1212 wrote to memory of 4296	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	87
PID 1212 wrote to memory of 4296	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	87
PID 5012 wrote to memory of 3532	5012	msedge.exe	88
PID 5012 wrote to memory of 3532	5012	msedge.exe	88
PID 4296 wrote to memory of 4240	4296	msedge.exe	89
PID 4296 wrote to memory of 4240	4296	msedge.exe	89
PID 1212 wrote to memory of 2848	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	90
PID 1212 wrote to memory of 2848	1212	36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe	90
PID 2848 wrote to memory of 1232	2848	msedge.exe	91
PID 2848 wrote to memory of 1232	2848	msedge.exe	91
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 3408	5012	msedge.exe	92
PID 5012 wrote to memory of 4248	5012	msedge.exe	93
PID 5012 wrote to memory of 4248	5012	msedge.exe	93
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94
PID 4296 wrote to memory of 3728	4296	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36dee2205e405d97287e8f0d13d9f4e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7300660339627900257,1915031022691972985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12755214712723051135,12287807657170891903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12755214712723051135,12287807657170891903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,1189863195991369355,1769221144773928214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9f8cd2ae9632431567519d87cee7827dab9be149eb4d0c071ae675954eca4a05
MD5 c820a729a9d013215f23f5b347ddb9d8
SHA1 61ef29c8cac72251076e20c0ad5554b10b449ae3
SHA512 032e21e9926a0f1c682afd1163e8e9d330b377a4adcc12213da599f7496bdd735d871ef41a590ebe730499b554b5145525e186e70df2c8cf7d6c0c1807023636
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9a0202df7fdb4a769728e5a92d1344e4d6221106477b85f39f5a19b41667385f
MD5 f477b0c3107577df4fd9b137caf6f2e4
SHA1 f47ca2c5635c059bf912e0d26eec24ad11bd96c3
SHA512 5b0405bca5b117d1a2bde4ad16e551a74a5b5b0f1fa5b16609f8094bbd91f5774012806904affe2608982931a28de3d98399fd83a9fac99c6a1ba4c9064dcded
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 52e4ba0dbcae74357a6935afd9edb05d4dfb9d5b7567fbd058bcb33018ea2436
MD5 d9dd6489d65d28e51ef39ea8c70cfc5c
SHA1 b6c0f86e533b5e4ff1b4aff8934f345ba1c97f15
SHA512 4f06e7f53e98e2274e522ea62ca465cc1403d7812538848c7c1fca8d8bf1f329accafad5f44a79169e5515fd41e35190433f051b9da7dfc2405fa65fd2e83b84
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0f5da4634d64a0366b283995c5c2b00556f20bec228bcd87200cd4f1ccbf7591
MD5 44022d85f3903d5b83cfd8d6fd45ae67
SHA1 d0490d8120d47757c29239f4d22569b11cbacded
SHA512 38f91b741467a2cfe96685a0aa1d51a707fc5af9257979f1e31763566ddfd52d09c7651f68e05c0b25be140f658c22d2e586d0d8842989ef6b99e25b7c4a25df
SSDEEP 96:nkkHQ1ane8wpmKpWMoiVmde/YoMktuQ1UgEQIw8EQAZwJVUWQyV+VD7AiEwb:nkkwkne8/KpWMPYoZuQqgEQIw5ZwXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2b176dc26bd5aa2abbf6c3533d793b980260b5da1eefe88f52c55a87d33eba51
MD5 daca41737f7f4b114fcd3cfccf77422e
SHA1 77627f9ee77175c6de3a82f2f1942f4fc565bd6f
SHA512 3dd0221dde711e7848a7d65ccd5f5686743bf40a73ecd2d656371ca796cd2cd9aaaebf361e09683d50b53f8d675b8c0085ba8e249f2255e0aa104c1d5c634b7a
SSDEEP 96:nkkmQ1K3e8wpvWMoiVmdeHpw8EQAZwcUWQyV+VD7ziEwb:nkkzQ3e8GWMXpw7Zwcrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 d46d61569a29e5c5b7ab5fea81b3e4fd6c4ab530a00e70358daeef914ba9ee53
MD5 2a42b67fccfd3278bcce06a01fdce1d4
SHA1 65cd4c575bc98daa598809154ad2fa3528ed17d9
SHA512 e4506bd68c6eb7f8e4cf0dee387af3bc2ede4075d3669ca24d467241d405291c1dc32a6cee14913389e40172cc89325bf51b897c7cadea4fcd46bfae96409b16
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 324d6c0049dea157773bfa65ae232f753628f007e87f0e9b34e5b8e98228c03b
MD5 99cc0491ab83a7bd1a40064c20c5a1c2
SHA1 766be7ad721263701421caac59f2303c22cce4f0
SHA512 ede7985b1624b9e072e6a5833b337ef1cf8cf956f58c816882274e22a8041bdc8051c993e61e449c7bc24103aa65aad5b28482294d7748d34796bc84af11f6fb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 effe61268865ee2a1090aadfdbc5d14b06486ae09e6ff478b53b24cdf7be2c09
MD5 d33da63c7ae5bcf554a247d0fd97bdde
SHA1 ae149430952139687489e78b1b88d2b4af9431bf
SHA512 de438cfc9efc436a8180602be389102924cf0ecdddb255113cbf6cddd4255ea3da7afa7a3781c4592a357a20bfff9a986d819f44cfdc38881830584d624cd4e8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 d13c941e5146ed917b349874f489222855a9a676e075b2403f68597b7de2617a
MD5 aab2aefcfc189b59220813b89f6f4a18
SHA1 4947003b34c6d5caa3c7067dcbbb29ded7e85513
SHA512 cd2b186cf0f4776c673a64a9df37973152a2ecf222393ce97fd0e9f40b08638250f9a696d1b59f1cf68aac60515cc939b6252378ee61d42607bf802bbe5ae550
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 9f2ee008ec61205d4fe2eb86d657d7de57891d732d6c0ce533bba7c0535cb17c
MD5 209321c93b9996daf050ecadc8b1f6af
SHA1 db69095dc24d1fe1635109a22aaae63049567e51
SHA512 49a25473cfac7a13e3354c62d26fb15f7f15355a36b71bd333ba102d739a1a018af83a300ac009096d27aca2a1c93fdf11ccbc5d21569c6d421dbc36e0a695f0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57dc66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dc66.TMP
Size 539B
SHA256 33e6334945bfb756d0d4d11555a0c8391f411101b884ef5b5a3a2901f0d50098
MD5 d57e4cb790aea9f6bebfd2b6d8d84689
SHA1 14f25a33463b551f46662edfda86788628dda446
SHA512 86cc501fa2eb7897ab01cd8a0aca11618f22be6b339f2d5ba49b6eada92c9ffea55466ad3c57b0a4529a51dccc91cf3a3ee797057042d229a64c0d23a1a5497c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21c198f48870212d443f5b5d9fe6718150a00cd6a3dcbbffb66aed048ec0a8c4
MD5 876c40304c918fe92e1a8aaf02ba39e2
SHA1 7673f05273890f9be51c70d49d2855fa8d3bf487
SHA512 dd3f8d9ad01f7d43ba2cc42791756feecd2342b18f1d314b0fbb472e36a8150c400e17a6148d6a57b472f60b2272e950b424d9bd3dafb8bd1280fb8d14f3f13b
SSDEEP 192:SoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcMVe2RUL/J+kh:m9iIxuERzA83h09RZxYlsxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a98d1acdbf697570f0f454557f995a0a098a5612fe3e8e307fb255c9c4bccefc
MD5 33a44f8af75afcbb50d987b1169ef041
SHA1 d9f35c0b5e02a8dd9e62c544851eef7eaf185743
SHA512 c334b4bf738ed09e1d6ab525e812f9d6581b17555609843a294be99960f8cd8d19abc4d6c36c5c1401ef937dc137e3749a00caac14a0049fd538af1e8d4b0ce5
SSDEEP 192:SoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcMbe2RUl/J+kr:m9iIxuERzA83h09RZxYXWxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab950d1608bea54e0d1410cf0160ad5ac925986dec51f88fd564ef677329a817
MD5 f3e8b161108bf8f1d8956850e9e20b12
SHA1 65bd0e6b84e57406d999e3acaa1ea593f2ce96f6
SHA512 c9a00a1eb1317f9f350aeb390eb45ee6d7753bb026a2c45afffe65fd58f256ebb21ba07abbf5b274c699839707ac572a3c69f90df8be523d3d82aa684caa0c78
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzMIe2RUqP+kN3z2OMDCRHR:A9iIxuERzA83h09RZxYbvNaOMWRHqlWr
MD5 SHA1 SHA512 SSDEEP

Submit Download