Analysis

  • max time kernel
    253s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 23:23

General

  • Target

    http://mrcash.site

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mrcash.site
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff959b246f8,0x7ff959b24708,0x7ff959b24718
      2⤵
        PID:2732
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
        2⤵
          PID:884
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1820
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
          2⤵
            PID:2044
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4716
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:1868
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                2⤵
                  PID:1184
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                  2⤵
                    PID:1552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                    2⤵
                      PID:3464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                      2⤵
                        PID:4068
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                        2⤵
                          PID:1868
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
                          2⤵
                            PID:440
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5916 /prefetch:8
                            2⤵
                              PID:4148
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                              2⤵
                                PID:4728
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2764
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                                2⤵
                                  PID:3152
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
                                  2⤵
                                    PID:1904
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
                                    2⤵
                                      PID:2092
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                                      2⤵
                                        PID:4212
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
                                        2⤵
                                          PID:8
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                                          2⤵
                                            PID:4524
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
                                            2⤵
                                              PID:4528
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
                                              2⤵
                                                PID:3316
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6384 /prefetch:8
                                                2⤵
                                                  PID:2696
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
                                                  2⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2012
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2024 /prefetch:8
                                                  2⤵
                                                    PID:2560
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3396
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
                                                    2⤵
                                                      PID:1676
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
                                                      2⤵
                                                        PID:3772
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                        2⤵
                                                          PID:4288
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
                                                          2⤵
                                                            PID:2868
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                                                            2⤵
                                                              PID:4556
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1312 /prefetch:8
                                                              2⤵
                                                                PID:4632
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7108 /prefetch:8
                                                                2⤵
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4036
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                                                                2⤵
                                                                  PID:4888
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
                                                                  2⤵
                                                                    PID:2604
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
                                                                    2⤵
                                                                      PID:3088
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2128,17617633011962715536,8452262947253565232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7336 /prefetch:8
                                                                      2⤵
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2868
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:5016
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:3416
                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                        C:\Windows\system32\AUDIODG.EXE 0x398 0x46c
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3944

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        81e892ca5c5683efdf9135fe0f2adb15

                                                                        SHA1

                                                                        39159b30226d98a465ece1da28dc87088b20ecad

                                                                        SHA256

                                                                        830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

                                                                        SHA512

                                                                        c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        56067634f68231081c4bd5bdbfcc202f

                                                                        SHA1

                                                                        5582776da6ffc75bb0973840fc3d15598bc09eb1

                                                                        SHA256

                                                                        8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

                                                                        SHA512

                                                                        c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                        Filesize

                                                                        203KB

                                                                        MD5

                                                                        99916ce0720ed460e59d3fbd24d55be2

                                                                        SHA1

                                                                        d6bb9106eb65e3b84bfe03d872c931fb27f5a3db

                                                                        SHA256

                                                                        07118bf4bbc3ba87d75cbc11ddf427219a14d518436d7f3886d75301f897edaf

                                                                        SHA512

                                                                        8d3d52e57806d1850b57bffee12c1a8d9e1a1edcf871b2395df5c889991a183a8d652a0636d5452068f5ef78d37e08ce10b2b2f4e05c3e3c0f2f2230310418a8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        648B

                                                                        MD5

                                                                        653986b21d52ba86d17d914e6a668489

                                                                        SHA1

                                                                        36c88ede22886188fd95bfca38596a815051c15d

                                                                        SHA256

                                                                        7deee1c35afe981c7e56e5a64e619c47e29131e962c5bc207bfd3aa3cde02f30

                                                                        SHA512

                                                                        82daee420b5decc3ebbf8fa26aa5bf70252b74233d843c61a448d65b925d8d69cc908bf64a1c31d79d501d91d4c5d4d83b7e3809f797722ef18d9f63feeb173e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        192B

                                                                        MD5

                                                                        c285592c51dadd077ac5aece35954e82

                                                                        SHA1

                                                                        1c3e78f55527c57cab3a5f980fdf65f193cf4491

                                                                        SHA256

                                                                        4d08763675d5de177142b29b9d9cc51543d50e0da6623db7a5d0f0c42c6c4d29

                                                                        SHA512

                                                                        f836613f4ecd6fd99e30a4eca81fc91458440e1afc418e1b20dc2baa7c0188688251dd58780d71e6bb45ce5b3893033c5147f6437673a3b32ad31db4c78a7c7f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        969c353df4299e5de2db3eb76efbc519

                                                                        SHA1

                                                                        14cad2ce9027142c0fbe1cd0e6fb4220302938a9

                                                                        SHA256

                                                                        b11301234cb61ce29eea9e936a2fea1f6a87c4eaa2eeaa89ff1a5af113b714fe

                                                                        SHA512

                                                                        c0c5095f9d54c6d93172d7e5cf47634ae357c544f195ae71883378c33cfcb4c496de0d1d6ece5df3bc4138c589fa09d99fc8fa56677295268ef183f29a7c93ab

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        6d02785270e36feaab6873b6662c00a6

                                                                        SHA1

                                                                        75690b1ebc5ba2b14df4ab03f9c347eefdf588db

                                                                        SHA256

                                                                        5fe4764751aab58399d6c50f59dc2b690458f24fb62a80e71580e93dddb9ad00

                                                                        SHA512

                                                                        9452037839407b203d7f375ee1429983f3050ddc4f01d1d1e6ec5a0a1b116d6877193782565edc4686460816727b8b37596af6cd1083ee380bef937c2b15fcab

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        533594eb372ea9ca17af4337e3486cef

                                                                        SHA1

                                                                        f9db081a62c75e070242703c7b3e8892350e5a97

                                                                        SHA256

                                                                        1fa1e65872432b298428f62c3301c11a9f1f15623d7a2b3090b68837fc453339

                                                                        SHA512

                                                                        e75a213a4af8f72f419e964e97bce55d8144b9e1f0b11fa0b277935b87a68d2144b863f10308e8332dc4ac3dda5cea0fb0aed5478d7a01bbc231df2e18489875

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        0baff7c92d43e619c8d4ff447a995f92

                                                                        SHA1

                                                                        1191c328487a3b0382126971025c38ffa2f1e58c

                                                                        SHA256

                                                                        6c28b274a92cf5515eb5306d97610e729989b421f19bbef427e7e5123d9871f1

                                                                        SHA512

                                                                        7305734985d3f5d9f8d03ea961d374ea2c4e5965ab909410153335c65f39cfcf574898915fd9305da6ab196e90666a965f277fd7a05754f8613ec57449d53ff0

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        b0c6f8e7cd70aaa001f61fecfeb10c32

                                                                        SHA1

                                                                        8a1eff9630f6ce96a663047fbc5ce0e372b0a069

                                                                        SHA256

                                                                        3915e5549c7dbcb63a68b17bde49ec8b20455f1b527231518978f6eb12d73480

                                                                        SHA512

                                                                        7a72a5d3e60d234caeb94acb214258fda362e4bf5fdcf83fe18b62489d7b0184ca31cde46952b5455919cf614329f4ab29e9d6be10e975e04dd37dd421836279

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        6fb40b3309b31640cd50c3c73627b71f

                                                                        SHA1

                                                                        086478c20578cf8f0d8c952a895fc9e6e0894e91

                                                                        SHA256

                                                                        a82d7dd36855292b080ac1475a252547693b0df14c52a1fbe69ef2c367f7ba5e

                                                                        SHA512

                                                                        7e922e5982cf9b797e5460dc489729c0581f2909e1184ea781b6117c391b4fcaf4069036b85e3705f98df16d80f96e4d64fc0bbed46c7a2964dd2a678b8dd096

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        c258e5fbdc1098e4c3901bc66f6e9b15

                                                                        SHA1

                                                                        914134a45e0acf57d4131f6c15979e2c65d48a25

                                                                        SHA256

                                                                        562753b12e5d3111252e4ce48bcfcd57261601adb52c1d39e4c6e84ea614522e

                                                                        SHA512

                                                                        680c292cb55120320125149f2ce120cd58ee7f754d84fac68a23ac0d69d0a91a043ea84d8ed4e7e5f59bbae9b107a3a5f9d1f9ea8059186daa7ef331c307e00d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        14a43c7257028b01c6db5b8c7dc1c4c2

                                                                        SHA1

                                                                        f772b88436e423e4799ac300092f53d3a1a25359

                                                                        SHA256

                                                                        2f6d33ed190d6d7e6be4ab2e2f7ceb8b2288b7409dca8ba0b2f54f47d441947a

                                                                        SHA512

                                                                        6a3f879b148674ff96889e1c12d560dd62a9141f32cd51c689230e01b500d3fefa212bb433476d61a70c9c687ac804003cc71bb152d0362ca654d3b94679458e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        4006c272c3d98b1bf11a87e80546620d

                                                                        SHA1

                                                                        9a93aa3f89f6ea1ee18ff2397dd4e6baeadfdf53

                                                                        SHA256

                                                                        f33f85565fb4df4a46d49b0fb87f029ded7e582fb0b9a77aff5dbac51dd9b6b1

                                                                        SHA512

                                                                        9eae590c2d2d5ca0b30114a9d6b73225bb63c9940f0ec81fbf81be6238a1c309769f6851be80f6b24067932bb0594e68b28a3ce3c92e8293f52d784c2bd84134

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        2b4b31e9a625e56890c91ad43fce4418

                                                                        SHA1

                                                                        1c32b368dc1c301a01396e8ead86889e63836abc

                                                                        SHA256

                                                                        37ba295e06a2764d941a8a7b854e18d70d3779f2f9bd2bd187b14dccd2474cc4

                                                                        SHA512

                                                                        aa1640f81874cc76e22da4fc15cddba2b6af4753edcbd4745a27d8e76ac6639d65a7209ae563d41fcb3dc9b51571519b4374e91df02e947d49da6b5e79c526d8

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        c8899eac27b54e56b4d09fa59444bb78

                                                                        SHA1

                                                                        6a36bc9a4b8579cb9672d876b788956b43fce1cd

                                                                        SHA256

                                                                        444b8b862326fba65549d2cc395b2395d388eeb0f7a5a793f541551fc09d1bb7

                                                                        SHA512

                                                                        4a084dce3f150416307a0e96324db67adbe810e7c2422050e41c5be6a3d4f34e685fa19ef624f992c7f7a6366672fdc830cdfeb1e4a3f9d189be7e395688a572

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        4ce8e2b9d61c9dca112fe856aba46168

                                                                        SHA1

                                                                        70edba83e652cbc47a88f8c61bdd31ee7b5bac2b

                                                                        SHA256

                                                                        a15466cf6c2c921a1aa40f491c6d74819d990185ca1fc679431186624f3ba637

                                                                        SHA512

                                                                        1d0c337fc9e3e1db904fc46246ad7623b98be8dbc41a2b5224da226f465ead6070c86704d37957a6eabb1200fad12b3ee194f169a22a00d03859bfbb459c5907

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        0ae38017b08dbada2ab9b0e762b1bcd6

                                                                        SHA1

                                                                        8b5f094f2456e040583c21bd88e476bbe4a5ac16

                                                                        SHA256

                                                                        70daacb9f2d1616d3b422f3e92c103d426a0df29b0693bd72e091b829d511fb4

                                                                        SHA512

                                                                        a56a373e56d4c20c103e7af9ac9032af0f35ddabc5cbdb2148fda588ffb019ae59a8f1d5b78652a701a7dcf47bbfa62dd439b81661d39beb4c1390ccf0dd045e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                        Filesize

                                                                        72B

                                                                        MD5

                                                                        ecce2adb9b10b55fe978685f73cf14ee

                                                                        SHA1

                                                                        67ffa79e22ae6f554123a14f2dff2cf61c2f1b39

                                                                        SHA256

                                                                        86c8b2daf15ea7a56bc9d1d992ad7217a6bc0e2e5f4882beb6388f95e6d98825

                                                                        SHA512

                                                                        d2e99ddb5fcce0d81415157984fbdc644cc3363e68d23d7a7095598de3676ec7385f5e0bf4c834e4515161527242551ee9a315c0a4c051229d88d72fbbd260ca

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58654d.TMP

                                                                        Filesize

                                                                        48B

                                                                        MD5

                                                                        1728736cdd5bdd78040ff0d6f7c60fbe

                                                                        SHA1

                                                                        906a8ee7199f5ac0cea31f0f705d623d6fe2da36

                                                                        SHA256

                                                                        9528ae2642b6761febd9bdef3c6015b7e98f20f5bdd5e5577ccbafbb13e15005

                                                                        SHA512

                                                                        6ab4e5683137f8a926ecb3f373bf789117c7e7e9f7920d953c0fa7d413ea05967a420e19b9faddad585e9518d9245180b371f625f4ec2a9a54d72ca2ffae0377

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        873B

                                                                        MD5

                                                                        c0b422314a527f7df97ed71afe885781

                                                                        SHA1

                                                                        9f95b1be3f1c299405d61299195ac3a6c665f053

                                                                        SHA256

                                                                        9193e831a392ca883f3336a37a68a337abe656c6d9aeec24a285c2d073d41ef1

                                                                        SHA512

                                                                        797b8715ea1e3378c70feaf39500567feb184bb8c93ade92b141514efcb21beca2950cfd69a454fb4db024979b3ef33aa8eb73998c9c058c97b158b82de7ca49

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        f4a9c7c6630e682025e51536e016c5dd

                                                                        SHA1

                                                                        840b62bdcae978dfc2791f314e6ab28af1a5fc29

                                                                        SHA256

                                                                        3150027b2a2a22bf4c4d928c623b5b06f4ddc20dda003d4dedc10e6b473599c2

                                                                        SHA512

                                                                        b4cdcc57f10d6d7bbf1d6611b162d7fcd7f00e522dcf4de93c496374502fa184c6df4d3b6f18088a4f6953cebba93c94efa3dcb4954b94e5dc62be1266cd2119

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        3fdbf3b5a0ab439216a07d1e2ce570e3

                                                                        SHA1

                                                                        532457c82d15a4774965a4f646621aebe4b17463

                                                                        SHA256

                                                                        af58a97c6d9086feeb017e054d2d9233dfdd98c146ce0d827f872566fc0d8ef9

                                                                        SHA512

                                                                        fb58c0b38b2a47afa7cf3bf5a9f8fcade1a4cb5c493d3868a2d2ce010cc6345f6d2294a8b376827ad1e0f79035070dbc84af0ad4032995ee9b7729d9702ee9eb

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5837f3.TMP

                                                                        Filesize

                                                                        371B

                                                                        MD5

                                                                        691512d5cab98e8cb2f0eadfcf257540

                                                                        SHA1

                                                                        096dd47c3fab4e6d214ea906d2adcdc0a0694e9e

                                                                        SHA256

                                                                        fe2e40ddbd6b991b65b62970caccda26e0bfe2aa1b2d4f3b6fb22801d5525b05

                                                                        SHA512

                                                                        17dc7066e506645d26bf23abfa699b3c4bd030bf526274a1cfba48f5a10365662f93c540518ac364c942c99314c06101f1226d1ff0dfbfde6c83d20a06431070

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        ce3f45993e6b5122baa6653c9bebdc16

                                                                        SHA1

                                                                        32a3ec2f3dda3757acc2ef31f17a8b39f375c65b

                                                                        SHA256

                                                                        7375d544c56ff165f25b17a22cc5a5d468409d2b580f1e05bc91e0eb18d889c5

                                                                        SHA512

                                                                        607484f0c6e5fb0d441891d4944c8ed45c9c3d4aae975e422f05e88ff96d85498d3a3e33a75fda24c72348560c79ee8e9c42c793fae7c77c1c7da123604b18d5

                                                                      • C:\Users\Admin\Downloads\loanapp.apk

                                                                        Filesize

                                                                        2.3MB

                                                                        MD5

                                                                        726d0b9cac9ae3a1743a0dc530e1a913

                                                                        SHA1

                                                                        05ccff1a678478a679122ebe3bc84dede5e68a91

                                                                        SHA256

                                                                        212a0dcba3a98b255905868818c8e40d44e679bba82b9bc0188c7b4e386663ec

                                                                        SHA512

                                                                        86ba86aeb16f12f88f0e95a42e9e17f5d74d31217de1d4d905341c12766a9d75f440bcde620835aeaf32cc913920fb048fad326534d5951880983e4261e211a5