hxxps://www[.]mediafire[.]com/file/0fj9kqtkrmfj3wv/robux_gen[.]exe/file

Analysis

max time kernel
277s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/0fj9kqtkrmfj3wv/robux_gen.exe/file
Sample240613-qyahys1dnd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 211197.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4576	msedge.exe
4576	msedge.exe
3232	identity_helper.exe
3232	identity_helper.exe
5376	msedge.exe
5376	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3716	4576	msedge.exe	86
PID 4576 wrote to memory of 3716	4576	msedge.exe	86
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 3808	4576	msedge.exe	87
PID 4576 wrote to memory of 4540	4576	msedge.exe	88
PID 4576 wrote to memory of 4540	4576	msedge.exe	88
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89
PID 4576 wrote to memory of 1840	4576	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/0fj9kqtkrmfj3wv/robux_gen.exe/file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffce4746f8,0x7fffce474708,0x7fffce474718
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7796 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4994115254941606252,13918078572801484272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 ddb2fa4b78bae5ddc16197bc65d82a5a7f22c54a6c4b10b6caee0593e462d4be
MD5 2f2016a7be91104cb3ba7d03f3d658f8
SHA1 1d12a2e120a8125316260986ecf5276eec331e9d
SHA512 3b3a5dc4e8788674654f9661d5f2818db35a3a1825d2009fb1fe4cd2b48297c911ce746c83a3aa7b35f7a1b18e82a7dc3115e3ae569368e50e20338ef15ea862
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 8KB
SHA256 d5cd3f286fd1ecbe72bce5b5a4e131b53ef9cc4ff3a02bc8c682ce25473a831f
MD5 bce6c20cf48a6647a02b0a5131870e11
SHA1 5e1386038c9abe2d57f49ef4660d0838f683ab30
SHA512 00d0c8aa74783289590cf1741300a7072f944887338f53abd747e37a0876e632d891731f9cb74713d09651c7a4ef020959c22a08464f3c24b28dc0d31724f302
SSDEEP 192:JuT6Rsm6l6wTfFi1fXRh8478U8schXr6W6gy60RI66iO6z/liT9oBBbMIj6nBqct:JuT6Rsm6l6wTfFi1fXRh8478U8schXrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0b66360809841802b3fd0b0e8a113d94469ed8ce7a82f7b8d2a6e8cb0d99994e
MD5 fe8f228d5cf298f030f48374be786963
SHA1 8b879d4a5b43ee1ff358e7d087555774b53e4a18
SHA512 ff0a324bb928b82830074f54ab1aa527fc9bee7d2e015f474bf2b83cdc34d80dbc7e6886255f09997baa4e69cf26bbabfb818225a030ed793922621e179e9cf5
SSDEEP 96:nwfkVoxm/DQYmqAe1pAeEcwpvWMoiVmdeHnaVw4UWQyV+VDCziEwb:nwfkfIBeHAebGWMX+w4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bd6f116d40562f380d94173a830baf8bbc759b46173aced1d32854e87f5fea72
MD5 77f14c69ad5432a88488307539aee78b
SHA1 111116cf4794374e1f8d2a728144bc4411ef001c
SHA512 4726b34fbe63926afbb31e2ccec2d34c2f44ee981c52d175b84fa67630cfee814900ee7ee38b610e06b3e9744a8660d99d7b86b794c8079e24bd46fdeafbfb9a
SSDEEP 192:nwfkGRBeLjebaO1T7WM0zap/l5ewK8lV89JKzDSKpg2qbkpqkIC/N7Flc0FrOmYm:nwfxeLh8vWbU/zI8KHKP9gjQpbIIp3Xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ef43d8b6e24cfbb1d85413586e63852705cf3c73e9b499cb54d5f9b88bf5aa8b
MD5 c1ff8d740b60e83170735f4604daf81f
SHA1 ebebeeac53bfe57091078ff6ac18dce72acf1b3c
SHA512 13509453c40bef23af8cf5ec683e209d2ee2aec75e408fd799c6b86a72b25e70bea0aae3a581e419d8f4e2906a1496b921c8d6afaef9249cc489c34643b3dc82
SSDEEP 192:nwfkf7BeLwebGWMv+uWl9JKzDSKpg2qb/N7Flc0Fr0ua0UeQxKUEVK/sHO0zyZz9:nwf0eLaW0ClHKP9gj7p3XA5pTKpVKUut
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 1e4d2870363e5164292673afade8f6a2b02c353c024497f75a5b1e24cf67620e
MD5 56883cfaaa99ca4c131b89a7089e21b2
SHA1 fd99c85b496cc14b1b27b0a3d4bf4d0069a29219
SHA512 275c5663ca0171d15124e4c95411ae13a19c1d3634903946be3cf33bcb4cad4e99c2d71f592b4c959674be3f595f1c469110af76d633c40a4f5e36318b7c0ef0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cdb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cdb0.TMP
Size 873B
SHA256 c1c7f542094e553150600de8ae9966ca78902dbf3b97b502a0906c3dab628082
MD5 2c069b834e353970190995368999e483
SHA1 c1484e43dc24678cb8539d6a02b1f53aebea8f31
SHA512 890a04754222cd5ce1d4857230614ff3f34ff172323e0f5d395a1b57d001cb1bf0bbb8bef44a031734b05519443d9ea095fc017819542422adaa9b32e6ad7784
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a48938b540ae60149b5645337266ed004ac7a35272975acc1e6c9e2945ebed23
MD5 7c8243b44234efc1c8fee16372ed972f
SHA1 30ba5ae002b5a411b63fbe0e0d6c9bc845525b41
SHA512 c240d1d1f5ba310233c21763f6a996f9d9b2395b0f47567deff3300881c1105282c7feaec9271b017da825540236f992b678a2825aa11be7268879feb8b0c300
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0g54SM42e2RUmEXhUtRa3o:A9iIxuERzA83h09RZxY0g5RM4YjEXaRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 65a319beb026d6f4d2d22535a0d0be6fa089b0ac59bd87e721f5029fcc6fc3ec
MD5 2101c1729ab932db93dc2e663d6427ee
SHA1 e590f81036867f45d03f8147f0027822ea7a51bc
SHA512 5f547934b90b4984ff3bbced530de11176f689d9799075cd89d5b03d40cf2560558f2fa2ddace361f57d9741c2a91be7d4fc0ddc7eee11b83c6ed1303317c25f
SSDEEP 192:HoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0R54ST42e2RUmEXhKtRv3o:f9iIxuERzA83h09RZxY0R5RT4YjEX4Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 211197.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 211197.crdownload
Size 30.0MB
SHA256 75c91b29d5522c8a97c779e50bc33f11e07ed37b2baa31c8c727016e92915c1d
MD5 281ed1d5ae50e8419f9b978aab16de83
SHA1 a869e551c0dfeaf152a594f9051b99a65d46f16d
SHA512 bc5c066447b0ea83a837f080bb41887200896124c03cdf996ce0d1ca85c2c8fb10ed2d60b2f10d685758482b8aa6fb1303c05e51bff18dc8b51a7dc8ae1ec5bf
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download