d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
14/06/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
Size

894KB
MD5

eb7452ecbb368db5aaee83dafb439ef1
SHA1

8d2d761b3bda63b2ac63c79d0395bfa337b30e16
SHA256

d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c
SHA512

2c2853ba7c7c1d40bce86239023d19681c64616fb0383d6242c47dcefaf7ff9e62c5c85474967dcfc9c77c65702c543bcc6637129e04af62bf6ca02d4659af88
SSDEEP

12288:WqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TT:WqDEvCTbMWu7rQYlBQcBiT6rprG8aAT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
4448	msedge.exe
4448	msedge.exe
4932	msedge.exe
4932	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
4272	msedge.exe
4272	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 5116	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	79
PID 1688 wrote to memory of 5116	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	79
PID 5116 wrote to memory of 2604	5116	msedge.exe	82
PID 5116 wrote to memory of 2604	5116	msedge.exe	82
PID 1688 wrote to memory of 2496	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	83
PID 1688 wrote to memory of 2496	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	83
PID 2496 wrote to memory of 2500	2496	msedge.exe	84
PID 2496 wrote to memory of 2500	2496	msedge.exe	84
PID 1688 wrote to memory of 420	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	85
PID 1688 wrote to memory of 420	1688	d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe	85
PID 420 wrote to memory of 1364	420	msedge.exe	86
PID 420 wrote to memory of 1364	420	msedge.exe	86
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 3316	5116	msedge.exe	87
PID 5116 wrote to memory of 2312	5116	msedge.exe	88
PID 5116 wrote to memory of 2312	5116	msedge.exe	88
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89
PID 5116 wrote to memory of 2416	5116	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe
"C:\Users\Admin\AppData\Local\Temp\d4264fb0d4352856beaf132796e7ac8f2618fd9ac5856990ac9c73709273be4c.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff892183cb8,0x7ff892183cc8,0x7ff892183cd8
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,5217372858099292689,11569919381818050421,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3292 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff892183cb8,0x7ff892183cc8,0x7ff892183cd8
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,296434884644990421,14170252219732583584,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,296434884644990421,14170252219732583584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff892183cb8,0x7ff892183cc8,0x7ff892183cd8
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3807517962684134663,131699156998089517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6486ee9e961a437dadb68ff1544d18a8

SHA1
05f4daccca0bc1ce73fe71ad2325ba5dadd3df25

SHA256
9a98b4686c9e90672a548c873943b3027fb111f7992263111d912318429f5834

SHA512
ee3659f68a46f37f340f98b85a7aa289e700c5ced2a4f0104673bb5f18cc82d1e9b838ec0278407213c6ed2073998e7aad78a7a39390b7e460c8e26dfa91d0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dfecbb576ee9795c5284da8a2a3c7f5

SHA1
f1f0a6a97850aca2b4ab267a017564af02f24948

SHA256
dca6901942fa748fc01339192c0738a06847d8497c9c61298f1e5df1f8352fb0

SHA512
d664cc261113427810dd0b2d32763ddd08611a528fe6b285782d6b8ac03304b72a90fe7f3f7142e825ab8d948d5c9cf52f420546f3796b2ac23f3d00f3c17389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
03d77e14441fe4fdc85f82753a9cf49a

SHA1
01c2ed002c6c232159133a69aea35c92cdcbf88d

SHA256
160a5c08596501317fa5600c6e7e4d33e7748f290baadc2daadfafe5bfecc61b

SHA512
65c52c6132316d29982141fca0072e6aa72d71b99497c3390efe0c6e90a488da9d1bca939c63315f02810decb0115eb5c82457d2c15723ea0b486b60d1a10bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b6f99e0b6ea4b424a35ec23f50a72b46

SHA1
a6d2578b963554f3e1a677788e2877c6ce6da3b3

SHA256
71b5d3393993e0f9f697aa8819b4b3cc24b8ce14ed4c0dad724115428792b3e7

SHA512
b8d52b9e5120e6cc5ac0ada0c25e5c7ed77d151a250a00cb9cab61f0125f9ab039dca8390f094d321bc6cd2849c78f3b648a0466ca3a6983b784068de7fa4e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5c97c6e22c5531cf6f68b4cbdfef4303

SHA1
1d9e296cd2b2428cb6b2b477cd434893228eb10d

SHA256
fd9f07fd91dbbc1e5070f19aacdf9cdbdb59643623667910301fc5881f674cba

SHA512
ead89725481fe4d80c79d994ecb7a0e136d496318feb7f2f256ae84e749c6c7e2fecf1fabffe0f5841982b68712fc0a2759f0cfe10da1df53367e232c44b52c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c50b0685054b657293e2e111e0d10b42

SHA1
306a92d45e279aa408e8c625b16af960ce0668bb

SHA256
fa2cf1b38d35a12deb430b2d78741f189994b29e9af8a61507d43c1a288b5364

SHA512
387fb77edcedaaf3e8b5c56910d7c6a5f10b8096fed619e0e8097639f35e7c6c1428bf9320c94ed88714aa78f911fc95c734a6da0e8b008b7392e768f6d5278f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b7078ca2bf444f08f71072773eafd96

SHA1
398539f6ee8f68032c431b139b8ff3196681f173

SHA256
a97bccac0bd1504dd0ff1a84f27640f3ac4cc0911c350665f0b89626a6aaf09b

SHA512
d47a5b595defd545ede6ebe68edace55e1f5594d1cf1afe7ea5cbb9008a294b3da353e8e2dd95146e0cc9c4a0e1ad40cdde4fc6f644ced3c42311cec0249de41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
9dd6708751ce414867153768c7f44df2

SHA1
e1a1ac87f54b6498b1fe95e73dc875525b73a489

SHA256
a8e61fc23babb94ee5901a49e0e936eba45d67fcc67320be8a99d71bfe4a595b

SHA512
cff78d74f35cd2474bd7c3e3c5f332cc2b60faccb3a741aaac739d2a9737e3229cb36b74fac1dcecddd63ab37ff2d1856d9557529ea6d8e1e47bb55fffecf228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
9a8df336f18cd159992a58727c7ade9a

SHA1
873ec11f5aded4dbbcf6dca8cde42be7911372c2

SHA256
8964c47573a10362379deba5f3c92113e7ab41609ced5c4fd7b1732c5e3eba93

SHA512
45170a3df92d0a74442d0c3edf4eb415feaf56e63ddc5c1e08c6187b6fa7a6ab47d90632ba324cb9aa98e76ff30a63b66b123d989bd9ac2e011fdb692c2ea963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
8a53899dd3540f87c23950879d452bd1

SHA1
2a3932f7964b39768adf03f5940d0690c8600382

SHA256
111c1e33cd3d3e9f644751b07abf118fe88a2b2e7e96a3097d89f063da401959

SHA512
173ff3eca53c6aab0aa36151f01f265843b6703b4aad1ac2ed306b86dae9f9da07bb5ee313550c4cf24d77c3f1dcbb1afbd36aada1fa721f94cdb94a46f7fbd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
111f2bb1324722e18465fd59080ec738

SHA1
80b3bc68e1822f6a0030ed83b314bea3325aff99

SHA256
84d3e65549f53a8463d0e707a903e58adc46aeb50b60d18594e583560870fae3

SHA512
e4241e60780bbb9c369bf38f59f23442622a7b6aea3be5784118ca02e19917bf3f0c20b874dab11af9b5cc9a12e073b5706db17794b2d2f483c8df246c0e1197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b16e.TMP

Filesize
535B

MD5
c9fa3f58b4bf73242d0663953ce98f38

SHA1
3b355ab681a57feef3844759a44d7cb068303bde

SHA256
8c22e77567b0a438d9c99d4bbc1b9117aad52243f3a95a4fe1b24a405edbb145

SHA512
e24c59707f7af8331421a27ce9bf0fba6f07562f4d1da968e8b1b244a888e7daa5cb92ca693e9883a834a3cdab4629ace0fd0e93b907689b45d4cae3e99e8b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
60680c8e524ccf13cc8264d933f1f7b2

SHA1
426b6c89b81af9fd11efafae1cff9f37e5c789cd

SHA256
79a9510b51db8e1194779e6eebab48b1536d1d8369f54ddb5492dde518153c87

SHA512
e2f3cc9fcc9dfd837ff34c1e10981d01c338f26a30e82e1a3d71a28048db598da0aba18c49285fce4a44eaaea6491df4a57db0d473d6b848054df7cfb6dcf48b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33bf506652f5253862f847a7a8d63333

SHA1
76d7faa0338de873126182cc08743c72b5f34299

SHA256
dd749f6e453644e9bfd36a655cc3fc1c68426eb3dd240d68fd1e54b84d7174d3

SHA512
640c7ffa9df7ed3c4ab7ca955510f5dcddf1b5023cd35cf194fea72b062b8d91bddd4638a73da4009c84f79974c4c2cccbde2ba758bc9e145e74f257e4d10e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6e895601db2c89156b0ec0504e4cbc7e

SHA1
ed9596cf540d7c69fbee348b01cc2dee26a29352

SHA256
cb62382ef89d604a43d1eb54e21328ab5d30a271cdb99873b5209263b59a50bb

SHA512
05c145d20d07ee224e572cb4779c2b5da16ab3bb8b705b438cd284e7c70c76187c82994ea10cbae40e8e554ac57588657586469db78cb109d21d3159077cca43

Download Submit