446b70a5ea5040f38f3f2eacabffd3796df99a45b3a3134f010fc9570c7acfbf

Resubmissions

03/07/2024, 16:21

240703-ttya1azama 6

Analysis

max time kernel
55s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ST_Internal_Loader(V13).exe
Size

23.6MB
MD5

10d8a3c21cf63b82a830809ef8d243e9
SHA1

71b8ebb42a4d077b083fe076d090ceaefc163320
SHA256

446b70a5ea5040f38f3f2eacabffd3796df99a45b3a3134f010fc9570c7acfbf
SHA512

570e1b91b3fee00a09af7248f25e7fe537c7268824a18a44cf91f5826e39ac740d3041b273d85ed07cb5a9032bc58c5e85f7db7034f5196d0b17e89ffa938528
SSDEEP

393216:iZ41HE1s0XZ7LymucFgNTihw45gaBzXBJVdPVEMBqkOwzX1Pm4cLZtqyhu96T/:o4u1zZXgNihPgapXBtdEMBqwzVyNbhuY

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	discord.com
33	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{59061FF2-5020-4892-8D92-3C803BEEC448}	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3152	ST_Internal_Loader(V13).exe
3780	msedge.exe
3780	msedge.exe
4896	msedge.exe
4896	msedge.exe
4632	msedge.exe
4632	msedge.exe
4800	msedge.exe
4800	msedge.exe
1336	identity_helper.exe
1336	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4944	3152	ST_Internal_Loader(V13).exe	83
PID 3152 wrote to memory of 4944	3152	ST_Internal_Loader(V13).exe	83
PID 4944 wrote to memory of 3096	4944	msedge.exe	84
PID 4944 wrote to memory of 3096	4944	msedge.exe	84
PID 3152 wrote to memory of 4632	3152	ST_Internal_Loader(V13).exe	85
PID 3152 wrote to memory of 4632	3152	ST_Internal_Loader(V13).exe	85
PID 4632 wrote to memory of 2984	4632	msedge.exe	86
PID 4632 wrote to memory of 2984	4632	msedge.exe	86
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4632 wrote to memory of 4624	4632	msedge.exe	87
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89
PID 4944 wrote to memory of 1272	4944	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader(V13).exe
"C:\Users\Admin\AppData\Local\Temp\ST_Internal_Loader(V13).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/staffbesting
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff858fa46f8,0x7ff858fa4708,0x7ff858fa4718
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6740694974504480483,3229925606803036969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6740694974504480483,3229925606803036969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.staffbesting.store/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff858fa46f8,0x7ff858fa4708,0x7ff858fa4718
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,6732077135432380086,6422671442119340035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
241379a911bde1dff4e08f2cb521e220

SHA1
d296b9bff172a84febde0d306294d6ce0c63ca1d

SHA256
b0bc11054a6e14544e3ef33a7492f9cd7be99cdf8dd7bf10c6d73f188436e653

SHA512
fe5f999d90254bd50284a349c3a5c9dfc28edb95ffa724f18d28f5a5758df3dea2d596c4e5ea22fa02b26723edcdf7c55057a2e35aa1d347efe7a258a6b761ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
96KB

MD5
29acbe9123a51dff777c399b93c4aae6

SHA1
5381a0c5bf2dee2b2ee03e624e342eedff732834

SHA256
999510a8eebc7a4b5b397fa15f85ad35569c4fa626db0639093f0db34357aab5

SHA512
08caeebe0787ea9d8e94d52f6e9ab2cc641befe590ace6d2bc243933d0575c74dc9c54ca32415dbd3cfd7f78078d84dbaf131877e3c18052341c6fa7d8d441aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
5fe6e96e9628baab767358f0635a43ed

SHA1
b66a2665b7cebfdb8e68328f6f2980a0217e1c18

SHA256
24e71440abeb8bb9d0b6c4280bd467d61ec0f435505f25c2d9d7c65035cc0bd5

SHA512
2021ff8e81134f7cd6dda57cb7ea3a889df7921e3f721c557c235da2a3a7c77827b82ae580356d292217435d7fcffba6c323bd40571f09949d54ff3814a22a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e53683991b106a8098bddb2636b041ba

SHA1
a100652945ebc62b04b48bd28c3030c0284047bb

SHA256
7cdf4c969d196abeffa4ac15139f7277bf01778f73e15dfb7822feef488d08ca

SHA512
5f987785b5d568c9ec85872977b2804581a02acfc6ed775f159db801034ae5fd5c3a4baa44adc9b026dea892584d92f9a771f12fb451921b7484d86d470ecc87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a4183e71e30821aab2b9a1ee8cd5d3e

SHA1
3869e613f4b7e5f5c1c890e63e3890cc2d1d3f54

SHA256
624e9afaced4d87a0259a6f048a4030d43a340bd41d497d20bd8008ec6ebe96f

SHA512
4089a9f35eeab698651cb9c79d783919799ebcafbd81eb0d03b0e9008b8e22529ff177002c14d3543a9d92016ee7afee21c7eeb5037ae5b08d5434a8c691ae86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b91c3f6ec05d51175423222d3d21272c

SHA1
231bb1907a2127f39140114f55de9f79304ebd34

SHA256
afbb92396b311f2001ca3b315d6c5f04224870776643a03b3743f98729374824

SHA512
a2d29dc21a57a75f5f447892573387c4d7e021bb5d42727e177f5bab52ea431fa0eb8f1e9528468932c282b9a503c5c5a91cfc3028f21adf7a688ca90c009461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2022b764e2a885fd614fbb036ef290b0

SHA1
018213ca562c75f63de1ae3d196c5715bc8eeedd

SHA256
98bafedf2a05cd8bbe183f7a4a361929294f4a0225d6e2a976400519032857ee

SHA512
e4d94e3c4931cd2e93443df74ebb40d21c5e47437f02c64cf95a07514ab080a767f5204d2fc3791162f1fb33e1a8dda3f5a2c62b38a34b6d685323f21bea4095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b16e.TMP

Filesize
1KB

MD5
e486d43c6b0d07d8a14d7eabf2922e7f

SHA1
822ac3ec236fd2c68522764dcaac0d95cd513fd7

SHA256
c4430b2a5c37c79c21f04f42ebfd53a4f642f70239f49f382a744001bb224f27

SHA512
4a2bad8e8107dda2c26e398a40f419501364238306ae1e6699fbe7e64ab6af976a7325c17e6dfe539d60e8d9457c6741eb98e300682c374eeb494e391eebab75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c3233739d3c31ebc34fd0a3fa0a907a4

SHA1
33e37049c4b455c81051b14ba3b0b6f591476200

SHA256
c6d9e67877df6834c7a7ddb9717c97ba6992b25674b5d09b336f0be139d628d0

SHA512
e890f4b826b7d50d79d3fd0899979d3ee6a2d5250104d503c0add3a51503e00a556572b261da0b8f069902fcb5c8850269568dd16b111338a4934fe8ee1b685c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7444a8d99c6a0997e8b1879c34c55984

SHA1
d4d0ce8537a14afdb202a75776cffbc8fa85aea8

SHA256
e1e71723fe4154214bdc8bd528c619a0cb476b87b0dacd0d83943d05fbdd9062

SHA512
8b306726abd4be003df17dcb91a35d86207076fd7d19c2ab3099bda945cedf2e03ca63e9679f949f8a81a12ae1d9cc2eafdd4047860f282b35d6267e22856908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e1c80396419715b6b95fa571188c566

SHA1
484d9a388f3b644c8ad498cd4062e1f92c774d95

SHA256
2ea1b4d8ebd55dc83d5b141cc1b40cb136268d347a84582650d7a949c48ce6c5

SHA512
ffb770c1f3a75a217ea1e080d46713451ba6f58fffa8913e7580e6b57196ef557719d2e331fe1d7a2fd8af60344b3230432fb32f6d578864712e609ac0259642

Download Submit
memory/3152-293-0x00007FF6F7F40000-0x00007FF6FAC00000-memory.dmp

Filesize
44.8MB

Download
memory/3152-0-0x00007FF6F7F40000-0x00007FF6FAC00000-memory.dmp

Filesize
44.8MB

Download
memory/3152-2-0x00007FF867DF0000-0x00007FF867DF2000-memory.dmp

Filesize
8KB

Download
memory/3152-307-0x00007FF6F88E5000-0x00007FF6F9460000-memory.dmp

Filesize
11.5MB

Download
memory/3152-1-0x00007FF6F88E5000-0x00007FF6F9460000-memory.dmp

Filesize
11.5MB

Download
memory/3152-3-0x00007FF867E00000-0x00007FF867E02000-memory.dmp

Filesize
8KB

Download
memory/3152-4-0x00007FF6F7F40000-0x00007FF6FAC00000-memory.dmp

Filesize
44.8MB

Download