hxxps://drive[.]google[.]com/file/d/1sfhWRpiE3tQDrlKdc0kK5mcF8-g40NRU/view?usp=sharing

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1sfhWRpiE3tQDrlKdc0kK5mcF8-g40NRU/view?usp=sharing

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
7	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2494989678-839960665-2515455429-1000\{12443337-857D-4E51-A9A9-9266E5821E44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
2940	msedge.exe
2940	msedge.exe
4036	identity_helper.exe
4036	identity_helper.exe
3804	msedge.exe
3804	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2264	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 5104	2940	msedge.exe	82
PID 2940 wrote to memory of 5104	2940	msedge.exe	82
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 4780	2940	msedge.exe	83
PID 2940 wrote to memory of 3648	2940	msedge.exe	85
PID 2940 wrote to memory of 3648	2940	msedge.exe	85
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86
PID 2940 wrote to memory of 3084	2940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1sfhWRpiE3tQDrlKdc0kK5mcF8-g40NRU/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaaf8446f8,0x7ffaaf844708,0x7ffaaf844718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,13380145152139632108,8831445184658101329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f8 0x46c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ec31917b269a4ca41c94985511eb8cc4

SHA1
f2414c5721b36894e622f70d710dbf34b7621bc0

SHA256
fd8639956675fff7bf5734d45edfa286c39a4dee31c5a7ebc26870ee5fc514f8

SHA512
a580315c173f4c48f3a374fe56c9f4351dea561deafc0106da54d8f9aca3f90a419ab29d5d3315713ca84953e9f59bf7056838a61be551ded04548373d74fd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0b213319f015a5c268c687fc74895feb

SHA1
f9bcc07c389664923110d917ca1352ec66324e8e

SHA256
ffdd5432af13f637c40c555f092f48d72888b11e3c6684e4ecc595f3750d30df

SHA512
77be18085f76913ac06986eabda18dc8fe77727412fb5be8ff06b9a97cf69985225f85dd7a28bb02cc43365f7a1aaeac55800d6ca4501fb1ad3da4d80e29c0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e1b485d93f10d4237947686c65fbbd7a

SHA1
1c4bfeec0962a90b7aa8fb31d791f1009523dcd6

SHA256
a5b1a637507235a11df4b25ad8c4ab7f07a37bfbf62c83dad7e344bc755f8289

SHA512
13c608d7763be35b8ee00b4eb3d6303a22b5f6b244b91e358e34e55b6410a5ab40b5b8b287a1927db7f2900fecc3e0607d6327655af37cefdb880e8cc2df6648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d32ff18e2e815e52fef1f91ef0557425

SHA1
800e786118b17e73e171c023ad48bf170eae0a64

SHA256
65204f1c60649dc3d2655a100902e923a990b7de45753f5a55a87fb95e076063

SHA512
6603daba9f0d6186952e2a4e2fca9534f0a2eb64164e1c8276e6dd227d8a6b34544f5f1d08767711049923f9ffc829adfe238baa2b899689d11cbdfc8da949c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e542661d5eba55487aa1a44c697ea89

SHA1
7f89c10160f6e40d677c64a87fef53dec027de1c

SHA256
6155ab75ece570e00ea79ab0e560de36b357531404d61a858330cc4058930745

SHA512
52722b756e7b6bfe716785f0c7d173d03717400f347840064a0be947d113fc6d1a8f8616b2544033793d47d8b9b33426b463c827fae13c9ef2a0c6f4fd53a5c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb1c5a82bcef372337294757b1e81f5b

SHA1
e66cb3fe629d7582be7360566ef0e2ac2716e6c3

SHA256
b9a11980cd1dd5d0be3c5db3fff536d3c0fe25fa4f44bf94fc32f4cd39029b88

SHA512
88c5b057a0e5db87d7fa267e74cd3646cc01cd61e116d6ea73542041796af3bcbf043a0d575f1b45004a15dfe87889ef85aa329f186ebe7c37bf99900ac5788f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6509da5e3c25939a902a2f8d256d0e2e

SHA1
725bff6ccf90d9e655d8ffd6eb4a6c13e0c80e60

SHA256
6ce7c3add2bd4f09399f5adb153b45f54fc751bacafb32a5db23f0e9ef10c62b

SHA512
02eff11288de769f40a4b5f8e84a79143ffc7789b58743478cc30a826f4a63032f882be8f836e18fa95e87eef937c1c4789b9906b173beb78cde9725807a355a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
94680723b75e36e84c34cafc05208a22

SHA1
bb4a6e8c8d19710a2b01ec6232e576ec684226ac

SHA256
1996aea1a17480e2f2ac99291a3e6ffba4522dcc2fbfd44124c787ae28f79f80

SHA512
738da140137cc5453caec99471cfa32df760338381f97af033b3ac2f739703880b8066dd06b399d03ef0451593efa04120ff3266708b9e0b2db5c105cf4d8bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f052c6ae-4c55-4447-9e52-a2a0c8d78193\index-dir\the-real-index

Filesize
2KB

MD5
ebf05e38c48cc653b8e4fb6138d933c6

SHA1
4693362cf56bf22a263f12d919920e7295b67d64

SHA256
e9e65d5a62ccf50ade8e60293b2af61f1e71b99ee1f5b4c43ea37fa68bc845cf

SHA512
52ccdff3d496e12d6baef07322e267c38770e0e65a64426fa937c3187d5d66470294bd02d884fb83b9ff2d35fe478d0f756fe7f1757d562f16dc861be59be6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f052c6ae-4c55-4447-9e52-a2a0c8d78193\index-dir\the-real-index~RFe589843.TMP

Filesize
48B

MD5
2f291ceb0706769a7b2000c18f3dd31f

SHA1
88349c3899b54bb76ebfda5cf9a734dbd14095c9

SHA256
44fb7507d94b426d8f05673904e21b1ac683706c3735918cce0ccde65c8e9c8a

SHA512
fe20b4cb6d71a4f239b8b060baa83f76b25e75e702c89a2311c4a0e87d65c6766147c7f2759b5b1a2384291439e3ebdb7d33ad87d353e30e5e1f7722786a4aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
d54d3fa7f1a9d731686aae3d17dc3867

SHA1
703392cacaac6005edbeecfd0ef45873ae94e2c8

SHA256
9d417f73d5d5568a62197a05d40dc4ad70acde99b464b5ee7fb83949303c1ea9

SHA512
3c7ad09f6ac56119697c0c7c8c72c55dc8b17523bc6ff4a7b9e95470bab4529bc57242701c96ef3bde7654d7ca6049560a0d185d7e8f09246bfdb5ea7eb11932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
615b814cfff02bd952ea989611731d29

SHA1
41cf3cf63ee9c8fa49bbdbb86f2cd2d592d7f6cf

SHA256
63d9acd3361e3c10d952369b14d116b0d4582b50710b105c5ed4038ea66ccab0

SHA512
d66bd4a07946a40a213916de32e7e0f5a251b511055f34e67349a2fc4956d6f7494d7e38f6cef76a5d2952678e91037ef8227708cbeb7e8054b0052014964e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
bc1498b9645c76488f52ef66ca3b096a

SHA1
2a3a8fe4e94f978c89a9781942a6d9f315a56702

SHA256
3bceb14437612d1e6fcd96d0b6f0484e770353c812958c8b2f2a37d20e68383e

SHA512
37685040cdf8c3d5140b18cb11761913c16edaa7b262511c37d402b02dcba267c650501d88b401b8124e64342fdc2c8b2a5d1abd39834a9a01d78af679947c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5866b4.TMP

Filesize
89B

MD5
92ed31692e8ab4b330485f18222cdfea

SHA1
38650d09aca363efeeeacfa3d71b8a569cad0142

SHA256
674cd2b820e4ec78b91fdde98a00b88cb3f9e7c32613dd90abeb788f6f0533ce

SHA512
10ba10e43a05f7630465ee013092a18b105085eb492b0e49bc63547711626cabc335537004d15ca3b69aff25e28918cda522cb4f8677b52f6fb83e8c17567153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
23d6557794563dd6bf39cdc6cc8f3b13

SHA1
06ef6477b2683fc686c317b0d613e6f0b673af17

SHA256
c438a2f440974b1bb26bd8942c0ef516413c377d238cf229a45ec6a185f2a658

SHA512
9a88aa6a6b3d52094bf0867a62dac006e14a5ad7f32bdca2430f2165e45335ca1df2e03fbdbcc65c0b5e0ce04d93d10c141eba23efcb19d099c77e81a0c7ead3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e663.TMP

Filesize
48B

MD5
7a34277fa88e8a22e37534817816144c

SHA1
3e359632c7b71dbd24378d355a8abb64657c4873

SHA256
1f907b8a547827cfeb496548313ee4d689517c57b7fb3736832e1b2031cdc0af

SHA512
31fd92fbba4edea2f22e96dab34944082ba31c5538aa7d0a40eaa9e43f22f2d1fbe79e74d8bf808446e4d91c736cc5726af5038bf797d3418270606affc278a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b831f1528b5a476faf4714bd09c1c11

SHA1
0490fa9cd7241b2d240418fba41fb6c513deecff

SHA256
64d30738170d54e1ec09c236b3db5ed330892f5e78257a16b1149be44d0102f9

SHA512
ba44a8c3e9a33bb016a5bc0ef38b51d227d58e0d06e4f37579a72998b1a1568970076b66066eda982c20a66e94ca5ba701eea9798beb2a44f776ec770a71e6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e943255fd10e4059a61a79dfbbbdca8e

SHA1
2acc1eda7b06793b9edd9fd30ea712c9295498fd

SHA256
84f37d7e933134924b73662dd8881391f7f7cc22fb2fde420b48c0161404121a

SHA512
22c7db8f60c8fcc3705c168d0e2accf4d9becf3be7241a56d07c916650baedcb77812c92fb1c44bba93881d970aea8e7f206ea5cab0b7e6c7f32a1f0d268cc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5868e6.TMP

Filesize
1KB

MD5
0b1b23f9b93e8dbe68d4ceabbea60fe7

SHA1
ffb6e333362813f79ed00b4fe5d5d3e0535dee43

SHA256
0035ed2e44564499c2e79c7b8b9a03a8b84c0667707a2b9ded9827f74f2a9353

SHA512
866869b59d8a98803e54a2782da57256828a838d6b8a278b8a77176807cf524bac030511251177aebc239cccaa690bb5f383af748ecdfb9813714b516552c2c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78de8216a80d53a54d51ec5f21015161

SHA1
9640365a049012d33cc5ba608cefb2976340e510

SHA256
2a6971e5b7f7424b1ce35fc58c054cc776ac3390796d8396b57e80a157b474f4

SHA512
cfc874bc9e44d11298cefb1b8dbe78c8e524552116be7cfbd4cd9a4d6daaf84e72ab00e155fa3a8c9dc630befa9b2916a1dfb9d622c06fc45040a161512a53ce

Download Submit