hxxps://verify[.]doublecounter[.]gg/v/5m2pz718

Resubmissions

06/07/2024, 14:06

240706-red8gasdme 1

06/07/2024, 14:02

240706-rckx8sscmg 1

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://verify.doublecounter.gg/v/5m2pz718

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1015551233-1106003478-1645743776-1000\{C293A15C-CB4F-43E9-8BA9-9E7D02265DE2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
1708	msedge.exe
1708	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
1016	msedge.exe
1016	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2840	1708	msedge.exe	83
PID 1708 wrote to memory of 2840	1708	msedge.exe	83
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 1812	1708	msedge.exe	86
PID 1708 wrote to memory of 2152	1708	msedge.exe	87
PID 1708 wrote to memory of 2152	1708	msedge.exe	87
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88
PID 1708 wrote to memory of 3692	1708	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://verify.doublecounter.gg/v/5m2pz718
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebc8246f8,0x7ffebc824708,0x7ffebc824718
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8150277871425620449,14453469483882445698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e81c757cdb64c4fd5c91e6ade1a16308

SHA1
19dc7ff5e8551a2b08874131d962b697bb84ad9b

SHA256
82141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3

SHA512
ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2e57ec8bd99545e47a55d581964d0549

SHA1
bd7055ea7df7696298a94dedfc91136e3b530db8

SHA256
a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c

SHA512
6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a1ab5c23c27c0a675fcd662c28b30840

SHA1
252563f7194dc7fa5df873cb41f6951405860cbe

SHA256
63221291ab3cf03529aa0441692544963ff9d1be9c44981b11667dbe21047a99

SHA512
de199f23c7ff02840a4ecfb92c1a979dcb42721c000ded1e8c6dfde3e315df30d29d911167343efef64630e374c8f2225a831aca4665befb1c27f4e428e8bdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b99edd98b63e645d0bc0367c45c92679

SHA1
628490e32141bbe1255d0060392cb1b9b2712203

SHA256
3ce8411bb46132b70d3736052b1164b79f070f0db0f11338b2cf96638245e2b5

SHA512
75e595c81f33854da54e5dfbd09be4a9dfc2dcfca766a855c4f5d223d7b2f7ba08abadf312b62bf254bbfaab33a81f1b744f817c1fe3eacbd2bf94b4815afc61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
020e3d1cf5ec4c820b37f9d4a5fddceb

SHA1
2ae81b2c328f947b0cba8440a96b92f098fe5f15

SHA256
da99d02644e8e867a33230e5acd26f983784c423176904bcf820c0d1bba912a4

SHA512
80b454379a6b5a32aec2f442c70fea4a2bcbb09d233ae83b44c467560e5c3a965fffcf4bf217d5e8c0e346f4243c9905dda3bcd8d225c1266ff9e3c668d16e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
09c60c4beffca97b75344b272b805099

SHA1
590f8aadef7e5ed7dcd085a1f9a4e8149ea85e87

SHA256
676e681ed02dbc6440a1037e774cc45351e01e4794d7a2e138d3c91cc25c210c

SHA512
c2e8f3e89ec11536281fe711e7e8f3f8baf79530c0db419613036b40c3fa4801f92e01702790e02d21069bb22e0449089a6a453529cbf5843c8b384c5be489b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5d701d134d6d880b2dbd568f94608971

SHA1
ab6e32ac4349dbeba020c338239cb4c87a67ffa5

SHA256
830beebb2c54456607a1fcb2e29179e49a6617aec4226938ac76fbb019e5844a

SHA512
b2e52675e107d9aa04630cf74639567055b6892cab35d78e7ae1930091ea753ac1c59489c940073f148d922e6c0f42ae9785ab1db04acc813957ad1d128de8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c40aa59f168a7ce3dbca0548340e247

SHA1
67a03cb9a473740c32bc1cd1e054a1f54e26d415

SHA256
227c302738e5f1d75f8ab39d29073b8d9d5172a9fb9dd7335d317cd252cd4fc0

SHA512
1df1cf47e629e9927f4e48fa2e067aa9a872e039d2a9ca9962eece5d90bc3eb3c09be43aad0f17ff0dc57dc073a27f783cc9202db4f1443616151945a103356c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d7226186f697e1560b899067919f304

SHA1
5a7011545bc07c7d15ed830ad308d3947bd90fde

SHA256
e9bf64bb53e89b4e47ed5a3326bf78e275e157870dcb9565a50cff689678e6da

SHA512
aa1ef2457216e4b1e6643bf998eaacdf6701ab1db49c1ecc7088dd5c5170a9f84a3376ba705857cd08e8bd56f08bfb04efb0642ba41484e238eaa820595f33ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5e21adc39706ec89d07a523630924ec3

SHA1
30dfbaf36b770cf701ce4bffd37d6daa5bc01d4d

SHA256
718e726f5ce68e247e072c6e107e3e0c50a760164cbc038cdab67afa92104565

SHA512
6e6ae0a9293dbb85e535eb6e0ea8b393506d1643a7154b3abf8b288f429763b68d92beb1c9a807fc85d678c7dcdc3894ad1bc05dc56f0a85b5eda9db69c78d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
865B

MD5
eecaebec7919b306edc76c7a7ab1b9a9

SHA1
740b7d88d46e312d405d5083c6f4754ce7fe87cc

SHA256
fc871dc70daffbedc2cb9fb1867bcb5c79a725dead54e81575f0e6346f91456d

SHA512
4d5b45c5345e0fee2b8edee9ca961c3e65c9dabf2e34e7d9b42bc24411e1da778e2e27e41f4718929cbde475042e9335595cf03053f4ce5806e33a095fa37cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db617dc05fb761b1a6fea2483dc0b35b

SHA1
19f600a08930da835d9176386ac7e54e1c8d5c81

SHA256
25eec3ee7404b63fb2c5dd3823530ed42aed5eb03e4ad149e768e7f59241fe21

SHA512
e8697d2234d9b85e25c03e3c64c8e4ebd088b9deba19b1295042f7aa7403ac74e329ab0f832ed80df4ede83a430a9b286e8a561ef1990f9edc41ca92bcef0e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7de63e6182fd0527bb26a3eb3452a06c

SHA1
63d3b7c281145daf0207e98f9a34092b1dde5309

SHA256
9bf40660644c5eaaf0b08fe45501b31b5205c4c05188666312f5b5e14f0a1c1d

SHA512
d57187adfbc46dd500d2218190a454ee4a6a116261e827f3f119ebdfca22aa7e7bcbd0dae3b1b87e6b7ae5f3f2ef0971c13d0b89fe9ddfe7f4166c407b69b4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c015e83e5fedfe91af3792e572273452

SHA1
7f2e683fbcafbd7f7010a1793f044414bfaea4d4

SHA256
85f302628b0b3231fd5ecb30fd68ea57bf330b20179ece98c96a0daaf4df8547

SHA512
f3d7407a4ecabb19ad6f00f817a3b6145598acc76bfa42eceed5662485a626b449edd7a5cb467b12a31390dddb560a343b68814b80a0f8182bf15518d00c1d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6c20f7870009f68e175c5c628b16d6e6

SHA1
30a1e89328993a7add18f455d517bba62d89c962

SHA256
b020ae196dc9596dee37b1d1e46a2d94256a7d857bfec4a9eaeb57cefba0e22e

SHA512
795ca540986e4f1289e67883a8334967b95e551fbf3ff25e27d62f3439b31883f9343c332ab811c239b65049f01923b1378b5778351f6aec23ba45418be83c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581fd7.TMP

Filesize
535B

MD5
665000df03c6ba61938ee1a983ff5152

SHA1
d2ba2d6cdd6a95b096a176a05bb53375a3db76a9

SHA256
82150a02c3f015137c7f5ce8462eac67c31f08e948f87fd873774cdefa550334

SHA512
0e92ac7d9fdbd669d6b018fa5814052b7c51ceb26f45d4cd1c134bea1a137a464130e909f69b0825ae22bc01e8f50fa03fef73b54501922f9283d2abaf041f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df0813c900e13eda9000aafe54dee42d

SHA1
6a3284f4876f037c4cccab7bbeba9054171b0e53

SHA256
e9a3f92efc3c63896b080589dc4d725cc5107e7c8ec92b931450b77ffb5d5384

SHA512
896aa7ae1a0061adb0ff60da156ec2e37737e603b9ecf8a70ec7afeded2535fdd2d7613a91154b581c39554c590f067ca66fb5e493f788793686d32e532c67e1

Download Submit