hxxp://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd[.]onion

Analysis

max time kernel
208s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2650514177-1034912467-4025611726-1000\{8DA2AA5E-8883-4523-BE8F-50E4A77CF46A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
2736	msedge.exe
2736	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1412	2736	msedge.exe	84
PID 2736 wrote to memory of 1412	2736	msedge.exe	84
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 2140	2736	msedge.exe	85
PID 2736 wrote to memory of 5052	2736	msedge.exe	86
PID 2736 wrote to memory of 5052	2736	msedge.exe	86
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87
PID 2736 wrote to memory of 2396	2736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab79646f8,0x7ffab7964708,0x7ffab7964718
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7495993496541835827,3895314732390145202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9ca4f0692d77ea8cb60d8efc4608028f

SHA1
0e8613d541f91026e6160abfad138815e1ecc327

SHA256
de76021f5d3b69db3c300d6dddd6ce1dd399f111ee7e7366c228242043108245

SHA512
fcf9da8063fb43ea39cc63554dd873f32bdae66bf32259ad883fc0fe66bb45e3ac48da08866ebe868280f6103a78e465029d60d7d7e1f2c6144c4cbc4fb724f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
808B

MD5
2e382e123f26d406d744707eb84d3179

SHA1
8998e3dadadb9aaeb4f2d01d81c771411a830e4a

SHA256
3338c683c3740eb98ef79389c42c9e776241058b3f52060e7e5c5aad2a819b9a

SHA512
dee0c2d31ced8803cbb2870bf1a5f9ae16bc4337633a5c0a1f511db14a1497b12d28ca58d5fbdd39d8c00ea35d1f4cc2ab36543a751356ae008e0c7c79e6da4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04b41e4924712092bf6c087833514b2b

SHA1
cd7aff44f5b1684edceef0496471ae93386756df

SHA256
c22803b5ddcb3aaa26f47a9d5b7f975cb5068a8feecda26c90db69c2fcdbcfee

SHA512
5f95d3ee919918bd73cbcbf5d4652943e5548030effc0e020b0c972413cc662ed78611bb15a4db8de122aa5e017e3bebaab8aa0fd9bf1a1fd0b2274dff8c5bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af529a59f8897467cf3adea65a4a34f5

SHA1
027981a0053ab497f879e52e535b942ad34f6866

SHA256
62313305c5ed6966319b1593f5d71f5c6b289f333574fe0e18102ce70e9da77b

SHA512
d47eb17a621de7ca7ed76348660e77bed304f86e7cf88bb26f53f9bc0d4a07ccf1e69d7346504c6848458225bfae3e5bd83a3d5d0fbd0594eb18a98502a09256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e322782048666d51a04952b094236c1c

SHA1
695b05b47bf6f0f334a7427125fccaec393f3b55

SHA256
2f63e5dc43fb7586a10b6988b7a1d58935eb182a7fc817838e7c6942e85f236a

SHA512
c0e7e7f080b47de7d6a84e8a11ab244844224ffb5b47e13ab24c97952d22a7adfb834884c3281edb2fdd8470c7a7cfdd788c57447ade7ef26445cbeb97d0d17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a81f893b2466e3b8f15701093bdb024

SHA1
492d018d96fcca937f1c4035eef18b3d938cb66f

SHA256
05f84202e2ca97e66e5a1927cd8b39e143b68379c686290236bf999f2c3abaf2

SHA512
f332cec7520a4da9db745da270683f5b246aff4e58491ec8251b249c180459bc75ba275882cad930e7ed36749957f2ae06a7d780099a18a1c06b0edd50b57848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22785e3d6197a052eba41eece73de26c

SHA1
01de2e67204dc0466ae6411c5517c9ad68f5837c

SHA256
239fe203c94ccdf07d7cdededf7dc0be4a6ac5ae2264b49cacb1e07dd7ea3888

SHA512
cdec6ba4537a3f8cdc66b7f1043cd05db930206f27044cb9a25126878a0d6045b2e127a156bce878106c265c1df044b10c749eb5768e23c616c89495726647ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
0cbaeead2a2d7835da0833b023cba326

SHA1
6e9777dd51fe4d61577ebb4eb39d17114e4cf9ff

SHA256
35dde76fb526d5ffab7e5426489b26abfe79957803136064943b4500a1e3fa4f

SHA512
2a47fc3d8338235ee4e678377005158da7af87fe4ae495a0cc36e869732322520bb97967549a51bbc08477276254df425886c04210d33a3e8b5229879a3aa7b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f46b85f250619878eaedc8d98d0033ab

SHA1
ce101112a58e35bd05020cbd3d40e636be738b6b

SHA256
a4f7d531fe0b4fe60141186b91c652cf54e76da3b43b83744dc7e49acb867ee9

SHA512
98cf2ed656a10269e0e56a5d938d8c0f497aed30d0b688b1842912426d6bcd59f6f427de367127eb9db825a7005a092afc73633be183f28f8d159042d646b745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8345b240cccb93dd3e338fdd60ab024c

SHA1
e1c736e8b4e895de89d2aaa738dc9adc682e200a

SHA256
591dd484f5cfc72d7feee40c7309404e5fd4f3f0db0fee9d7045b0e741d40b21

SHA512
d1599977963962846458823d44a5dae65a934cdbf04158b115b80c277504a337a7533556ea195e13ab0cf8056650b69dd536e615045f9048d19ab7486c7352af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
475d6cf45ddb876564871662a5698b64

SHA1
c7e913e9aa6ef21a942f21a01deaa783499c953a

SHA256
631012a7b000d65855b1338725d14889b29989080110a47f2aaaccb70620bd92

SHA512
ea5954a399323a1f859067815c506b0771043004dcae0d4a41b43e874f517ea3c22460b0ce0ee915a1b19fbeee4d4a9897779229b7ff910b27428fa2f9b34fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59698e.TMP

Filesize
538B

MD5
df4a2a1daa3e74a2415bfa1a8ba6ec65

SHA1
5fb7798ed0c90bf76641553817e4723370da375d

SHA256
d6b2b786a8cbe07e20439798b78eb116e837682cad3dab33dc4fb811628c3020

SHA512
fb28486444380baca8bdecadc69e0f6c5ed13026674dab9c3097e90353b622c030b59b2561f204052f12223c885c1dbd1bb81737ab66d13ae7e32bc1ecf56643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d4250cf69bbccab6b825364c9b87f550

SHA1
823b12e2de3177e62063970f3071c9d3aec101b4

SHA256
9a8a9f19d540e6da7f962a4f92f4d5ea2ef1a9267c26548a8f7d98a97dbdd98e

SHA512
e2275d08561ae5fa066f3d45ae4d1a0f2d32dc1b37969db2c1209fa9b747072f5f0e103c37ddf8dda5081753fc563d8f2e9d54481ee415decec190f10e50f459

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit