hxxps://silo[.]tips/download/inicia-utilizaao-de-sistema-para-otimizaao-de-custos

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://silo.tips/download/inicia-utilizaao-de-sistema-para-otimizaao-de-custos

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1750093773-264148664-1320403265-1000\{7A571FD1-18C9-4F81-B72C-A0A4B9B1C636}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 130311.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4972	msedge.exe
4972	msedge.exe
2496	identity_helper.exe
2496	identity_helper.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1088	4972	msedge.exe	84
PID 4972 wrote to memory of 1088	4972	msedge.exe	84
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 2900	4972	msedge.exe	85
PID 4972 wrote to memory of 4416	4972	msedge.exe	86
PID 4972 wrote to memory of 4416	4972	msedge.exe	86
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87
PID 4972 wrote to memory of 1420	4972	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://silo.tips/download/inicia-utilizaao-de-sistema-para-otimizaao-de-custos
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fdc746f8,0x7ff9fdc74708,0x7ff9fdc74718
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5733630023633947519,3121921304083533169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
52KB

MD5
66c4c0d65346737905bd39543d308803

SHA1
305928efedb9eb2dd81130ac2a6258beee05eade

SHA256
6f68cd908a40ba36816a357d6aa766a7a89bf322cc4f91127ad8812b95d75852

SHA512
57ed1ccf28da74a70f1119d9552356a2afbf8fea660ee4de30d1edfeaf6c8ff81b954b46537cbe7bc5a0637a8f38766558ad9e5ff8386735b7fc0602e1ebd2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
142KB

MD5
66b4167a067765d4c4bc29cddbc0f8cb

SHA1
63f2978e6953b01cec39bd25f5efc22ca23ac2c6

SHA256
bb04db17d3a6fb96e4199b19283e18ca790c0bc2a40af3b96cae7bb1d3cbd6f4

SHA512
e67e6700d9cebeaddbec1a8a408ff301365664be1a98419d4ce6a49d97bba5de235766f377efca8d31278158abdf2793a63cc356341daeaf8e7b3a0d1354d966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
91KB

MD5
40aecc940f22ac56a3a7b99b87671c28

SHA1
dc39a739f59c094e963a5bc855a16436a1f4bfc1

SHA256
0901f7438a7cef6e4afa4de7c755848aca4ff6cb479c6beda2ec0668deb464c1

SHA512
4f6f66ce0b665e1fc7730dc0879b1eb1081efb90aa920edefa4f3a9ce21eaf2e5a37f91feb4c22855d53fb8ae441fce888c9a57f76e26f480e98a0305095cf28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
b3b71ef77841815c899ae8370085d7da

SHA1
f7362b36e1ffecc7f965d4eadf2fbb4cac25d9f6

SHA256
7ad1f40d9814673dc1e07f1517b9b535431fe9b028a6e9eecf650e0be2a03cbc

SHA512
f5c72cce1f7c5d5bc98573339e443e8089ab8c5d9a1826b1faccc3cbacce0011a1192cbdbbd26167b1e435212466bda2c64a9aabcd32b85aef3ea03035f7963d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
62KB

MD5
0c80334d0d604ec18274ca386da3cc20

SHA1
7ad48f6e38fc58bb7ce03ff0e7fcc7f68f19c2e2

SHA256
eab981b59a865ba5e00917ec3fa2b94baf7c216a98ebd06c23d0ce0f135df54f

SHA512
53036cd1ceff91f7e17b2d80d4880d27e9f49bc5afdd739d6f26c2d03a80a08c044f60528be8a8b4fb1ca6a09a0f537e464c1970a2973e8e8a9138e739cc94b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
624B

MD5
31412488b1d2de72d96c0fa46fe30416

SHA1
07fc31ddc50a40f485e7266f7760c367b39ae080

SHA256
53ace83c85e7a93b4bea0ef30ad29c94f2626712a535c79a416bbfa88f38d34e

SHA512
246c5c6b9019e7c8b8b826ca4a68220bb69e059361a58cc821ad1fde604a7ad57f3a1a8e1dd052378ebeb535e71e096f7239484fcabcbc0171580820d07e5fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4008429fca72b713615300f0cb9adae5

SHA1
6dd4fd62af9fc51fb2434bd209a8d97d8b777755

SHA256
b3d2ad3316fcf1fcd441d2ca1a96cc6c4766ec9287581c6fadac1151b1b4a189

SHA512
3ac1062ba5105a9ace7cb26bc932d2895e5bdc34398a47ea99e2aaacd784d8b0804869e77a9bd7ac5168296aeb9ae609efe91d710af5b0f6a944ca615277cb33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bb32d3f5d96d4889e921f23fd67ba1bb

SHA1
23d913443d88422b99e238e36a3ccb3101ffcb6e

SHA256
516f3150e7dee720e32c47c450d3264c967593e16e015e30622af30c3422b204

SHA512
e3f85493b97faf71135fd15a5ff5ac79d47917dcb1b75bca9e1f377792b35bf778224d4b71dd6f121404b4fe0b41192651b33a946647e10bc2b8d78e563a67a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86ecdbb3bd92c8792202372fe111e518

SHA1
bee6f0ff23bf25873e015164c6c02dd82b57b9fc

SHA256
ceaa9b0e75cc82e7d58d7b5573a9259d04778e2bc9b003a746706a16e5a7e1cc

SHA512
ba8a14de0d81b98c8ce1f189dd17299d4041adfd7163805eba61c1729cc3318f396f15ef8e0e142033b7ceeeaf3bb3060355d6be3f611ceb4fc33883ac2ae99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d7c06084cb06be5ec359bb0a9cce2426

SHA1
f243c6947fc44f12f012a7dfd3e5fa3c69dee8f4

SHA256
08d4d9d5eada0e04ccf555997e68a2de0b216550a5de0bf82a8f4cd3397c4504

SHA512
dcb08d00dbedfde13bcb7a8d451be4ee6d49a4db0116ee360536b85038ed40c24eaec47286bb7b963a20d216a6cec2d0956381306756c74f1882a807df3bb259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fcf9826032b8576f1a6e51723d47424f

SHA1
6c26ecab1f9aed561377a59018aa294165b89220

SHA256
95df48ba866ae89ac8f23d972e191c24f167e85915a5fd1354e91e6045f1c073

SHA512
3eea6ee7955509d4c836067d1bed51c31d7902c8fb72571ed35847f2ae4cfa6ff245d28434ab606fbea18aa69c6d6a0f63bbde066c9a32a0a5a7492bebf0c6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
866d45748e0dc387dc5c8b30204dd920

SHA1
79571f60be786b6fff9b1ceee75f008c1773e009

SHA256
e0d329f80b489f34b979a79a7fc4709689ae5f77dd68dda92b8ce18125fe0bdd

SHA512
b6313d7bef2d82595b189980125a70acb08175300a37aab51f717ba6f1dbc39b4dc5fcdf4cc4cea8e5593389e78e587b226992b0f0af2582fcece7f0e06f1dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
283641047df0487c6865b4430d9e6bb0

SHA1
63c87d423e605319ff7e71da6fc0f5121b78ca72

SHA256
4a0df0953da21524d87eae09d8ca46efdcdbe6c61a9f7e0979c6935c4983f984

SHA512
01e8cb4e5cad1f1bdcda93105a985241af0dbed50fe392359ddf4a10d4638c55918867d10c3cde28a2f4120b6384b41ca6eecb85b2faded9b45fd2e6e07748ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
701ac283f26ab713fdadb98e30821928

SHA1
7243f70b730af0ffdfcf6b35479f62fe50187426

SHA256
246978db15eee7a3cdca42d8763dbc58e2c04ad16ce5e7a60613cddc3f0e4a25

SHA512
2af46418334a770e4b5b3faac2b0d15f79c883b6f5ae9cb682429d19d4db7fa9bfca2636fc77d5eadbfe0d09787e8380089880a6f9cc8f961e7df5db310340c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ff05f40c1daa83c112a4dcd3c1769865

SHA1
788572af731f6a3e2e4441d33018605be69ee7f4

SHA256
bdd37ec0a9e6fe8e4df44c85c4103ace25e19910a49fcbc95b301b425851598a

SHA512
a605174eacb4c73c49eb080bab16755049e2b90929910334aba9b5bb95221d8c4be60d801730394456bf17e2cddb67fb0ac17ee1d24ca38b9a5ff92c164b1c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b5ed.TMP

Filesize
538B

MD5
6c3eb708a0aa59ee740a2230e688d23e

SHA1
e9e897ffeaee58cc2e26090c767ff6f5d5d7f15c

SHA256
786a24784a8289cce6e80a46abde335f75b684fbaba7a7825d4337343b8f1ccb

SHA512
d97a301e091df01dff9b439715ba5e0c663387427b43bf97aae7bf9ec0217469f9670e5aab7a8369a275db51ad07203f065b5db7279a62ec62ebce562245480f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57a8f13e1ed06dd345a2c815510ccb15

SHA1
dd61b745a3f85224cfb6edd7e3f3431c2e6f9a74

SHA256
9cf8f4e38ac900c2a59908ccb0baced3119e20c0bdd9fb7f1acc4ac4b856e028

SHA512
0e53f9fc17bd1cb35dccbd4066746a9c9aca221c5b5bc83d49c69a7dd099b35283d3308763411ca0db208b219efabec366d9e7ae0a6c203a5347127d9994e5ef

Download Submit