11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440

Analysis

max time kernel
143s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Incognito.zip
Size

460KB
MD5

0a6757a13623c4d9840b0aca6c243b52
SHA1

35804c36e9bccc5cac2d406d837fcc9e14060ac7
SHA256

11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440
SHA512

0110dfb0886dcb22b0cc9243f36a1ce60929d00712e31e3eb0e268f9c89d42549ad974377fae8ca0c1919c8b33c1277bdbfe7fb34154f26a5ee0cb7dd9b21e3a
SSDEEP

12288:LANUGCFJT0fU0Yz3jBL75xwc4XscIFl4zA6fzvBLrkwRC:LAmFJcKjRdxwr81FlQxfDxrk7

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
15	drive.google.com
32	camo.githubusercontent.com
33	camo.githubusercontent.com
42	drive.google.com
43	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{F629077C-ED14-4771-A910-46DAF7650304}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NoEscape.7z:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
4608	msedge.exe
4608	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
3532	msedge.exe
3532	msedge.exe
4560	msedge.exe
4560	msedge.exe
3280	msedge.exe
3280	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1840	4608	msedge.exe	85
PID 4608 wrote to memory of 1840	4608	msedge.exe	85
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 2272	4608	msedge.exe	86
PID 4608 wrote to memory of 1832	4608	msedge.exe	87
PID 4608 wrote to memory of 1832	4608	msedge.exe	87
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88
PID 4608 wrote to memory of 3456	4608	msedge.exe	88

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Incognito.zip
1⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffaa4c3cb8,0x7fffaa4c3cc8,0x7fffaa4c3cd8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,700220271837377697,16511281991500568329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0dc03376-6a5f-4555-bb86-40c358017422.tmp

Filesize
1KB

MD5
3222eaff926cdc327e84e00e7a73dfcb

SHA1
0af5c958701c636eeb8cc87f54e83b87ba7eaff1

SHA256
05516b495802b3c76b5c92c7db42f396b1f0b234a2025b36f278ffd904a1fad3

SHA512
f0344c357c98c636011b52cd03ab2682ed47c3d1b38cda2f8a1bef5c23f2bce35c9afe0218c4972c32ca7990839bf36d7210215a2840819ca6e7d9d6c08f07c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6a8cbb0c377a8e3d253cce9d9e2de8ad

SHA1
a718c38f716a6f97a1cf237d844bfc4e8660cc8e

SHA256
a4622dc6c3dc81d5b6a6d94cadfa31044663fe8b594f3f5769e36b8508eea517

SHA512
9eee1f9c2f0909de20c2bae24286dd83cede2863353edeafa1c09e780e2247576fd81288d8ece513ef3eb88129d066a16b8b8acaf3b657419642221ad91e1116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7147d147aba7bced292c49416a67f422

SHA1
d5dc46b5c4f55e48fdf1db69eda202c1c706b57d

SHA256
c07341da633c37887bab219ab31c3200263d725b2188228d309d70780e75d2a8

SHA512
1f623d8533a2fc6063ed22fe164557e1bd44472b20ff494af2bfcfddf282668c7ed9c81bb1ad1bec0ef4a4437b89fb00c91b95edfb8e4199629daef2e66842c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56d9db85671597f4332bc57f38f6aa8e

SHA1
78d9a2aa723502b4505bb098e8725c47afee812f

SHA256
99cc460429d923d80e01b964bb7fb40d3af17d3a32ad6b93386a5c4ae5de982c

SHA512
8440bb36a9d07ed83a9c7565f50b24ceba5342b93e5cec3567e42dee2c60e64f3a063fd760d4377520575b18ada960a8410e25587c0fff48b0caf0be78227ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8564d6fb1864182dfa62fa46e2506f9c

SHA1
f05541ace75b9d0b7976736bb8c835783a40cff8

SHA256
aff5e5471d07c884c444681bd69c2e107e30f0d56adca62b7e4bc3b114a27c89

SHA512
f9e07663f7835c56dc2f87a62a8fa58f1d8c89617082379ea6308c329663216aa7105f9108622463fe9aba5694835db3e760b8541342043cbb8c67a46caa6a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
040f8ad8e95942d349d06874127b1e33

SHA1
312856c4ad210ac7f3bba8949d29b0a1b4287560

SHA256
c5607a02990d6299d7ec1088d6ee2b5e68cb24609318b9fc208b134a0d9401f1

SHA512
b89c4e8cfe724a7e18c8fa794f6bc6fe90dd2f85eef0b8bce05ecc08cf0fb9e10582f29b843a4d32b7177f51c065bd9121a5a5c3b4f82c3f68ba9f055567df0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f31e859de2bf9ed653e0ae4aab77098f

SHA1
47cf103356449cf295502797bb43f242c3b4e98c

SHA256
2fcdd3a3627e1ebcf4698e081cad95a70f25f0d3839ab233cfa298ca02bfb866

SHA512
02ee43656806d6ea2894807447d7ef482a797c3dab562c9857818fd034b23be45e8081f3d91145f1e658654f343cfefa3c3d3a531d1a77baef6ac58643a2eaeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79236dd14b954bd59a4d9c0da46cd885

SHA1
a33204d67b36b24a0f57bf47d3978fed0d392366

SHA256
40a52bdceb29baa4a109a8fdebc0428151f50d23f45aac682efa36af9c6b18a7

SHA512
1d6ef556cf7186c1e02b266240e6c949240a2253526a11b7f642ab61a4baa39530863ec3fc46c0ce45692893625b7bc928b8a48f4b0fac5973a0afe1740c4f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
388dbdf0a2155b8168f4e6b3d90cbb8e

SHA1
902d3c3f4620a34d70f7a286aa154c3497b096e4

SHA256
31ceb80ebe7d88bb529060f8e0155e45dc3d1ca94842b5c1844d32223417a420

SHA512
5c252e32036301e584a0591ab9465eced0bba345b419d6f33ffa04d668e9d937f77859412d335ffd4579dc19028f4b9d0567062e50b2876e1e57801ecb7dd078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583fc3.TMP

Filesize
1KB

MD5
ab5de4b263a2c277b1c8a4b6d2feb522

SHA1
a473cf71f1d89f0e6d62a83b31048253fee5d9d4

SHA256
1032e6fdc5415765abf5db0905644c6b98af140f99632365b77ea59716c2308a

SHA512
aa120d5b8e6f31a71735a3afcb472ee96d1a596e42b2760f634accb495c7c2b67d71418d37c9bd7e4bf9a1a07759c1034a4914c3a9876448a6bad834ba041a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
938c9c52165809b5101ce7e37a566b36

SHA1
09dfe7a134dcb0a5987471ad6470fa294bbbb319

SHA256
ff110f83cda7d9842711390dac5e86bfbf118b2277d62b17825eb35307af3456

SHA512
9e9ac2be3e70d6592bb46ca6828ae5763bdc16ae307bffacd976394f98e1e95a452f59f494fa5cbf6ae9b36fca66f0cf95d10f19f64aeed383afec7d9302b8dd

Download Submit
C:\Users\Admin\Downloads\NoEscape.7z:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 3013.crdownload

Filesize
617KB

MD5
633348e013a0f26636692f4fdea9814e

SHA1
06fee52d37c5f604dd8c38ba1c13c9c4fe503f8b

SHA256
0f3338d8ac521cc76377539cb7d2fb4ae724e9e88ab6cc469017a481c3ff466b

SHA512
37064d02b8a6bc713088fbe0f72b072eaf4d9a24e99368799d0a63f332475a8a37d441591e01f1ff40cb6773a4c278f87f91dda663a30bee5bc9d88c5e1c88d0

Download Submit