hxxps://cdn[.]discordapp[.]com/attachments/1271300788429394073/1271676610374013029/Windows96_-_Jaguarandi_Masterclaxxx[.]flac?ex=66b834a2&is=66b6e322&hm=973ed0e64c2740a3532c8a5498d6993367107605ab6ad74577b1e128feb96b62& | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1271300788429394073/1271676610374013029/Windows96_-_Jaguarandi_Masterclaxxx.flac?ex=66b834a2&is=66b6e322&hm=973ed0e64c2740a3532c8a5498d6993367107605ab6ad74577b1e128feb96b62&

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{0668FF6F-A34D-425D-9A2C-0DC1C05B5044}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
952	vlc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
3252	msedge.exe
3252	msedge.exe
852	identity_helper.exe
852	identity_helper.exe
3832	msedge.exe
3832	msedge.exe
4832	msedge.exe
4832	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2852	AUDIODG.EXE
Token: 33	952	vlc.exe
Token: SeIncBasePriorityPrivilege	952	vlc.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe
952	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4456	3252	msedge.exe	84
PID 3252 wrote to memory of 4456	3252	msedge.exe	84
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1212	3252	msedge.exe	85
PID 3252 wrote to memory of 1660	3252	msedge.exe	86
PID 3252 wrote to memory of 1660	3252	msedge.exe	86
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87
PID 3252 wrote to memory of 4192	3252	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1271300788429394073/1271676610374013029/Windows96_-_Jaguarandi_Masterclaxxx.flac?ex=66b834a2&is=66b6e322&hm=973ed0e64c2740a3532c8a5498d6993367107605ab6ad74577b1e128feb96b62&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe664d46f8,0x7ffe664d4708,0x7ffe664d4718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Windows96 - Jaguarandi Masterclaxxx.flac"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1080 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17865681090467521566,3297534300398459503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ea7d597506fb9ddc411308040902db8d

SHA1
9a45def44a270c5e4b6f78ae94bea794398acc7f

SHA256
feb6bd46f415dd88716f1cc0ce41aae7637167ce784a18f3b1f6ab8578cee39f

SHA512
8b44f2d96c19a2ef2b8ffd069e9036e562fce5f75cc936cfbd8cf35d90f5f69d58dbbd30b443f43cf0111c946713a5b4d23cb97f0842c8b9fc46a8d60b987e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5058b90ce43a13570b9739491beaa7b

SHA1
879c28872d81ccacd4a0ea9473ac83733d7af7ef

SHA256
d8614b9f9fca8ec60636bec435fcd29119c2997efa4a472e8d797009752b4e0f

SHA512
029f6663a896a62923f57639d674bc3498f5301498f91562867760ac2230ba7797220c5625606f447f749b5a175fff74e01b8500adb1309a82b1e59d104075ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7b2e1875d02e6a5502c59a8fa963350

SHA1
061b6779f224fdebcb96e83ac72026037be315ce

SHA256
298fb8a917f41a4678dba4b10019050e1fcac79e0c2db8bc554e7fa9c4ac5873

SHA512
eb9c868b6954d28a2f5b15874a5d79118e6a5e74821e83b68997c0216d595a3d557a16ec6d4a2e1983192abaf974f14d33cd4e87c870b8b212d933d02ddf05d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c48078c69d623aee9e55aec0df30888

SHA1
e615a40b0faaef92062965ca03f5c92a55217924

SHA256
d1ccdf850139e168460ad862eba44b889212c628a01fd4beb5d05feabd8f9475

SHA512
8b4bd69695b1230c8b652d80123727af59ae300a6a2f4b98bf71c3808adcb333dad367ac8f3d837ea45885de2115a4197561bbc91f6e8e8cd43e5f929ce89620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5cc77e568a975a72b6525efb35ec0692

SHA1
4c2eaacdf6ed565a9718d580eec075a0c07979c2

SHA256
7063f04f121c93245e64e476eed6dfacb2d0ebefc484f847fa64f2368322bcfe

SHA512
40dc60c69992f40122b8abc3bc15812378b56caf0834632a4dc8f2bcf42f3c8a4ac3071013b4d6e36610f82ff1f70ed1a4442d30b2fb66443699c032cb3e9da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
016f360580df1821775873e07686d2a9

SHA1
e180713e2a6a82bca0c1e8608ae54d70c336f67d

SHA256
7613bd14c28f54ef939dc5fd039f4a0b41468384e8c0d9525a358f9fda3f46f8

SHA512
efbb86d51aeefc35b880d7560f65a3c0ffd01ddf6462e0c12c08cad1281e5d23bc9ac9c2875a6025cc564b2a8efb0297e555e6244d481d87e9406436022c619d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1cd3c84cdcd41ab4b6c3e5139e5a83f8

SHA1
5637e1416995a3bcaaa25d165b7e82806b683d23

SHA256
46ef5fd04da2f8bb1d0a98441bbc4260274fda3284d8697bf25863b36e8edcd1

SHA512
eb6e39f6e5a840c57b14ece752f20ea82ef156fd3c360f486c1790f3fc3d914bfe497f97775dc9352bdf20e7f2b5d91c822d82aa502f7b5eb8278df44ad3a97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
433522f4c20ad940af2d065a361f7091

SHA1
2927a64e1424c9fd03783d5c8581fa3c0e8246a5

SHA256
0c92a1fc6ac62c3ceb8839fc30981fd7396aca0782f2f3d9c841fc965e04da94

SHA512
c387b470335eace1c3583b72d3a3a35ad7642888369a983552536ffd301d8094afab355718565c6090686811047ce4bd627aa853e4118b205bc92501787b0ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1466f543a3814e4d2fbd04d990d7cc7e

SHA1
ed48962f1e5bf139c46ada1940534c2c21bd0178

SHA256
534626f1d68144f728ef39ca25f82c816da2987a29103e183b69b49cf91ba92c

SHA512
b68e5d9bb746c2b651aca38181b957901143406697551b9563309d2900625870985d1130ee807ebf503ac1a4e972aa8c70e26fa35204a2ea22b7f3b99a017e92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Windows96 - Jaguarandi Masterclaxxx.flac

Filesize
32.8MB

MD5
1370274b40f91b8b52ef5e7fb7243b64

SHA1
2c03d8d2b54fccda864f5452a14cd46c09e60dbe

SHA256
0a4d21b4b7dffcc15292a471778d5570931c1bedbab93b7ea5921f882ac43085

SHA512
e805eaa7fce6f5fc8f6845d5f9e96240618ae127172c2691840cca2c0083826dfee607480b7adb7d323351a27204a34f31e88a0d5aff72a68d4a82b672211977

Download Submit
memory/952-124-0x00007FFE52EB0000-0x00007FFE52EC1000-memory.dmp

Filesize
68KB

Download
memory/952-130-0x00007FFE518D0000-0x00007FFE518E1000-memory.dmp

Filesize
68KB

Download
memory/952-129-0x00007FFE518F0000-0x00007FFE51908000-memory.dmp

Filesize
96KB

Download
memory/952-128-0x000002A0CF850000-0x000002A0D0900000-memory.dmp

Filesize
16.7MB

Download
memory/952-145-0x00007FFE52FD0000-0x00007FFE53286000-memory.dmp

Filesize
2.7MB

Download
memory/952-144-0x00007FFE53290000-0x00007FFE532C4000-memory.dmp

Filesize
208KB

Download
memory/952-143-0x00007FF6C6690000-0x00007FF6C6788000-memory.dmp

Filesize
992KB

Download
memory/952-146-0x000002A0CF850000-0x000002A0D0900000-memory.dmp

Filesize
16.7MB

Download
memory/952-131-0x00007FFE518B0000-0x00007FFE518C1000-memory.dmp

Filesize
68KB

Download
memory/952-132-0x00007FFE51890000-0x00007FFE518A1000-memory.dmp

Filesize
68KB

Download
memory/952-118-0x00007FFE57AA0000-0x00007FFE57AB8000-memory.dmp

Filesize
96KB

Download
memory/952-119-0x00007FFE550B0000-0x00007FFE550C7000-memory.dmp

Filesize
92KB

Download
memory/952-120-0x00007FFE52F30000-0x00007FFE52F41000-memory.dmp

Filesize
68KB

Download
memory/952-121-0x00007FFE52F10000-0x00007FFE52F27000-memory.dmp

Filesize
92KB

Download
memory/952-122-0x00007FFE52EF0000-0x00007FFE52F01000-memory.dmp

Filesize
68KB

Download
memory/952-126-0x00007FFE529F0000-0x00007FFE52A31000-memory.dmp

Filesize
260KB

Download
memory/952-127-0x00007FFE529C0000-0x00007FFE529E1000-memory.dmp

Filesize
132KB

Download
memory/952-125-0x00007FFE52A40000-0x00007FFE52C4B000-memory.dmp

Filesize
2.0MB

Download
memory/952-123-0x00007FFE52ED0000-0x00007FFE52EED000-memory.dmp

Filesize
116KB

Download
memory/952-117-0x00007FFE52FD0000-0x00007FFE53286000-memory.dmp

Filesize
2.7MB

Download
memory/952-116-0x00007FFE53290000-0x00007FFE532C4000-memory.dmp

Filesize
208KB

Download
memory/952-115-0x00007FF6C6690000-0x00007FF6C6788000-memory.dmp

Filesize
992KB

Download