hxxps://www[.]mediafire[.]com/file/kydby9iy7ks7pfc/KASU+V5[.]rar/file

Resubmissions

23-08-2024 07:51

240823-jp4xwavdql 5

23-08-2024 07:48

240823-jnfhwssdma 3

23-08-2024 07:45

240823-jljsjavcmk 8

23-08-2024 07:42

240823-jjnzgasbre 5

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/kydby9iy7ks7pfc/KASU+V5.rar/file

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	101	https://1redlink.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8b797780999e66a5	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1852	msedge.exe
1852	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
5916	msedge.exe
5916	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2140	1852	msedge.exe	85
PID 1852 wrote to memory of 2140	1852	msedge.exe	85
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 2244	1852	msedge.exe	86
PID 1852 wrote to memory of 1920	1852	msedge.exe	87
PID 1852 wrote to memory of 1920	1852	msedge.exe	87
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88
PID 1852 wrote to memory of 1376	1852	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/kydby9iy7ks7pfc/KASU+V5.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff914d546f8,0x7ff914d54708,0x7ff914d54718
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10738807292588947536,17173392924990212576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
c4cac320b4d35b55f4f0305c7e6d7cd2

SHA1
3cf6153dfc14845fe8de9b664d68d2da52af7ee3

SHA256
9f2423437f8564211346635cf33b0623e397f2fa68d2f69372e87031d2cfebef

SHA512
744e8aa6b6787eadeb21661319bac3b2ae6f90992e151960b843126666db068c07c368ee9f3d8a8da82b7cced01549cb6c424570abcea94074c4915a898c02b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
83KB

MD5
ba0dbc3e85a6f7b854fc9c582f8d67c6

SHA1
48d52e5aeb7c33201076b0649b01260e5d2b3ff4

SHA256
1c84803141bb51cb38687b0b2f69081e2bbfddc5030408c7a3ef6a5f4cdc6816

SHA512
b1bb69258c26b1a2d51ccdeed505387703f0f2cfb53789ce02bcdf81ce3dbc99f8c262086c7562f9e9c0d9950dac4154593be3fbd46e7b7df6b097ccc026b2c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
108KB

MD5
9cd73b56bfb6685e0b42c2914519bebc

SHA1
511ac4de91bfa5807becf90bdbed4517b1becaa6

SHA256
ea24b3d3b35c007dbefef62471c7b0c5e9e28b531061506381577870ec53c4f6

SHA512
cb9ae89b40b9281f003fb6274a729466ad0333087a7c2529767b39c8f403c5f610d56c547eae1fc836f105ff00ab8a66d05d7f565453e37375028440779681b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
71KB

MD5
83a365eb4edf510292155e6d37f50dbb

SHA1
7f152270e58a75a5cf628a57d0fb400f098bd3a2

SHA256
4c5af35c6200b96c441a1cc42d1043d56ccb7d2762aa70eb1cbc046545f82109

SHA512
0c29259aba104328ac0182427310d58819146162b6b57d8dcce02785dfd16e24b10e5803c7d697cd9aaee590f10dee6cf0d999f8563fb9aa5d60f6d936fb6460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
6cbdf2acbe4a1d698ee6aa879721ab6e

SHA1
88b804bf37bd185d7d735ddca8ac22d2b31c7637

SHA256
1215f4dc3632273b8a70a20b336e2a0ec6cc87c8ea1142649f04712c1d8cac90

SHA512
e90ac60d231887da9c20803e7364282498ad2a89ab89fff20f4baa094770b175f2830bb2c5a40461829f053a4048e07e3f505c28844f606030bec32116ec812d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
e049e4b739c2207ee4c14a9c51feb0aa

SHA1
ed517de9a6dc07c4ef81fffb5ca1433cdd1f20d1

SHA256
db2be4f41acf778b3a38b548a28c65b9717a322bbaedc1a5c9fada10e1c2f8e9

SHA512
0672734df0c2ea26714eca3ae8ae2e63e8c08da26eb79d519478166f44f352099fd88e1e6184eae23656aad601630eabca70e39a43855fd56c4ba1f781578d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
64cbc8634ede93b8ecd883c27a1af8d8

SHA1
e6426c3a736165dc05b22005bb3e9f3e6d12fe96

SHA256
b16cb30b8d1a7235362e2b29d052e11be1e68e1f26a3bd79c0e9fb69d7254404

SHA512
72bca3be3e16ec7f900f898e52dc968516180c79e4276e2c083578bc8b4ab0407dd671399b57981b93d7017ddd6254bea24eb12650322c78604a49e5d7fcaa3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
87ab1f0d8234a02cab5fc94be9f236e6

SHA1
64ae2d245b0ebe25c658d65595eba6130c564c9a

SHA256
bea46c88d26cf865b4bc1abde4938f8a75126c5a671b3daf6c97a3d9618e6848

SHA512
d5d2c2cfbfaa3ec33fd040bf0b1cec2a40df0bb39dece21037deda8dfa241ed9c7c24e21c8ff6ce3fba6313c7dd61bfca5117a4d60947f8e7dd4244d99f72346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c68bf2b80afcdcf5f976131c197dd2cb

SHA1
9b7788f81764d744b15a0d9f34add6b3c7f14f8c

SHA256
f8fb57b46b8565085a53442ad60a75cdf616fe17352387b648108ffaeec7bb02

SHA512
dc3a0c806c1c6cfbce60a62d1570b0fd3b8e5973d9712f49db6c19f23fa401dccbe089827554e8bdd7809b4d6b53b603f7d918eab738dc5556c7c1a940b3215b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4ed41fc3a885f5aa99a788ade9e60987

SHA1
cc4fbefc7684252b8765c462d13ca05dba4ceaef

SHA256
a1da45b3e0d66a24341221009dec3d78974cb3f877c7ca0dd309a44b54569767

SHA512
7d8f3f7180c0534b9abedc4aaac9a147577959f7560fa83e393d9cb868d35f8e1de45a4298cca5b81902b678da7e92649b34d7ea9181545948e4b81647f60ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e416f763fdb824863b63f1620ea1cf70

SHA1
9809388e5c799e475b672d529c4299961c96f5d8

SHA256
b835ab91ab420dce27b9875ad27060633f76af3b00d44dc556c1e4b1bcccd1cb

SHA512
7bffe6bfdb97c1a945fac41b30f2fd225887cd39478159bcdd88598be7751cb00b48e10ef95ff25a2b61e7884aa4477690c444678577e321dfc0f6c9ac22f7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
77a4cedf2e6eef10283cddd277161507

SHA1
9e07fa3fc150e5034e8da1993c7869f4dd86e256

SHA256
761ff6cd98d78123b820bd05900146932d7bbf998f577b51dd090c592fe21c7b

SHA512
fb81b546ccd4c6ba9419a3732702dc938c2c48a8d2dd9c7737e2e26e8dcd92f62156129229d3a603dc509ba1da90eee43082041dd9f4031031bbe1ee85507def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acdff1d1415c8496eff993036b9eff96

SHA1
91df9ecdea1a0bd914091acd0c6455e3a915cc03

SHA256
f9a21ed7520abfd8685bf808879916a7f119f9d4861988a5e26c7bf27c8bce55

SHA512
0a9967906e6225c5795e88a5184b96f7a195b649dfe8f33c309923967889c2bc7049e5ef3bdd0e5d3e1c2e0b89d76daebe54f10fced7f7152c4927c75a082af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8d94b71df49f0198360369543c0dd44d

SHA1
af3e5caa628bfc691773d6690a13c7ab0794f70f

SHA256
9f4f5224ce6e1aa3e5fb7782d44161f318b9c3411f168d9f834b641e04294522

SHA512
fbab6bf35758e2e3e4efa0b23dbe92779f0ae0ca3aa27bea5945d2b59877675b58c7566c274d87714eb826d660f756042edcb662f5bcf910c7ea2b151764ff23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
494a553cf11762e610d903f9149f6f80

SHA1
1f82f3bfeb08863955b78a2ec1e83adcdb8eb4ac

SHA256
aa8add9661454b583ff99f87a9bb8055054f31818274243f8645327f65130582

SHA512
374e40e9900190c37c3e126efb8adcec873998b683c830b78fef4d289a8992f69d8a4c9786d616904723de929ee9436b12f3d86d85e52076e5e50c27a6ac4930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fd0460ade35aecb7ff5a7b2f2ccd35a

SHA1
0b253d6eae498256e365b25bd239b75a03058442

SHA256
440ae95fd2d5bcd90be3bf03b8dd770eb77ea0d7d3762ca42addd56636cc0b02

SHA512
98165bfc0f354c54d27dee393ab3a4ae2ab7187af22ea7cedc4017e1fdc00b99b8d2084df183b46f14266db4e8f8d8e5975c26a06719cbafc20d9c8c685168af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
5362b0c9afb866a6acbff9c1648b296c

SHA1
19a5d454e8678e65f16431442eb84f6c572e3b04

SHA256
95239f93d64a6e3416a3a533d9cc655ee873aecb8f27dad68831e1d90b19c03d

SHA512
50b18290e71472acd4879b7d26abca18181a7787a8c5cb0f9482535cabb5bf392b2cf71612d418d84f54e03b7442ecabe741255c99c8d1c272918fd5da2fa4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
ff5932b66ef9b607e1fb378a5c5a29e8

SHA1
293a2bf6b7ecb6a76bab5c6a6b391e92e83cf50d

SHA256
198af072c9bdad7a405efaf998cd7e76813c7670631903aee1a5a63858db20c9

SHA512
7fe2d2fb4999d91016531097a653318ec10ced8b191c2601eb5805bd859d3cf2ee541d1a57a8b5bab1d7267d45e55af53d21cdd0f86e5b3a19d1c57fa8823fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
13ee16f2b2efc26725aa92888a000160

SHA1
1f830a23dc0d810c2d08f1ab11f903dfcb694f5c

SHA256
05446713515eda2380f0e58bac2d99741062dde3ae9ce8c32548c37e5c41cc93

SHA512
c1b13244c4b3e913d16a99280a35ff9862a5db987d12c689b0f1d84f70b1a7024d42af35a25a1fab643ef03daf17029c1751cc2ad4d13fbfa0b4531d78c9d4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586db9.TMP

Filesize
699B

MD5
8b0bce95b17ef50e919ef876e6ed1158

SHA1
b7316ff93022458566879dc198f645bf5d23cac2

SHA256
6bdfeb4472f22382ca006980143ee952f0e41ceb54de11a82a212d179a6c482e

SHA512
591d65c65fbb97e8f3e922b8355999da20dc8bf0e09ac678e6354c8370d1c82b886b9aaec5f1abce5a6dc6b5fc2293140d96f943a3c9ed1fcede082bb3844a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc9fc88a4bd0c1f9d086b1dc7b490cd6

SHA1
b1cb60756f901865c98eed7d324a86f99f7cac95

SHA256
1cdae4d5da406f2e6a8451f8c15cd1fb523ca448c153f149ae9f4b262441b87b

SHA512
bbc8a0fc28fc9a3f54bc85449feabe64871da4296b32f3ba3d05435945b479719e49e5ae112b14e53d427f8e7d560ee3e11dceaaee2715af2ff0521448dbbf8a

Download Submit
C:\Users\Admin\Downloads\1808af3e-2cb7-47b5-bccd-01b514e0ab78.tmp

Filesize
21.5MB

MD5
522d76cad51e0e6eba24fb2556cdd506

SHA1
503b1bf9251af41e946069760ebee7ada28c6f02

SHA256
f8afb32af7d2f0c4e60aafad88e046c10d21d8162a81b84a55066993cf443e00

SHA512
d36823c2543d18b6bb628c62b64ddb21c7d3fb30ff0c75303fe94eb397e0bc35a6d99e68762c0d4ee16d7696fa5b370f2a890b1b06af05503bdf53c16011bec1

Download Submit