e22731d9c3a47edcc4e6d1e31d1eba588d8778f05dce1ba16e8a0d189eacfb01

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

896KB
MD5

d1e279db4bc12765c9bbb2334972cd86
SHA1

dcba210d7bbc45bc396db2875f9cf029b5c0dd66
SHA256

e22731d9c3a47edcc4e6d1e31d1eba588d8778f05dce1ba16e8a0d189eacfb01
SHA512

8b50deea3a125afc1297fef05e371af1cd1ada9a102c3817cf84af67d70038a266585d8419fea1e640c2e21e58e7e90a4237b96ed2ead725883dc5cbd85302ac
SSDEEP

12288:0qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTp:0qDEvCTbMWu7rQYlBQcBiT6rprG8asp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
3772	msedge.exe
3772	msedge.exe
5804	identity_helper.exe
5804	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
212	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
212	file.exe
212	file.exe
3772	msedge.exe
3772	msedge.exe
212	file.exe
3772	msedge.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe
212	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3772	212	file.exe	83
PID 212 wrote to memory of 3772	212	file.exe	83
PID 3772 wrote to memory of 4660	3772	msedge.exe	84
PID 3772 wrote to memory of 4660	3772	msedge.exe	84
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 4172	3772	msedge.exe	87
PID 3772 wrote to memory of 2920	3772	msedge.exe	88
PID 3772 wrote to memory of 2920	3772	msedge.exe	88
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89
PID 3772 wrote to memory of 1856	3772	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffa155746f8,0x7ffa15574708,0x7ffa15574718
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13403700764439500819,6693116607616454015,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\31512fea-2e17-488c-a230-3e3f9ef6c531.tmp

Filesize
9KB

MD5
d63a51e043e3d8edff62a89b4ba6af07

SHA1
dce99ce052fe6cfdaae1c0d67eba7b65a1dd2fbd

SHA256
c0e6835c42bbc6007c7509110bfbd1ffd4a24b7e7b334dfe6fd77c246d53a0ca

SHA512
e3bf34e9bcbdffe69381770580bc17803e13a777593726114698ca109ecf0f75b9f147419b13074f1ed12745a87bfcf453a5a9b0e1ccfb2ffb629eb94ba52caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
15b9c6ae173cbe473b8b34a9d31e2db1

SHA1
81667abcac1acc63e83a87e7545ff8bbb7b9a380

SHA256
35197af47c647caf137cb244de40f35aa01548ffb49a2c6b97454059b6402b9d

SHA512
0894b95b3845242f4f87bc0a4550c5c8bd6c04a588e31311acf00f29a06170214a9c52abe6bc7c9b98abf9397bac22d9c0a84b5220afd51215d0a91d2bc0a0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
ae4ed3eb52de5920e128cd9256ecb38f

SHA1
52a238be2f85b170af8f74b550794c67a916b989

SHA256
6ad998fcb594952ab9a587494370a0d8660e68f53124bcc387c819d06d84ad59

SHA512
8ae2a5b886739444fadd91f27c60cae0ef03f1db77ddffe739a6378745acea999a2879e5b76b2bfb015ec6f27fb2713bf44d156e42e0437ac8f810faa67d04c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
a4416237e1c388fcdfad3347dbcd0041

SHA1
be11da5232bf7c635ef17904aa92caec9715dab9

SHA256
fbb48c06bb32a385023ea5c562d43aae3a962aec0b3519a8e0b5359090339ade

SHA512
f977ab4d28ca1da139e390455385123594e8b88ba390c6799ab166be49850aa909731fecf19262ec72665a1d795cf8d6dfcb6d340d54af7a9a87ea080cea3d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\64712947-c43c-4bc2-b1bf-0ce368ab6c7b.tmp

Filesize
4KB

MD5
aafa7ce12cf0bd22a500a0d51cc23388

SHA1
44df108322195a7bc973e9d290572933ec80e9f8

SHA256
e9feeca2e4d4a720c35039227d399722a1f5fbbefef2804158bbd02662953d78

SHA512
fe98853caba2c00eff07c93da574b39032dddd64358b3b046d85011f797c790720b0de128b36eaa01e24e9a3457b5382f663343f05e91aaaefb4dc087da63df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
6c0335f1c4343d65b9903376489e2358

SHA1
47d0908ee15bdf040c4ca0463c4c1791a5d77c56

SHA256
39e0fb9b193d62d06b9cda79c5fbd0abc4e1674a90e86da54e284591033ab59f

SHA512
95c48931ab280cae1d7904131130abad4f208c7394de9b340a717354d411968c385cd3b9c80433027a117171897af8a60b2019c4d3e54a824d4c01490234564c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
7526d3e600b200fad0ae4e04617add09

SHA1
f3fc5af68978ef0621be21c712cb9c46a8dcff09

SHA256
b61ae99d71cb6ddcca611f7addddd9ddb0860cc6ae7026c9c2c6a8bfe16cc1a1

SHA512
96545aba071ea863fb15fb6c477cec253b0af3673f1b6cda9d516e0271b01da7d8e12c2c0516c77feabdc14ece1281b03265c6258db9534d66f6819716b15f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
94d32ecf8c4daec57c6d0494bf830297

SHA1
b9027318ab0d1e268e2a965128757da1481925eb

SHA256
69c38dcae33c1759c294a0448b5bf68bf2ba61aa5c82b16ea68445a3341a9908

SHA512
5b3fcff527d330ccb9e332a0a1123035413779cf0eb060c2a1c56fee43476e9ef9bccc65f2035d916c377b13fb3f267ecef96cd32deb645e0538eef16a37767b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
fcd4091a538392497f8e81a5ebc2e095

SHA1
38b55318c62fcb938cdcd8bf2a2f6de18cd13650

SHA256
0b88ba06218c887fa055f01d2dbf23cfe334bec388d9ebdc32d9673630f48874

SHA512
1163bd61fde9ac5db592bd12b482e6b8966184c030f451411fc6fc4d7ed84aa685ef061c0438fcd47b2ecef6c60131a6aabaff8e4fbe719d7f30888367515496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57a539.TMP

Filesize
24KB

MD5
5aad68f60b9cce0ff496b419f854c7bc

SHA1
d40fcd1a2b9c0ab0763a56f502590dec389c86d4

SHA256
31efd751373a5002998fe01f2721e73d6abb54b1b691f51df5b338d3b09f8385

SHA512
6691fa0822ecce770a95ff7f89d2e66189589af390bca2cae2ceeb1c0a4f534c19ed7a46edf23412180297888c8fd2c32eaa9be4fb71dd74f58cca63b058de3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHQOCSE2UAUA8VPQ38CV.temp

Filesize
3KB

MD5
72b67b10d539a6f89c736f23c1c33393

SHA1
fea5069eb85083441fe55541b2dcc6b7df85f1b1

SHA256
158a6e37fe47b54d81a4771957eafabe06cc3e4b972b8dd0094f267154fa9e20

SHA512
82d06670912b3da05743a527e391d21cf9737dabd64a441b19c9ef0be70108c9131acb801458feb0c2dadaeabe68a5fd1474a1a8bc95b08b29e6c299c6e007ac

Download Submit