0c19bad7c0ab86a954f8d5cb8b0fc410bb8a792fa0a63140197db4f65e6af6c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

896KB
MD5

ea94163d40e5cb504778dc729ef519f1
SHA1

febde4e5f6373200e5daae74277adf576c76158a
SHA256

0c19bad7c0ab86a954f8d5cb8b0fc410bb8a792fa0a63140197db4f65e6af6c5
SHA512

46f2cdff5a9c72f18b268ed32f75e05d0262d1f12fcd155fef0e98ab9875dca752da4b1a58d66177c0daa8ed3b987da4c26be443391ac89b0e2f96d990891159
SSDEEP

12288:XqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoT0:XqDEvCTbMWu7rQYlBQcBiT6rprG8aw0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1636	msedge.exe
1636	msedge.exe
5628	identity_helper.exe
5628	identity_helper.exe
5568	msedge.exe
5568	msedge.exe
5568	msedge.exe
5568	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4372	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4372	file.exe
4372	file.exe
1636	msedge.exe
1636	msedge.exe
4372	file.exe
4372	file.exe
1636	msedge.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe
4372	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1636	4372	file.exe	85
PID 4372 wrote to memory of 1636	4372	file.exe	85
PID 1636 wrote to memory of 2880	1636	msedge.exe	86
PID 1636 wrote to memory of 2880	1636	msedge.exe	86
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 3668	1636	msedge.exe	87
PID 1636 wrote to memory of 1372	1636	msedge.exe	88
PID 1636 wrote to memory of 1372	1636	msedge.exe	88
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89
PID 1636 wrote to memory of 4892	1636	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffba9d046f8,0x7ffba9d04708,0x7ffba9d04718
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17681913408926594395,1556911591202937830,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7900 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\6ea9c85f-5b0c-4049-a376-bb2e3b3ac1eb.tmp

Filesize
9KB

MD5
98b94f49a60e4447288384771cefb787

SHA1
370b1fba48f366473e78d74b512d6736e02f6ce7

SHA256
6b694e6db2ee4cf332a5ef2d2bc66843d68c7da7ff31aa2d4bcb828063810ee6

SHA512
c908393fa1bc1962e5c7e194c496b5c0bafe38dc0106421a6276cbf4067412e2e4c0ad2f74b77cb868b167fcd6dcf470e152b74211650bb5090e6ae940a41bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
3ae516849e320657a2b650eb022a12f4

SHA1
8fcd439cedd9d9d4935a7d9aeb1caa1ede067c3f

SHA256
62496fc34c183ac38b0e1b6b414d7d4510f2155d87f43980bb8a79f4b30a94fa

SHA512
e3b009acfb41aadb6030113d13849563e5882440063bf1d7c52d1ab523c21414a337b0c8e93700d168949ea555173cb579a6400a1221abfec61b5d176ab48444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
90f53736ed8202ebafec443aeb0bfa63

SHA1
25bf8a37f593e5a850246be3d165071e2547a905

SHA256
be1066655b26a85794b1e108b397089f551122516a3d535ab944c30ab67b55b7

SHA512
6ad68bcb330eddfa3ee2b030e7e4c03dea6cc41acb74d31b1e1c23132cc758f51d5e70ed0657b8ac4c8ff56ebc64a6d53e18bd737150769cff677ed569880e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
bc224ef5c0749a0b5eba2cf8d08b73d3

SHA1
c53df99ff253cfe311560978829d97c7ba8bc36a

SHA256
f7060b23b4c71cdf0852e65979816334b1b436015a00e2f4fccb38d8f8b6200c

SHA512
ec6324fb5ba7d5f9ff08d746ccae699a906e78664a84ed1e2954e54611eec7df8ff9442c8f6bdf157b93881ae38454efafea04237b2f53b5b6b629bfd5b64a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\783a060f-559b-4fab-b846-fda6665550cc.tmp

Filesize
4KB

MD5
fb96a67ebe2c7051ced6b40d415dda12

SHA1
71d61f12b3ff8142cf7c2049b3e529e30186fce2

SHA256
574585ec7558b2f7550ba162b1a9c5dc8607e26ff257acd4c2fcaa2aac6166bc

SHA512
0c99cd4178003efebac7e017e091ee08c90d02fe746ba0010018a9c96f9b8bc9dfc8e773d698ca5a9b73b5bc32a54b7aa4661c930768d17d10fc5ace9ba26805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
086165982e9908c5c016e73983725a3f

SHA1
0ca126417abddcf2438200505a917d1d057756b4

SHA256
bcbfdeaba9992396e3fc01aa28d4dc5075581909ec010f745a758e43ef2b3c16

SHA512
5653eeeb6275501195e1ffcea3bd5270513fc89d776699781fb329eed038be2b6fe4c8599ffe742b2951762b9b2b0576ad03a3778e8d40c912e2fe1e370b82a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
e5abc36ec87081d09852184bd74372ae

SHA1
3da6dc3e3bbbd0a5d9cb76e0e12883b5893d92de

SHA256
d32a1ea1ac1fe0cac0d62e0152bd06f4e67a91b4af4e2c21a253b84c55808310

SHA512
10a469d82745e00b12260ae3185697ed40fec566beb7d2d67c0b2e7ed64340466696c7699a3ea162a6331bb905918c9b6326e0625be03b57e1660bef53c9fcb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
2aa08b6dbf2f50ba7883ff30a1a00249

SHA1
e31b29b0af04df36f9998645fe9446f8e2f014b5

SHA256
bc41b9880e6744dd5a03cae328dd8939545cd9de0db287663a6ab42e4cc5e9be

SHA512
6e2313349e315945e7dad969e91c689c01589620a84a49d4a33d0e2d8810903308138e318b835620cea9a7a9f111fcc14f54d434cda7acb36a5cce4e783c8e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
add835a1d6b91b7214b51274c93e4dc1

SHA1
885696d37bc16a349b15eb4e420dc5504e8190fe

SHA256
0cd4cf61bf553a1e5596612fbfb6ca65977a26d4fa33ed4ab6d076f479d2dea9

SHA512
4d370bc5f128bb5e11659d65d135f580ff8912a19646906135f1b42c649013648dd687a3811a0b06bdfa3411112d7f4e3d794767b61b9737fdc52b2be6ed156b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57e37a.TMP

Filesize
24KB

MD5
8662afef0d952cd389a7b921cd58c695

SHA1
95e6f1abcbbb440de7ecf2712f15b55c9d7473aa

SHA256
6e849f6d595b2a1386b51afc6c3227bfe754d48826bfb4abe36ef045bd6aeeb0

SHA512
ec6077ef34dbba2d7544323483b834c49e063fbe47811c7a26c69c4761e8c549342e61d25fa82696850850ae99b675f6fb431c842e62d46ba2ba1b062b190a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C3O72U38UR6PKWG0NJAO.temp

Filesize
3KB

MD5
4edd6b88fde3c972e2a9213bf598c76d

SHA1
0db96f292a10ebfa7814983077eaada93a9a6783

SHA256
c73b55de73110f044a1dc39eb60ca572d9a9b58eac99684dd156a8f55a9c60d3

SHA512
cff41666235c74fa5ed8b00b242a3954b8ab4efb57a5fc1890700105efa8ea89fb887c3a9ad5d2f5d9634d4618fe5f8e0f2f17c4d627b3aa471e1fa86a1de337

Download Submit