591082904ff8bb5f37f8bc63e854bb9b064bc1fa909ca535de795d03ea968ac9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nigger.exe
Size

16.8MB
MD5

023604358644626ca9ba60fac215e0f3
SHA1

df427826bb265287e3abf6ffb5b49b5bc097c6dc
SHA256

578ff87b6f0434257206f652088167354404717699d4df894e6c17515f88d8a4
SHA512

e1503db97d419b881d7a2ec171d21b8c9558b5f0e6a7175d7f1df23008d219b5215b4b2a617dc4a4515ef82c069fbbe167366dba80d5f5aa87ec30588b5cb4eb
SSDEEP

393216:WoJ3EYO2vOcUwdLG0rcaotgnJnXROEb52S0B3XYz:DJa0Ny0IZ+hxbUS0B

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	discord.com
35	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629364133-3182087385-364449604-1000\{C32CF4FC-EAA4-4701-B455-D0B6367EA11D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
5012	nigger.exe
548	msedge.exe
548	msedge.exe
1068	msedge.exe
1068	msedge.exe
4512	msedge.exe
4512	msedge.exe
3288	msedge.exe
3288	msedge.exe
5272	identity_helper.exe
5272	identity_helper.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4512	5012	nigger.exe	90
PID 5012 wrote to memory of 4512	5012	nigger.exe	90
PID 4512 wrote to memory of 1612	4512	msedge.exe	91
PID 4512 wrote to memory of 1612	4512	msedge.exe	91
PID 5012 wrote to memory of 1456	5012	nigger.exe	92
PID 5012 wrote to memory of 1456	5012	nigger.exe	92
PID 1456 wrote to memory of 2212	1456	msedge.exe	93
PID 1456 wrote to memory of 2212	1456	msedge.exe	93
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 3220	4512	msedge.exe	94
PID 4512 wrote to memory of 548	4512	msedge.exe	95
PID 4512 wrote to memory of 548	4512	msedge.exe	95
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96
PID 4512 wrote to memory of 2644	4512	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\nigger.exe
"C:\Users\Admin\AppData\Local\Temp\nigger.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/staffbesting
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9b3f46f8,0x7ffe9b3f4708,0x7ffe9b3f4718
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3810847239694590719,13238708370906043315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.staffbesting.store/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe9b3f46f8,0x7ffe9b3f4708,0x7ffe9b3f4718
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11587993698868388150,9511600788894777758,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11587993698868388150,9511600788894777758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1ed3bbcaa8e96c29a0b57e72bf0319

SHA1
9bc11860837a2bcdd048613ba8dd76d6d77d32d9

SHA256
7c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c

SHA512
eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4b5eaf7edd9d5391ddfdb694e0cd888

SHA1
d1f92fbd238c4d5fb6861a83153893568d514586

SHA256
1d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903

SHA512
1b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
51KB

MD5
215266b60e7a24d9b06877089ec0937f

SHA1
408970ff306f7ce2e664138177d99898e5036831

SHA256
e1b3ebbfca9529d149ce72f34633a8934e3d111506566c81686936acf9455c41

SHA512
29d33bfd2c34c27659f9f5e8712b1b123b31014dff8642896ea833e80ba3e540cf21dd704df95cacdf6866d297a4b59e1bba17036df429563aaa7ca98fe4bb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
6497533379c47f4b5674ec2f54808d3e

SHA1
07a931caa0660a6e39447c7a745349a47a8de8d8

SHA256
eff1ba5db9b8d5b0def8800b5b7ce95375a5d470a27d7da3cabc6991437b8b51

SHA512
7af1cb5e1054037c96b73e1a05793e74b30861a7fb774a205923141b1a4c781c20f20a026c0f7f638b77a648a802bd6d96ffa479fea6821085f0be96ad2d767b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5e9f7d844c2776e4d41ad7a05cc483c0

SHA1
c57541c0da263ba4b63cf518c35cde6edf32bf57

SHA256
3594aa10d066340a6b8b408827858c0bc6b18a86b9614f47652470ce774ddd40

SHA512
0a73daa5cc8015acf11c83dbcedcbd74dbc11aa8a804c558f6f4f1879ca7c1a80b172bfae68f39f364b1fde8b8c79df85ed87ed966b997c1ba5e53f59cb78b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df298bb43850276e9e5739f405dab0e0

SHA1
5aae66c6f304b9b85293511bd8ff34b9cb67b260

SHA256
4424f1ecb90d81163cd6290861c8f2284eaa9367f9640de798e68da4dfb40936

SHA512
360f4d2e32f887ddfffd1ce4252c4b36266a47b889dfc9cb90cb2fffcf8c6b5539d824a636bd1c3f1447673eb2187c46e3160eafa7d24506867044bed29fb9ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cef6333f8ead76de948f79a17fab592

SHA1
0b7f43ab0a96775dd97412265a41b600f7c0eb1c

SHA256
a7d857d621936792f3249f070e50239780f125bbdcba5a5566e64c7c17891d21

SHA512
9e10b4fcbeaa8fae781e1330e26dccf013aa6f2a62d47b6b154a3ef3db7767990c6be51045c5da1e23a73a810f40ff39b3d682a35336b375e2cd16b59281ac56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
941ea4c983b3cf877ce6e1aab38f2794

SHA1
c4fcce581d0660a0c96d0579aedb528a8168233c

SHA256
3d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342

SHA512
f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
43711b9381627cd8ca1b2bc299969fe6

SHA1
3ba49883353defce6c4ac28d9c2af72ec6a58021

SHA256
6a028d9420899f22dca71381348ff363b21d2de1e16fe77db272e477321185cd

SHA512
a0b3caa12b98c4e1568858b38dd109dcf523a55818ab61cb439bb960ec82b7803b916df90c104f72d9ff341dced61f571c83c17b798bd7106a4b75ea68ce2097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
b608e4d3a3154dc7eca12fe3c9b34419

SHA1
86faaaa8f3418a368997352e7b1d872233305be6

SHA256
03857103b6b07dd9db6d27accd3a1fe6fe54a6d39ede7524b8d7001c0a1f20e9

SHA512
c09b8598d1f0acfb36dcf0fa26c678c2f8db1d165cb7585314c9226d949652cf196aabe2a7eb880a8c2fdd6b768ea22111975f4d1b9657eb8f65eae83fc928ae

Download Submit
memory/5012-0-0x00007FF684A24000-0x00007FF68541B000-memory.dmp

Filesize
10.0MB

Download
memory/5012-175-0x00007FF684A24000-0x00007FF68541B000-memory.dmp

Filesize
10.0MB

Download
memory/5012-184-0x00007FF684A10000-0x00007FF6864E6000-memory.dmp

Filesize
26.8MB

Download
memory/5012-5-0x00007FF684A10000-0x00007FF6864E6000-memory.dmp

Filesize
26.8MB

Download
memory/5012-1-0x00007FFEA9990000-0x00007FFEA9992000-memory.dmp

Filesize
8KB

Download
memory/5012-2-0x00007FFEA99A0000-0x00007FFEA99A2000-memory.dmp

Filesize
8KB

Download