hxxps://archive[.]org/details/next-car-game-technology-sneak-peek-2[.]0

Analysis

max time kernel
960s
max time network
988s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://archive.org/details/next-car-game-technology-sneak-peek-2.0

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000023511-130.dat	nsis_installer_1
behavioral1/files/0x0007000000023511-130.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{D01CEEEF-468D-4F47-9B56-09EDC8E4BA66}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 164371.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
3592	msedge.exe
3592	msedge.exe
1736	identity_helper.exe
1736	identity_helper.exe
1380	msedge.exe
1380	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3660	3592	msedge.exe	83
PID 3592 wrote to memory of 3660	3592	msedge.exe	83
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1648	3592	msedge.exe	84
PID 3592 wrote to memory of 1432	3592	msedge.exe	85
PID 3592 wrote to memory of 1432	3592	msedge.exe	85
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86
PID 3592 wrote to memory of 2628	3592	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/next-car-game-technology-sneak-peek-2.0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeda2046f8,0x7ffeda204708,0x7ffeda204718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8966796999606093430,2102444319523111541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
af564e9c66a16dcbd39e349f84595eb0

SHA1
af8929a9f1a67ad90a711fca9f0141e3b2a0be6c

SHA256
2045a12a059eb0f25df4f3af2487718b645b84fb09203a9b0c11514d8e4381ef

SHA512
c9da838fa7f0b8a0eb159e21867ef9bfa9788bd79e29b3baeb89938b50d77edcf79e20e181b85a40e19c557b0c3419237879b8f44744491ea174f717347b2423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
01cd6f9da264c5eb0e799fb1d29e272c

SHA1
cda5d92471514b6f11b8d1b27b9fb3c76349b541

SHA256
d4db6750bfd5aa6e8d95738ff09568c266fd7f093ee830086641073e7f1ce82e

SHA512
c0387c1b20db36fbc25848ab3477217d310bf91d36a5089394b0b04ad26e7c43c5eca7f43c80f3c67db33a51cabf7f1c8c90082492435bba65794d534e4ce1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9cddb99a8ea22a1afcefc67de06d5c34

SHA1
d97c0b8b7feeefb525361ec4423e68a177f1d0e7

SHA256
a2aa80c8d714620f9d89005834012bb910531425e124391c6c195443e6b66ed6

SHA512
13f28cedc7e1269e3c580e045c55f168af033f1a5d6281220d40b42df089c95687d26c743b29b4db4c424e598ba683622a85d2232c3b458c57f0c6354694027d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6263970c7159ef3b77f4f4ad39ea8bac

SHA1
0afc7e09a9854611ff0ed39db892478e71f4f643

SHA256
a30a9621bfb1501f130b8eec67d34a0e52db78e6b1c759f1c86d6c3ce400b27c

SHA512
de875ab4601333d813ae187408041622707fe89ce9e54ce1151d5f7f1e3d23bd8dd54cf04f1e413ea0ee820c425b8f18a3369aca8cce1af2fb9c08e327ac6888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37d8dfa73bfdacd0de9ea23637dc3fc6

SHA1
96a934e682626a5020103c4e767147a68324f6c2

SHA256
be5213b0d4618e03a5775baf3aa75816e051defac1945ebf12308f0da779458f

SHA512
546733ab3ea907a7eb72157dd2ed5a4de5809cf37622ed1797183c0d5aa0877ee52cfaa9a49e8cdcd4bc68b7e0ba2101436372ca7c60daa3f6ba713172b5befc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
76416d66c9977c1ea4ef237794e01016

SHA1
3210f18c2f90543ea16847bbab43c39afe5ba439

SHA256
10176b74d32b0fb8a7de179af78083c48207b79bcf109188d7b10fe3a8404d6a

SHA512
586f47dc16b43713b547739e47ed8068c51fdc17c59afdd8a107f80796bc6e76c6ed2c62b70f6a80b7a6c17d5d15f6ebb8321f97501821af40bdfc6bfac6377c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d5ff6a72e16336fb12db80c1ca35f10a

SHA1
c77dc88d5f5e132402c43d4ce8ee09c0ab114012

SHA256
97be145632c1cb5df17eec2dd8a346d2e4f237963b226872ba3e821e800a3ed7

SHA512
a5bbb735339840e97b10f02b5558eb02d358cc01e53a300de9438f63470eab45cf801912c23df78c91e7af7c3b0416026f0bab5d029ecf89622bedc595e20032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cecc7e2b3339eb1262ae3dc80a90c1b5

SHA1
0a32f948dd38f0d7e62ad0a88be1be4a3fbee39b

SHA256
0439e8f9fa07fcab78a04d13109ede6f03c21e0c23cc07e18ee9f0c1d0c13898

SHA512
ac78989dad8b2cfa34cf6d6bbf0f7d2f8129bc8294f519d525aa9524b2ab2344686c4fcbf102b890fd8973a27c21e31592dfbac0bac07fe865c937e79d50c03d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc36a5ff05992d176ae235da41e01890

SHA1
26ab380558410c0e1e69748a3fb3335e4ddf661d

SHA256
56af1d8bc98579316aa9a096887086d2ebc83d080445f0a659cde3bfecf28720

SHA512
71bfc855fdea971e134f64845a9aa7cfedda4c7a2eca593285a398f2c1dbaf67f439ab83d07c2aff7c3c8726392157ce6604c80ea39a7ca7d273dcfcf5307506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d50d22e94efd42a5798cba39afa652d1

SHA1
8bd5af4f12d23d525091929d6854d8c0e00be0ae

SHA256
ae00644e4492ad72da9a728dd577736e8d4b060188c507f8fb8b6f658ed3e1e5

SHA512
ee6874f7cae77461e0f2c14e9de643dcdf9a6730a78f3904cedf032b3bb1324f8a2ca6fbda759802d24510ccf388f78b490a89557bede69f185a0ac2f85e9f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5899e9.TMP

Filesize
48B

MD5
09d84a0a8ee0e960fc97fb894bdbc2e1

SHA1
42b6ca08f38c3d7dd60d04028eb1493dfcdc6882

SHA256
385c3dad8f4b4f0b2f06c736064c753c145214ae5f17d27463ee25d15127a146

SHA512
940adb8ba721528bc96faaf5501d1e95e9c230f5d66b06e98efaac7fe77e972386399dc024f0b0d579db9cdcae904eb2592866bb3baf03896b0c3a0b25e8dc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
eadd9edebc1f099c0328106ce7d05658

SHA1
8afe1df00339832d124ab05b58f906a627f6a185

SHA256
be8b002c94027f435ec170384618ee05e4ee992296cc67bfe6f2d7d0a4aa0593

SHA512
d71084f04ccfe3de92f82651b1dc907804372fe5b3d967a184551be183c4e40fe42da64f28b24a5fb95dc00260a5d57928532866aa590b6f13c4090b192dc507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e517ba3558fce07e84f8d53e316a2cfa

SHA1
87ba800f80ca3152445e9d1c34699a96b6cac29d

SHA256
a8833ddd539f03e83cb4aff95de8c4da13ded4bac2f5bd520a45e5063764605a

SHA512
947f2419f09a4a01e104f20cfd37bcb025431ef3c8078a4fdd4274158ecfb05db4161ed893b4f9444b48a2dda63fb79b6474197a32bb1af187eef928667d5bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e7fe.TMP

Filesize
708B

MD5
73421ad3e0e8672a53711886ce7df2d3

SHA1
80204e4d208c4854426d962adf361e300c05bb4f

SHA256
22cf20ca36b0e048ee6876c5fb0c213fe6bc2dc6829a2228ff6d1767e93c0f5b

SHA512
e83d39aad4f4eb9653a7aaa07291d703525871f893cf6a9dd8ccf1a2f911cf01cb1ca0f010f32ade32460c78f9d1b3476c70a1a47a62eff9dcbdfa5d3da990a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13f41379e49e6f59327888935c0dc803

SHA1
c524ad658a920e9b807d086723b0268dacced897

SHA256
a8b2b8ba1eab7f264bcaa975171d6a53b8f1a98eb7ba2b960b9dcad54178985f

SHA512
a580a75f18c9bc9db1f321b3338811f44730baeb916a07e003f6c8d5d3ae037bf12fe967d189b0f512d214a1a11bf878acf7755070ff2c89196a56b7fc0152fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
add913e9fbbedff8956d2ca83b617314

SHA1
1a1c3b305c4d4b79ca5908877211590a1e5a6ca4

SHA256
7622610ec282bea8be62617e091fc2864b08017dea5571415ea6d837fa0f4988

SHA512
a5ccd91937140d677ccabc68ee0f2f10879f40de96f296f52dcd32e60c8554fb9276684ec80fa2c25661bb0d6084d37dfe35180782118127fec927d8dccf7679

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 475811.crdownload

Filesize
527KB

MD5
2de154018b68411acfb006a7888db914

SHA1
dcca0f52d99511b6d157908f8cf0f080ce2a1b4c

SHA256
f1a223fc2279f9e0c6120f73cfb6961def1eea5e17fbf10d0ba6fc7a5eee9e6a

SHA512
694b047fd4ef51b063e015356dceae3a8983c2e7c4faffcbb21e4a8d1aeebb02431dd15afa46df00226f92731857b13efe567a25988d0d2c8ad9a0511c118bf5

Download Submit