hxxps://wearedevs[.]net/d/Multiple%20Games

Analysis

max time kernel
103s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wearedevs.net/d/Multiple%20Games

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 454163.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 304649.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
220	msedge.exe
220	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4160	220	msedge.exe	82
PID 220 wrote to memory of 4160	220	msedge.exe	82
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 4980	220	msedge.exe	83
PID 220 wrote to memory of 3840	220	msedge.exe	84
PID 220 wrote to memory of 3840	220	msedge.exe	84
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85
PID 220 wrote to memory of 2188	220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wearedevs.net/d/Multiple%20Games
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd956346f8,0x7ffd95634708,0x7ffd95634718
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14655897595878626381,9975576300235320289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8021fe06b406eb12dfd04fb190297eb4

SHA1
26f03e140713edfce4001715e0d2b9b82e9fa7be

SHA256
7df575984ea9b516bebb1119b3ed2168389bf97618eb93a13daa606a42eb7239

SHA512
948725e9815578ef764eeb5e870b3c878474c16f3fc5bdeefcee408c4f4f6501e30f1133502efb38f42aa53b892992d2d281a0b5bc4226523ebbfa28ae421ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
389a9fe89ff9895b249ad2c7277ce07b

SHA1
291777885f00b231ce8ecd8b62c877c473af81bc

SHA256
197933d1eb30da6596676effae97a79ee84c21ca8ef3b86b23e9099f5410ceae

SHA512
7152336263bfc60c862e44c01eb37631762ca80d38c0685dcdb2885b5e1355894cef76978e9b264c3d7603b93e11067fd841a1437f6ccb69c34513a4443f1398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c0a4bcb91f1fc855e058b2114e00822d

SHA1
ff9ffa6867e5f1f2c272636b3dcc21b48590e482

SHA256
676cf5ad694763ecf27417da50c9217397745d1d1972cb8ccce74d5bb93d9bc0

SHA512
b851d46401d43dd60f1370ed49f93cca736c325daa2e0d6bf128230d4501936ef6e1e3ed73d8a710919b0718c9b813ca7579176daf8e76f0338086afb84e21a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bf72098f1cec96c4db0ae1cf6d06b80

SHA1
e51adc1a60ea0ff51eeb7ea7a901aa02ace86bc5

SHA256
1da8231183fae5f2a75284e170cc512a1ad4da5bc2d977d62d3aa749599c1a9e

SHA512
018220ff9db6fd0a1f6cb919bd17260543ac3f79385af3a1c161e8f73221463bfb700ccdd8b5e47f25d4f18925fcc58c1eae3b57b4210537fc30fe51f2bed669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
605cf7b3dbf9acc76c9f7e5dad0c7521

SHA1
b96eeb58fceaaf22a3ca024f385c3fbd491333cd

SHA256
dadf959034f399701a674828fbab70cd8a158a49a4175e7b808f37f954907fbc

SHA512
fedea6a8dcc2ef0acfffd66b6a644c308121e6b50bb6d783efef414f082bb74168322355b6e8aeaa5de2502489f838762c41c2209e29ea49c2a6d0f191c1616c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2562fced988ebe4eba2cb97c7dede82c

SHA1
a0dfe074a9f52acbf941ead4150a6743da796020

SHA256
961629b7f259c0b9e7dca80dc9f04c18d821d716427935490389616073fb4c97

SHA512
da7503c5763c7ef2aeddc9281479fc04f18fc673fbfa52babef5d8fc79ba837b72f5bc725e85bd487180c496e2aedf1009c4ebbc2bf0fb3f7406d7f6c8f8f072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
391c5d6e3382282506e5d8d64a55c1eb

SHA1
89bcce1a764b259c3b29febd3c512aaa80eabedd

SHA256
8e426c2d9f9a1c616feee7de74d956dfdc436db689e0c0860dbfdb78db9cb487

SHA512
f7cb4d269efac006eb08439471d5407319d000a9053377802b92865f143475eaa0d2725cfa57fe230398ed3bae22f8d83f217b7fc3f8ebed937bede0ad7fd554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5b251900067d4419473f96e9b62bdfde

SHA1
6031a4caa8709403c112aa418ee85e22bee076f5

SHA256
8760cbc8778293976b5090e6980cfad1b1eb0788ae96aa744172aa30688c74bc

SHA512
bd20ca1f041f65d587c53eabfccb44863f9c67fd0616d587c7ff759438c759dc44fec355aed10e92c187e78df73688239453fcd3b9cbee577a1162610e04b801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
60102e29419a3bb5a75f0414e49ff67d

SHA1
4feea95a9476c602b6ef9edc551ed5828a03a4d0

SHA256
25af8fe98aaf5dd99b5abbef1f1d6278cdc509c079a97549221b347adae87fbf

SHA512
755913ab89ca9a33097e851f6f16b22974c2cf525637427bbe6d4b4e6b310d3bf044570bb729eead3a6b1a106788cdec71b4fa35687c7aeaa0ff0b48e3f2d601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57be7d.TMP

Filesize
48B

MD5
b4749efc67df4476f844be4bfcb8cc55

SHA1
1c16b7ebb6cfc82f687f3287ba4508cc044a67eb

SHA256
dbc061432936f4f0306baf5b14dd1cc9b2feab5d087e5459fa6b52138acfec47

SHA512
bb954099040f7b51b5acaa87bee06c5879073cf79ee4142368cea3bba48c2e7d22ebc6d2f918184717a585b6e111f751b40244ec49b3286cdf155788be76372d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74f2d0c66b61c71308c98c5a0dcd9430

SHA1
6a241433206ae8996fb42a8c6a361ef90d138fef

SHA256
1832a6c64fd3830560e17d3aecfe4b64608b21399a69ad3f0898ea7656fe64a8

SHA512
518c328a6e4c0bfa97cefc29a213ad83a909fa0dee44d229a6ee4badc418bdc34e78dc743073345bf9f0395e6bc963969513533129445f7e52a6f2b549506c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61839550a0a5b1aeb91ead074329388e

SHA1
25700b4e3b30133c313edc2ae38d1c3447947606

SHA256
a36368dd98db2fce211eea6e989d61b8149660d94b98671490ee821132dc2a2d

SHA512
ae07c367c5a9dea213b0a0a4e12eb84dc801e20a143b986b241eed29172cbc4a424bd20028868245c4204c599a2c5bc59fa69c654aeefecb6b7d67a73b5315f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1f970e2ff2d1837d7c710f0330df24f

SHA1
9adb9da78a9430b56b564f9588f578cbabfd73a9

SHA256
241dc91a0d1cd14340bb3c9f3ecf5a898013c8812cc259eae28610f2e8e1867f

SHA512
6c20e3b14d2219d0a0678d497427ff0c2a2674beeb3e3ecadd8cab984818e2d44d6cf5313851b0f4b584fff0b7f2d8aee594d7abd8e0dc2f33f3e6b0ab2eb6ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ed8c.TMP

Filesize
1KB

MD5
74b1c264b5ad79a147cbf1b292f005fb

SHA1
2dd6a33c516bdb79b737c4bdf1f1d683e126d5a4

SHA256
84436d69fc7881ad2958c15649384172d7060c511a467bca25b07fb321cdb453

SHA512
e65af7e7808bf3f7039c9cabe3ef71820dd56553515ab7f3275d5a48a1b6a84ebb6be7a576e9cfe68dae2b30e7dbe66987cd5f49bc1d45ac4b3b1bacc4649b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d75e8d93b5c1b61dafd8ae2aec079f3b

SHA1
457910c405e4898b1d208610e280266d611c8502

SHA256
73f4b70464e36b6535abc2cba01871d75b0ecd3a698713b7dd40e714427a4bd9

SHA512
77a8f92a8438938a8693044756f5610fcdd049e44521e3ae0e257566a5344c6503e93e0a36c7bc54d5a430ea73be883919772250968de5223236059b6a8b6cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92ac040f7bb7da3e67e0a78e97c35508

SHA1
3a20e9b39ed2e9fd14b08862e70e95db11a94df7

SHA256
9c31eaf9f27f9cdf860a135624b1471837ef7d9bd19ddec12602b21ad0fed11c

SHA512
c2449098f892b259e5110b7632f94bef01a49111507a5ae7a008a1ce36aee73d76eae849d4dda29e7cd3592e515e4551e554b7d0aea02ade947b68466af1c00c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 454163.crdownload

Filesize
764KB

MD5
aed655395747a6602479f6032d3c099f

SHA1
5fcbd5735ed0e4a013667652f4c1382abb45203a

SHA256
3d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4

SHA512
1a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637

Download Submit