hxxps://sk-highllander-pt[.]acemlnd[.]com/lt[.]php?x=3TZy~GDGI3Wi6HV_0Q9Fh[.]ah1H2iigTwjecyZHbGI3WfE50s0Uy[.]z[.]Nx2o2kk[.]~vnuY1Z[.]U4YInNUX3_y_5HVul

Analysis

max time kernel
196s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sk-highllander-pt.acemlnd.com/lt.php?x=3TZy~GDGI3Wi6HV_0Q9Fh.ah1H2iigTwjecyZHbGI3WfE50s0Uy.z.Nx2o2kk.~vnuY1Z.U4YInNUX3_y_5HVul

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
712	msedge.exe
712	msedge.exe
1356	identity_helper.exe
1356	identity_helper.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 2120	712	msedge.exe	82
PID 712 wrote to memory of 2120	712	msedge.exe	82
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 448	712	msedge.exe	83
PID 712 wrote to memory of 2720	712	msedge.exe	84
PID 712 wrote to memory of 2720	712	msedge.exe	84
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85
PID 712 wrote to memory of 4044	712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sk-highllander-pt.acemlnd.com/lt.php?x=3TZy~GDGI3Wi6HV_0Q9Fh.ah1H2iigTwjecyZHbGI3WfE50s0Uy.z.Nx2o2kk.~vnuY1Z.U4YInNUX3_y_5HVul
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0f3b46f8,0x7ffc0f3b4708,0x7ffc0f3b4718
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5027384621102590075,3047120269386711403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
edd987fb11a2c98b7f666680888aa262

SHA1
13dac1c6a9204579ce7155e705eb4e55ab496a59

SHA256
0942b0252ac5cafd221447a4138176f4cbc38755690ce3e38b64993f7d6c939c

SHA512
8162193321ec0da52dc6db5a000f7229fd4584453b07d5164f392b5d2e7fb3073e43ba23f91a918a0cde13505df5aad7f80d43f7f42c93be1c85fd49e0c628e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
12105bb8a95cd2c1360e32306d1eb852

SHA1
6360707ccfbf64d59b3cfe52258d7a1a1310e58c

SHA256
ba382377868fcf140f1fc8a7489bbdc2d560dc0c5e18fc547329809d0a9b8b19

SHA512
6586e61797317262cf6a6b81aa03ad5f44de1e619db934e43a0ad6552112f6dd4aaa8f1b859ac2cd8f781de869bca97955d96189d335be6cc91ddebbd56ee8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
3089aba9355afe367e5c2ea03b82c6bc

SHA1
f92737f30fbf384dd3f647fcbfd8825a9bdb604c

SHA256
bed146e25a2ed98a66372785474aeb3d83a4bb67772e1467f616f22fb8dbc9b1

SHA512
a29f25e58c3396d809875723054bc2e25c5e801478996bda6a7e27fc057f767fe000b9dfa55b8448763aa61926a4460ce4e4dd62c7c4a41ea50d13e67d7e4ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f9ac581be549678b1b55fa00a8a45bf3

SHA1
4059c70b75ff2d1972296c4dc10364760ef5ed5b

SHA256
28e016f68d771ca721b99b98812a9aaa09395721f8c52a6ec4a093259c56e3f6

SHA512
0f2c2381ec5292e4d4b0276219dbdbf498aed519b20b459f56d8dede96d6e09e7338f73cc1d323d73e80c000706bac297031e50558b922c0bccdc676be48a612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8a360f8c5ea375521bb21a01e19fabfb

SHA1
538975ecf1e65f44d1a607b273a6b97d55a4663e

SHA256
81beb452920d5b8dbf1dcfa2ed14c293d8d132fc5c0ea4ac341d27fc37aa0e7e

SHA512
e6e5b68c5dd04923047fe6f3a3668df0dd7c52a417a2eb75e6e9044cbe4e6b8dcc93575778e35fb43405cb6caecafe753163c32216c25e2178d2e501ef3f5b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
766db1b0807a09bf5a22d6d00fde68ea

SHA1
47a5b6cbaebb1cb430780483269c1670b1a2689c

SHA256
6bad09354dd213e53162dbe803ae1ff231fa2ab38119e3079cf80f9d4fbe3f41

SHA512
548b0cf44d9afa644a314f4193b21f83f21254a1de61c8c4c56d8c01a1bad397169f0da954faca07e9f016cd3d7409f23be317422768d0b632367ec3f47d6a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d987ecfd2bff0357689d6d36381fd0dc

SHA1
b5cf420143506b643b490bfca741466a2017e7bc

SHA256
68e03ed5816116e3953a00e0fe145113d46b7b0e4e45a2423590a3684cfb944a

SHA512
7bf7487f2602736f08762112b30d76b1a8600331ffae9fe1956add8621af2a41c1a6689d8f9c85451845f59e101ed44899dee4ed7d8fbf9e59046a69c10275b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
29faf2711c47f6f78ef05f716a4ec9d7

SHA1
15bf972ed42c342cf506ef20fa2fb6181cc255b9

SHA256
d5c58bf48293f61915c2f5937fc6fae28c7e9bf57f86e7b824d7b83a1ab35dc7

SHA512
c0be6f95caf1cbd3f9dd97f720d08b1fc01c18055e6b51fff8553598008e394d10c6f37617fe3967561d8bcfafe24b9a0c11157b5ad91a95880ee0000a027493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
20dfe04156238fe9ee813661d3b7aeb5

SHA1
c42fefecf24e973c460019d7bffd9cacd29de568

SHA256
9a9e64f86d1891f332769487052ddee1acb379f458a39f10e88b8e4814c19a1d

SHA512
f16834a221b060323943a810e6fc0d8aefd685d0c796b877275ee9e738540d8efddc434fc1b9dc43108d9342755d60152678340a3850b5e4e62c75a1045ae332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
144B

MD5
24b230e0097887a37c43a0aa8c2ca629

SHA1
a985607fb7fbcb0f14b5ab6dea1108eedf822aae

SHA256
849cc07ff567c0358d6b5d125e15d4bea50f0b86f808f3b72a4eb9759cdfae10

SHA512
76b9b527ca02fef1d2e063317ee5737c4f342720bb5e85493087fa66984326b2282d010410b4cbd9475f70e0316ab980e4872a8dcab4661a9e855078a5ba6636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
cc4b0b121b82d35667607b0bda006c53

SHA1
19d8486464686e3d0e424472edf7fb3ef27c79b0

SHA256
6ed6f5a63152fa99501245680981f6bd5c1afa405593b420cf81432132f43b3b

SHA512
6f962f26dbce35ee977cf6f58c5820871c9d9f443377ef25fb458e5a5a3e0230571f1f21e6545d3764fc5c09f956258ac7a6ef7f7909e06f55dfbc631b51e352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57db1e.TMP

Filesize
48B

MD5
25a21605ee81f4387b5d78b2290d2efe

SHA1
fae3e59d2f819cd92d5122e1e1598cc50e2f59a7

SHA256
d1c4c0785c4dbf41b74cde818cf26d4286c4383a50fbd325351eee8ccb04c125

SHA512
f13d7a1e0b9290e4c853d4b033c5c58431187ca240a33d31344869d8e89457debdcac8d2731cbf13a2281e80f33fe7962ac77b50bbc4cc191ab1dd580e1a184d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24330da8aa9ce391f95985ee94fce361

SHA1
14b9615616637e31018cc904a303588285cffeb5

SHA256
f38306202efeb9e18fc03cbbfb74038d666fed2a74a9711573bd79f9485dfcc4

SHA512
d6f42f5aaa6c13619b5bfd555ed7c720e12ba5e5c0f7aa90a420259961e20e957b7790a7a430d3cde4808e075fffbaaba582343550d90c6ddb69543c14de281f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a731883e355914a796693dda1c3701ff

SHA1
65726a363b4cb940013b35c949b4b514fb9569f1

SHA256
f5d945012284c702756870fdbae2e30546b379f19ad536a78e4d1c6a75884338

SHA512
7835fac1e33869e053f938251a6834deb203d1227fcf69ec997799beff12ce89080cec2b2f31e7bb2de14b50ff29ae1568a28f5171183715a97a63363a417faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db033c2a26ba9a8833f6f4639a3b4ef0

SHA1
5fa6b5c28281b15c2f9af31492a51bba5be0345b

SHA256
f07ce8335eb9d6e67b01fae14ced214acbb79ed61801b445cd41c2b005bcd9a8

SHA512
740087b3c3e5cf1af4a65f4e25be2df3d67156c535bd6d6d84b80d925f6d8e26b23b545c7524e79237b39a4c62903ff7396f5a13abbf238d8814364896b99d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581661.TMP

Filesize
1KB

MD5
584ea6e2e4066209302c16b6945853ad

SHA1
ffcb2c11123112723736fb38e1d90baa49b80954

SHA256
c1a18b446e87342bf47ef832057bd6e9386ceb4e158805b441693f1e6817ca2e

SHA512
0c46c8a6b918d3e321a23338f7d425890cfd0c1b1cfb078a097a344da98fd3baa692092bdf2b1e533f118f6b75b453e8a02b21fd1c714852c5aecfeb23f694d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b72b987368a1cafa3921641a1c5bda4f

SHA1
98e75e72da317ebbd87bea56686b90d99bcca630

SHA256
90c15d31e677b6e02134db1a2133a4fa868633c53c235b46058333ee9ed2442d

SHA512
04dd20a0992785e089d111999c827411fe63b4568396f80520729a2913cd1a9d031d6b2396509e04275426a9036c0fd44c54f30b280c6333ba66cd75e54b81ac

Download Submit