hxxps://www[.]mediafire[.]com/folder/vnkr1egpyh3vm/Driver+Booster+Pro

Resubmissions

05-10-2024 21:06

241005-zx53xasfrq 10

05-10-2024 20:43

241005-zhmm1sxanc 3

Analysis

max time kernel
1500s
max time network
1501s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/vnkr1egpyh3vm/Driver+Booster+Pro

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
1536	msedge.exe
1536	msedge.exe
2684	identity_helper.exe
2684	identity_helper.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 408	1536	msedge.exe	82
PID 1536 wrote to memory of 408	1536	msedge.exe	82
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3836	1536	msedge.exe	83
PID 1536 wrote to memory of 3904	1536	msedge.exe	84
PID 1536 wrote to memory of 3904	1536	msedge.exe	84
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85
PID 1536 wrote to memory of 1980	1536	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/vnkr1egpyh3vm/Driver+Booster+Pro
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,9983727418895776487,10693282222305529026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ca49e054b15f45d65838e6c66933a7eb

SHA1
0b81f2ab84757a56313e67235df87d486452feac

SHA256
e3b51b070f57a8d9bfe51431aa0c7f6c87fcf558740aa4d08b53b702a1441f66

SHA512
e5693971bb39db8c10df0760e04c1b9c13cb35d6ad28a1752a7b3a4c9d3fb4c0208979b271a26eccc992cace09c6575251be54ad5bd561cf9621b6759e092773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
abe9762051729aa60ade4c1857439a18

SHA1
24c9dd7ca35a42392e78d27f0f245ada735a2be1

SHA256
3e978993d15f1ca4bad2f4be2809e0a4367226bec67c2238e6c452b819e6f079

SHA512
b2e54d367758d2bc77f670b95ddbcb9c8248c6df1965198317366bb7eefb7028e713982a73c7d7186ab8dcd35109f06a7ab8dbc378feeac34cb2838b6e5feabb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c84af3a296aa27a2167566533062e9a

SHA1
bf7887b5c1d126839b4d8827c0a2a6cec1d72078

SHA256
f79d46f13f2650b7c22a425c9f9d7c90bda7abf6c3555050b895b32551bb6a2c

SHA512
0d71242aac04d1e338bd5a8341370721d1ed53f63689b5ba8d6be8872f8493808d7b973e9600cd0cb1590cbf101397dc9c8823b78771dbab3d3e6b561cde9781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
aef9f6b9aba1654b6cc8d85041acf0e9

SHA1
a20a7804a1ee376c10a08e0939071182a1865703

SHA256
e7d9648cc4991312b5d2a7c724627fec7a21ef991d8caa731a88e76a9fc73541

SHA512
25fb9a3225a725cbc3213e3f6eddeec6405d7abc81de646520bafcebaad09407a6b687ed781e5a495abcc3f7f0235a5a821fec4f429fe4d926a2447da41f6548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6b50d242763bfccbeac592c10fbfe106

SHA1
3b48cc2ea61bd4eaa9eb2f7e12c842ad9bc77c77

SHA256
84c3c21b56f3002dac01706f0cacc78a23eeea7446ff1144e0a9e3f1fedd4837

SHA512
0f1f722712092bc24bd9ebb0ec025393156dd34796483bb245af16164168913fb06012d57a20eaf7d7f7f2bdb703982af08d4339d00d4ecec9283aa24620760f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
51e40e6132dd82a685cdf2c009063102

SHA1
ace528f254e664515b59b94b91461d62d99f7b44

SHA256
bdfd8d8457fb74772ff5546abe53bb1ee6a1bbd0c71b97adab4bd3efa1555d84

SHA512
bb3863698359b4146e6ea5f15e836346886521b89cce4a90cd35eb571b83e66a8bee292c45434a72fc79db02feb50bdf8c6fa80873c22a7a8a75de132c120553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b17d.TMP

Filesize
1KB

MD5
4b5430a8e25bd5db766b935905f754f9

SHA1
86bd7766b3600fabcbd1645ccba4dbc079a7c1a9

SHA256
eb0737304acdfa9287a24954f4f44d0aaf7b6d19d78aeb859559d1af4338b2b3

SHA512
eb5f2d3970ce6e5108b14ed05a31591d613bfa97fc89fa7159260bf93506f3ad81ece4648f69f6a7c665551128b0934aa994f15ce9bba360e979321aa033f5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
13c7f504a6497e898406727a6e3fdc2e

SHA1
c883af0c8d978ad045edfd0bb09148d013aeb5cc

SHA256
a3663cbf7c953260fffcc19bd8621c7b635fd811ffce061b6ad41fdd7aa14bfc

SHA512
d03998450a900bf42d651475230f2aa87acd07fc1ad03c9ec1f54b6f91acd6bb33c1ccdc55befcb850a7c51044ef8e48a30555fd54c4629c96e4fbf75327a9ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e3553aee9059b181ef6ab7834e15b18

SHA1
71e7d230dc489be19706e3ee2922d3dc75114a5d

SHA256
0d679aac46afb5fdc7ce7e527bfb4c0863c10c0453a56e0a2e04f5eb2124954c

SHA512
caebfaa9294c77d46d370ecc0e8cf45bdb0781f37faa7546fd673f3022488510fe6d1e59e756039724f9aebb39839cf1fb36c1a96b56f0b5df4454805e1c0861

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 307176.crdownload

Filesize
1.5MB

MD5
e8f78a585f610b283b9c362f1f038509

SHA1
92a23c78787ef3503d76f2f1ac31a50b8a1d2052

SHA256
96b9994cd1d6027a2dda058d2fb98caf2aba513ff2abebca6590e1ee2b97bb9f

SHA512
ee700de2418e798c6f48a7cbd118a079fe1a199b6866972b80699e795a88c6dcecd0ce25ba72c4a42d4135ce251e460cdb8b0b592b8e63ce565c924ac3599810

Download Submit