hxxps://www[.]youtube[.]com/

Analysis

max time kernel
1142s
max time network
1143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
4932	msedge.exe
4932	msedge.exe
3384	identity_helper.exe
3384	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2568	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1828	4932	msedge.exe	83
PID 4932 wrote to memory of 1828	4932	msedge.exe	83
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 996	4932	msedge.exe	85
PID 4932 wrote to memory of 1908	4932	msedge.exe	86
PID 4932 wrote to memory of 1908	4932	msedge.exe	86
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87
PID 4932 wrote to memory of 3308	4932	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf8f346f8,0x7ffcf8f34708,0x7ffcf8f34718
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,330941635853015067,16158784679458480450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a6171ecd0586048ad2afd3ea1671ebe7

SHA1
7c5b0a1be508e5f29755c2ab35e0322ef93aa60b

SHA256
ec5b515725df8936ba2f3740a2a5e9629341dda522baa9d042748ceb49b688bf

SHA512
65ca98db64a9a311d2128356eaa2744f39a19623e49c19f4ac067af65b0b83e2ddab98e0e4c119d269d7da19ce9a72ccd865ec47d24717d13d72663660071b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ee57fc380a35460cdc091426cb079b2c

SHA1
e5f8941b688bf03f04d9c34614972c1c12f9991e

SHA256
324195670006cc8e8b1370ce943bedef73e99601ab29b76eacc64e04e327175b

SHA512
be5d5d9d6c8b97dc84ac01ecbb424fb6467ad075bb7073353ea2a7be5d1c142b7a5e72b7cb73bb2615a42690a6b40a3497225d90398a8c7257fa34289d6f22cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ca87331a8874271775274c74ae2bfa34

SHA1
c759467794abc792729b1b29242115443f3a1a80

SHA256
856845a089deae89ecbdb7d720cd7306ff5a9e538a90c9bcade8e4968206fd5d

SHA512
c11e79a02fbc8e8e8266c9e52fbded88876fd8f402d263faee20e77bfcaf79dc57b464a46439c3e078a376e25ebd734ba7a4ae2383125d1597bc5c23ee800fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cb72929269f4e640c869986e5629c007

SHA1
5cd3fc16bb85905e31062b06033583bc95b89069

SHA256
63a7828f3d2b6de26207c31e88737118a13b611bfdc76039875c1cca550f2b46

SHA512
9d02348f733c4ecaee735d33a00e94e9142f5c2b43a2cad36465276e358be103dac90d422c5c53384ebd8951178783253659384b01a2987c4322308174cff172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c9dbf7c0b97fb902ee7beb2d0bdfc7d3

SHA1
a065def29ebffd5d8bbaef20a8c4ca1a81571709

SHA256
245d3840e3462bf3add62d2d6a1087e898af3ec033ddc5c748d6de7510e7c05c

SHA512
ddcf798ffc3775a1f6e723bc9cf3eded7ee1524826d4dd8bdaa5ce228eb84f98f750c5309c124afc8383bb7f852d0d1da01ceec2cd9bdf1b27fd8af4ed2a6fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9af320dae1a3aed4805a8ee8b35ec914

SHA1
fd6e6a7476be25f7c13f2356b92c323f3823887d

SHA256
a805336e233bcc65ae448f33d514795d16272e8ffc335859befb4f0032777ab8

SHA512
1f51a9d64354bf804f8b994586d6922937dcec8229515006dd53a2802a617766098735331c2563e03c39d83431cc060183916e20c5d38e24d534832bd89be93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
921c90a7591859a6d564d599f3abb682

SHA1
85922cabca974e3cfec388740e42225f26c0f268

SHA256
54c8d45de3e16234bebdad669cb96a09e602ec87aa3a6b18748bd5d45fa733f7

SHA512
ac9e7a7e8fabdd486307ae25b1e84a56f009ba5aacdc01acad3a800b96594b5fd49e8ad5f5ef3990509487edc920cfab297c8b5d173d1ea9e424ef9dac0612ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
196a2fb9fdd43547496ef3af45e03e6f

SHA1
8ad162758ce556ff9bb29cce0ed523b0690ead26

SHA256
2933693a9f5b259367fdae2a1459672592c5c902163ba89ad98822068329e0b6

SHA512
fc54e794fb11df1bb4e4724022d2dc28a3af59683a3cd897c0e30f3222d84715bb775caccccc83776001bbff10074d15ba49fa401ed80755bd92f2007fc0db93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ae8ef091-6ba8-44cf-8f5e-e73d6924af83\index-dir\the-real-index

Filesize
2KB

MD5
58399eeb2662caff05dbb0b91ed72b5d

SHA1
9787912809c869dededc0258653248377187bf5c

SHA256
83538e3073911679d7b43aa891b4f9e426fcd88f514903ba377fd8df1ae50340

SHA512
73b95edc77c68f205d0f323eb427ab3b8c0eb244917db7bc358f00bc320ee48767a4deff397b0d0183b7f08c2a59fe8f0a8668be013712a7b53be40785e24fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ae8ef091-6ba8-44cf-8f5e-e73d6924af83\index-dir\the-real-index~RFe57fd1d.TMP

Filesize
48B

MD5
7778e4477f631fa8a496cd8d94c9e841

SHA1
39c8ca1efa2e6b948185f8fce0dd7c477ab5299b

SHA256
0cac686223ba857533da661eea7b5995471fa412b0c45cb3af443a158a6352c4

SHA512
b5746d812e42ef67c9e5126948d7bf4a16f9ec037e66f36871985df11610ddbd3c2190161391ed049279a6783484b8b2f364e27fa8e568b76627be598bed7d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
4327a5688a8d3f91226e13bff8d7f770

SHA1
7e01b836902783cddf02db12b1e992238eb632b7

SHA256
694435f017b3ccfd49c280b1b7d934cdd084f11298a09620ef365823b37fe02d

SHA512
ba74020c002b5a49cbb7ee401a8dcfa0b6b35315ff2255e80f716a1408c0c59ca42dcd45080a927aeb78f47f3b11c0952125d1b75238d130cb919bec5923dff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
efd464f2d455ce2b9311519d405dcbf2

SHA1
0742e34c31d7b1de4a41e6bb3bd518041a6b6f0c

SHA256
3bb93948247fe75a406478111c41647a4ef4b3dea0128924c3f106c0be43cef0

SHA512
f3d7dbe6b086fd0d196ac7ba0bce32d86b849d162dfa0932f0ad5e5d9c8410171080468a1c1cac39b4a70305bec276e35cc08139e72911c078dc6b90cc717ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
ce97f90fa73c34b18d6ab5262dff6326

SHA1
5a9b544099a9e5f060452d831896c6c17cca3ffa

SHA256
12b15df67010698229f1c9075673f3aade44ed0a8dd5a10782b4daa8b69fa573

SHA512
d116748e80eb08fcede08e725b7c35e3a066d2415a64c287f8bdc89e50aac48f282c92c94c2afbc40e4608efe3e26054e453c45fa2db199ee21ccebd4e0add3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
fd9f82001ca6d9b4607ce7a4f5d02ece

SHA1
dedddcb8c8365c236896f59750ceb56607d40c25

SHA256
b572133148e272b171f2331edcd6b3330c5d8cc14b99e44740b6df1967768123

SHA512
d24a7d42c633765600ab095cd47fe4c5a7fbbd960fa38528e7820df5ea1239d062c0089e61e17c834fb37e53fa76be7c52f6fb0e62af0935d66c9be83bb4b0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
699060bb3828ed61d330e7ec87b76b56

SHA1
48ae61c5a1a3137bed5542e9244397afab4d9a08

SHA256
1e1be85fd0a28a08ef7aa34e4401044bc10e802e4c7d4f84a7734176fcbafecc

SHA512
e5612eea93a9966440703947986688433d1ffbd7004484e0eff6bb68c4b0319588d415d59a38314be38c8b1dad2535f181e5d95e5b921f87364fdc1fa4c240b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
01563d02f121ac8418e99c6133e25054

SHA1
187d60eb35648032e694025b15600be145a76a99

SHA256
6cc5e6fb3e9e9b6a15a0876388c98b61e532bc59f890aad6ad4598ab44e30f48

SHA512
0df25aa14028376c606feeea9b35b3a7a39d9bd779be9a5ccd1bc114e311d95173acd6f40d92c4049702b47eecef5270d9212257d5e2bf439236e0145cd59cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f992.TMP

Filesize
48B

MD5
3d8b9fa3d8b5de3a66a5ca76c89d4f2c

SHA1
2da4457de4b0012282cd23030a6e3a9d610d5ce3

SHA256
4d0cf8bf02b33b19df3373ddfdabe2daa2d86185b5131f619430a4e9afd053ed

SHA512
e249d8809c19279dcdcbf969149582a7ee8c713c783397c0e2dae6df3b5bfe7f256df783bb1a03653fb9fd35c254cb6867e47106e0e431138f69aad0a951dc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7db175a19844b48b794e8f5a543f7211

SHA1
e8b6ff6adc6bc301ba0fc508c675a3c542dd152c

SHA256
dc64d8ad14f47c9aed975bbd53cc6c4f7891abd85697a5e37e7f70ba90385d1c

SHA512
ea15691ae7d5e36c59a0374627472c80eec9f540b976a129a995c331c1b667c0b10ba0a7289be666f3ade4b7609ece367cdf8cb3d2c54f54e8445bd146a861a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589798.TMP

Filesize
706B

MD5
ba3fcd6402d1da66395c5f6f9b5a25b5

SHA1
f617e2a7595bb6d25ad215057d8fc2d2071acf20

SHA256
1027441c9efac3452a703e572ff627904a7fd2cec0be19b03b199cefa3cf29d1

SHA512
0e3621c25e16d3a165b095fc0a7454de503a7e3582f3893d487ad71b1b478ac2cde51b8869cb623eccd7b95f026c635e37ad7fb6f28752ad9326354c81a57cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
265a7e2d677b5cce09f92cc2c1dca044

SHA1
88705e9dbe2f5d0d69c8e30171e10d0a816f1060

SHA256
b886ab0eeba1b93613cfe0540907db8790440d2564afbe9e2096c7ac38ad5476

SHA512
db5bdbb6a61967f5d9f87942ecd111763c2f87889ff1cc8efe41b54ac32103c7964a53cc2646050d2ff5192a1c8c5770ae628da824fdf74db7ab491b3375e904

Download Submit