06f3ab8955927af8728f1e98dcdc774ee152d436b6515b392a96e493b8a2beb7

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nezur_Interface.exe
Size

7.3MB
MD5

c9af7e2001b94e2001a5570d3fad260d
SHA1

63b400a16358e589e6bb43757c84f0cdee597b7d
SHA256

b75d3cc9cdd39a2c4811f871efb47f528222fe49a7dc923a82d1ee10ceccdfcd
SHA512

b3c012666476cad91a0baddbc2f568633aeb0abc9331ff81473bb52e1c9aac1cfeb50bf90f843d290eda19bd3aac73a29f9ce6478d33e3acd2c353a8adad995a
SSDEEP

98304:P4QuiXvqdeO4pbZVj9JPgBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuY2:ARiSZO9S2fasv+BptT

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{6E4C398F-81DF-48C0-AC76-CE1A8A8B8FA1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
3084	msedge.exe
3084	msedge.exe
1748	msedge.exe
1748	msedge.exe
464	msedge.exe
464	msedge.exe
2068	msedge.exe
2068	msedge.exe
5152	identity_helper.exe
5152	identity_helper.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	Nezur_Interface.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1748	2864	Nezur_Interface.exe	85
PID 2864 wrote to memory of 1748	2864	Nezur_Interface.exe	85
PID 1748 wrote to memory of 1132	1748	msedge.exe	86
PID 1748 wrote to memory of 1132	1748	msedge.exe	86
PID 2864 wrote to memory of 2072	2864	Nezur_Interface.exe	87
PID 2864 wrote to memory of 2072	2864	Nezur_Interface.exe	87
PID 2072 wrote to memory of 2164	2072	msedge.exe	88
PID 2072 wrote to memory of 2164	2072	msedge.exe	88
PID 2864 wrote to memory of 1488	2864	Nezur_Interface.exe	89
PID 2864 wrote to memory of 1488	2864	Nezur_Interface.exe	89
PID 1488 wrote to memory of 528	1488	msedge.exe	90
PID 1488 wrote to memory of 528	1488	msedge.exe	90
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 2624	2072	msedge.exe	91
PID 2072 wrote to memory of 5112	2072	msedge.exe	92
PID 2072 wrote to memory of 5112	2072	msedge.exe	92
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93
PID 1748 wrote to memory of 4020	1748	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://execkey.nezur.io/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd30fa46f8,0x7ffd30fa4708,0x7ffd30fa4718
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3336 /prefetch:8
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6948 /prefetch:8
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6948 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6604 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16797456002578873911,16199277228838081973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/nezur
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffd30fa46f8,0x7ffd30fa4708,0x7ffd30fa4718
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6075273212366088617,8307214473939529596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6075273212366088617,8307214473939529596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://1cheats.com/store/category/69-nezur-executor/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd30fa46f8,0x7ffd30fa4708,0x7ffd30fa4718
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1440,11644085254311871387,14082602825874984589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04d6c571-56ca-4aac-9291-4e18bb4b44fa.tmp

Filesize
2KB

MD5
68429d937e734b26277afbb1b67ae3fb

SHA1
493753e5c8a7bd9f2cff882ed1439950b32f1185

SHA256
4f44f8fae423eded3bd8e3db89d782ba5a530f77890e0ae7eb0d810d13057781

SHA512
6020db90038b7bf1dd1ecf4edead2f3c9b1e4adf8886d5c607a582a495b7b49479d650a3a81527c811dd4eaa5fcb756ae56f7cec5feb58b9f02c016e1d0571d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
6878f3914aaaa244caadfaadd9a05935

SHA1
3a795c22b3c9dba3a634a2e753cdb0f731363026

SHA256
384317216b8c5a33adebaadcf27f2c7890beafb3260233b27195aa2f6d8df483

SHA512
8c4eb049750a2a87ebfdf81ea401558a1dce39eb44d1852e7e07a1e656ec5b357da130e88739393a3440f3f266e2ffd38811a3fb031af1de085b7dac82b98aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e90366012e65fa00b35e3ed78f535b9

SHA1
9083cf2d98e80eb694871c80c3de936b49ba9d01

SHA256
625d06aaf6fdbd3f750c1643681b9a837b0a84529d277d530c313dcb86815481

SHA512
a823f03f8505fd0ef08b248da64fd1adea40d01fc92b38dd609009860fe8346506ed73345e77067225c59741f594b688a7b5745670cdec39235c3c9b051cec75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
890903b377d5140d7f4692a1fdb79046

SHA1
c655d8caa81720dee6e37b94f208f4aaba27c8a6

SHA256
1ee5c4ad1892fd614726b9c5f177783099c8b9da820ff5af045fb45c6ab5fb06

SHA512
168dd72d6cff1fe8aad3f6010f017635b1b84284b3e212f0146f6c0e58afdd1564e0fffea826501f16f8ceefb649bf873ead543edb575dcb42e33ab2ab02f21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
779d2f81e151229fcd71ea521a059b20

SHA1
a65b940ca220e09c9f2a7cfc3aa12ad000f09806

SHA256
505a4292186a235ec7628767558a2cdfa1bfab5a7a096a181d74c07801fbe839

SHA512
12337b727c5e532dd69f673ccf5c05aed56e1dfebf72155b46f6c48ee4730d2a6303e80295ed7a257f7b7102686fb1fc28b78e7af243eba2c42ca8c45f95edf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\717e380b-cb52-42ae-a1bd-c079b7402960\index-dir\the-real-index

Filesize
72B

MD5
1c55df8bb7a0ae9a3efd42f185a2f6b3

SHA1
446af9866a6d206e66d5affa794db66eff11000b

SHA256
698144629129cda8f25599ab3feeea461d79e07c2d79c38c8a93015c2876f8aa

SHA512
4eb9f22f036f3f91f328b877887d2e1f05fd0525b9c86e9c63c237025769f6b018ff74d01da5c8f71b7755a2f756f890262fd5ad60d85a9b9f97cdb3f3f8e3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\717e380b-cb52-42ae-a1bd-c079b7402960\index-dir\the-real-index~RFe582759.TMP

Filesize
48B

MD5
dc274ebb899fd548db56c1eec29acef9

SHA1
a523d23d56dc514e36d905397712478a0ad8dfe9

SHA256
0d7c6e01e69318a7d19e5886044cc7f0cbec737d0e10013c30f87c7e982b21ff

SHA512
35967057b7d1f855b535afdae9da96a35227cf4b98d37ca4a2e180e0cd461d8056944d47a47897e64a4aaf931d4561d56b89cd1a8a8825b7ec2b288186dd81a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
116B

MD5
94cce612e401ecca5c9a3f5a0da5b816

SHA1
adca032c26c8eea8f256796f6fda5b350feb19e5

SHA256
e8ac1163f5c7716a2284f08f2cc3986e2aff45e00582d71c43718c2b531119ff

SHA512
5ade863c7d66de2fa5c69bfde07238a9b6dff2db9ac2ac5fd6fc39e918afe6ee2faad4518e710a36d764cb7f62f1580eef31f39a5e96d6aae0a178d5077615ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
110B

MD5
c8729f5bd389f8d242b570c46dd9c23f

SHA1
c4c13e08f74c129f3d69e68df64a99f57e0779a1

SHA256
6b24652e2ed2b9dbc070f434daed90688178184535008bcc6dfcec1819596afd

SHA512
524afaf52c3a25c17ed87851137aa398ab804871a87c4d145756424beb21bff2ff8054691e10699f19753a04409dba860e47b5cb7a37ea2315037eae72a73297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3f3d0cbb7fd30f268eb0fd36514241e4

SHA1
382c9da0dc2a4563b35087fa097b3c9e6fb7a785

SHA256
47ac4d4767b2fc7f50313e10b5a5ba227d98757f31da5f5181ab3ec9cdf17e2b

SHA512
7ca0a1d9d30da127692ff2c12523ba41fdf340a0d23430630b2a60491b8425846dd75848a5eee4003e0418ff3e621e3b2cadad3b953f5187009d6a7b0367bdfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58199e.TMP

Filesize
48B

MD5
ecb871c18a114ecbcc47b83fa76f1614

SHA1
09171c167cd8a71e302b9d6f6be3ddf085e79381

SHA256
73c0b009f0c4c9c8992597399e250445536d62cf363c415a4f9163f3ff6e1dd1

SHA512
d99d8c1d9bae4d6323f4c227054003885a66aeec9bbf70da23acac8fc512997d87b4cd2a9bf8c203dba393e3b217f1c996b6983207a86b8e30fd8f5aedd4515e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa410a69126ce7a9bf7aa29b2d24851c

SHA1
ef9ca540a281688dec9c4bcb4868ae017b9b9ae9

SHA256
5d6d7fd8bce949b0d30ad2e4810225673e690b15642183d3c67c811b4e4c6453

SHA512
b4492120c48d70cbb84fa52a6ed4bdf73dd077cc20f9d7985a4b2242e17692882a3c14e041a7c6578c3977dd76ba8ce8f6ae5b1607e1cb7ff2e306535711c33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5811ed.TMP

Filesize
1KB

MD5
f7a6d79169097891b43c2db9dba32973

SHA1
43b889d934f5405c65764352cf4fce99cfe2c6dc

SHA256
ebdc579162955b2d4a7c0dcdd6e8a084ba00301a995a8b5e65bf737fdd061004

SHA512
c33b0f66bcd552198e96c4dba92767f051289ef5f6b30eb6cc7b8fe2c9f503c92dcf6c84bfdc0a2dcae1b938fe611bbebd507c5674dae968b0d546db95f3f301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c46417fb8b5eb5299560b362d6ec18de

SHA1
9b7fc43d397db7252951001471d3ade3b8156002

SHA256
16497ea592251902373fa100fa7b8aad089132081e0ef0d774773a971ebe8af0

SHA512
6ab9b8aa4816beb72af110fd6eec48832a0b370f07ee7f20af3b186c930f69d07257f2776b4f2cfde2a51de6afc11931ef0c4f4dccbbb755c8e06a9c2febd746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9be13a00760ae9457549cf64c107aa83

SHA1
e6843f62b511e16d99fb46e59e223bd24a5d0a44

SHA256
1750c85a0e42fa06e3ffcd62ead9b6c00e6f1ea75f0915730fcb7c9d01893d68

SHA512
ad170127b576a09666839934a1848e03fbc5f6f5cdfc3be6e6d7d069f4398276231d3bf407bc82244efbb0856d81581ce8db593dd1ce7ce9868b4f190e5e30d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6a5980eb6d9a0b8562e3ac17e4240276

SHA1
995445d3abf14cda32660418a8c6e60f88bff018

SHA256
db10cc3553a99d2009ae834e55264d7744458c1a06f18a12dd684516855d0b6f

SHA512
6723055133b40096419623ea56e54bf119b9830f1a27adb2998b907dceba6131aa3b391263a5b09c540ada9f53cddf8ae1b7d9e7871e7f48ac7ceac0dc7a720f

Download Submit