hxxps://www[.]google[.]ae/amp/w%C2%ADw%C2%ADw%E2%80%8B[.]%E2%80%8Bgo%C2%ADo%C2%ADgl%C2%ADe%E2%80%8B[.]%E2%80%8Ba%C2%ADd%E2%80%8B%2Famp%2F%E2%80%8B%C2%ADww%C2%ADw%E2%80%8B[.]%E2%80%8Bgo%C2%ADog%C2%ADl%C2%ADe%E2%80%8B[.]%E2%80%8Bes%E2%80%8B%2Famp%2Ftemplearchives[.]com%2Fsni%2F/bitiytaf/Z3JlZ0BzZW1wcmFsbmcuY29t

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.ae/amp/w%C2%ADw%C2%ADw%E2%80%8B.%E2%80%8Bgo%C2%ADo%C2%ADgl%C2%ADe%E2%80%8B.%E2%80%8Ba%C2%ADd%E2%80%8B%2Famp%2F%E2%80%8B%C2%ADww%C2%ADw%E2%80%8B.%E2%80%8Bgo%C2%ADog%C2%ADl%C2%ADe%E2%80%8B.%E2%80%8Bes%E2%80%8B%2Famp%2Ftemplearchives.com%2Fsni%2F/bitiytaf/Z3JlZ0BzZW1wcmFsbmcuY29t

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	44	https://processings-portal.torquesmeters.com/cdn-cgi/challenge-platform/h/b/rc/8d14cd7dfcbd385b	7

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
1968	msedge.exe
1968	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5000	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	osk.exe
2612	osk.exe
2612	osk.exe
2612	osk.exe
2612	osk.exe
2612	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4220	1968	msedge.exe	83
PID 1968 wrote to memory of 4220	1968	msedge.exe	83
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 3296	1968	msedge.exe	85
PID 1968 wrote to memory of 2340	1968	msedge.exe	86
PID 1968 wrote to memory of 2340	1968	msedge.exe	86
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87
PID 1968 wrote to memory of 3284	1968	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.ae/amp/w%C2%ADw%C2%ADw%E2%80%8B.%E2%80%8Bgo%C2%ADo%C2%ADgl%C2%ADe%E2%80%8B.%E2%80%8Ba%C2%ADd%E2%80%8B%2Famp%2F%E2%80%8B%C2%ADww%C2%ADw%E2%80%8B.%E2%80%8Bgo%C2%ADog%C2%ADl%C2%ADe%E2%80%8B.%E2%80%8Bes%E2%80%8B%2Famp%2Ftemplearchives.com%2Fsni%2F/bitiytaf/Z3JlZ0BzZW1wcmFsbmcuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15620491516606394994,13231331146818942011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3c7c23d0a382b13972490e038d64c9ae

SHA1
c5b510cef9854e4d24bec81c4ddaf483eecaba35

SHA256
ff2757a4fdbb83c350ce64c570349b167edc2882381773a480bb77351c38b69e

SHA512
2f39c5f5fa5a97b7de7091ba92abe8d92b84fb576d977e41a8571ec9067d93151b31aad253190fdd5df78994d9b29ac39698c6dbe1eea2d205b65527114314e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5af4480f9b72635af91356aa18e1c290

SHA1
0e7c5784ee6d90000fa7c90724fac25ce2df6ced

SHA256
55da9afeada97fb07053764fe7aacea0172a9b86734580c45875ae0d33f73821

SHA512
2565e080af261a3c6a2915167f8a009fbe0b011a9906b5322074ff988f5abd4b62aa171f49f43ee60a45e9af2dd881f0bfd15719b61f10e8076c3b3a26dd5440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b80a7152135b367887c67341e431e233

SHA1
04a86e2e1fbe053ffc495b16ac79ef6fbb1d3fe5

SHA256
45596af641150f8e57079551ce1fae86ebe8f47a4a581cf518d4ec25747a0375

SHA512
893f3c3f9f1500b12b787427981c17666165ebd00dfe9adefb64d559e73954edcfcc3d2686221122d8e990df8f197660c07c419443618ec9fb200d212abd92cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a78b2e93a973c8cb3a76b68aa748c51

SHA1
a1c36fa35e9461aa8e9d8552e7357f13e9c5256c

SHA256
80e3640ee2ed47e6979aa3160abc449e6d6243ed0a143a27c9f0640aebd5c5b3

SHA512
2df48dd02eae15e2ba3db1a11f545b1fd038347707a4160879798186961086c9533fd64bf7e4aa3a6f1f1fb725bcdae0acb709e0b0a40696c7ed2ac310313dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88f61432e6d6d47591c4a801b44c0806

SHA1
83ce27bb4f00595836294f0ca0a5686b7338a472

SHA256
815db5ef586b047b13c643281faaae5ffb77a252fa4710afcca8d71f951054fa

SHA512
b5d21a0dcc55e82cfffe486f0d0cf15ad4fa50fc52770429d7b9150df88127bcd94ee729ce35267a8c64a22523a16390ab5491faa83bd3c3dc6d6c8c3ed0da12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a58f0512cd702209a7facac84afe65dc

SHA1
a02166a66de3a08ae3cc30081d2886aeccab54e8

SHA256
42f46538c51ca2088eb2ee3168497268aee00719fb189905ac5d275531628f72

SHA512
1d0c2a080f6fa5ff15dfc30f876b49bf988040294c311370bc925cb1b1816741ada4a4b4c257b2631cb6941666f2a361ad92068d3e75d4956b81a0f7d07330f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c1283ca85757f36a9f9453cd30ab0c2

SHA1
41ac4b9d39064155c2d539918aca1bb338036cba

SHA256
2fe749ec81c00e84b2ee53cebe9a4376ea5c1f8686abfb9b63a55aefe3e2e4fc

SHA512
af901212a05a8aa9a14ed040dc9fc1e401e5f64ed8ab9d36700753824da305f2eadc8aa556a7da427bacb6bb749546012aa1d9cf5ad50756af55e0ebd89b4fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
64f555d9a3b10a61e03376e2b43a65de

SHA1
b0f8c15b5b6d357b441d9b28af0161e295e9371c

SHA256
e5531bd3b8de1ee3d0430b8ffcc08aa0fe46ae8430ac97182b118c6093ae908b

SHA512
2b5d0477ee622633536321633bcae3a73133e2ba1ec00de69123498886dae4bc05f0a722e0f2d74a27f20ffba446e5b9f2f94a44a69a0120d133762e5b8f9040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5872ca.TMP

Filesize
204B

MD5
724aa955471eceb79772299f14090c7d

SHA1
5801ffad35b85fa4929b235807e340dfee498b4f

SHA256
ccecce81cdb1e9a17d0357112fa3b0ab523d2d3aaaa7e9838dbc5c3c2d25e04b

SHA512
95ae06cb4033253b96656f62c1245e1590614aa0a66f437160f908b328c8e6e99b99f4b266aa1ba5aa34454ca3a5aa2a735a16af32d1a9627cb60a4463690fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
376b79edcefbb93ce0c68d646eaf7e7a

SHA1
e84702460677560f7a0164b0128433ae5a3743fb

SHA256
013c3689fab364f2e4e9f98f525928fa03ad75edd77ee2849a0d1a3f5f6cf09d

SHA512
3b53cdcfece275f786c1a3f6c2ec20bda1ffac9c18a34a336f46d23112824765e7e9b16d43bcd7474e9030b60fb6fe6ee381fb9ed6a7d75a93c9ba7d929d04e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit