hxxps://sourceforge[.]net/projects/fastclicker/files/latest/download

Resubmissions

14/10/2024, 23:59

241014-31wv7axakn 8

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sourceforge.net/projects/fastclicker/files/latest/download

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	10	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d2b8617ee40653f	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 487853.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 636823.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
3248	msedge.exe
3248	msedge.exe
1264	identity_helper.exe
1264	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4116	3248	msedge.exe	85
PID 3248 wrote to memory of 4116	3248	msedge.exe	85
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1852	3248	msedge.exe	86
PID 3248 wrote to memory of 1008	3248	msedge.exe	87
PID 3248 wrote to memory of 1008	3248	msedge.exe	87
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88
PID 3248 wrote to memory of 2312	3248	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/fastclicker/files/latest/download
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeffe546f8,0x7ffeffe54708,0x7ffeffe54718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10535402407087704833,6641732568411946182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
b6b1d79a2fd4dcfedc8fa46ac6c6ec34

SHA1
7f340ca3b0fcec9805faabec05a067f6a5f45ac1

SHA256
7a3e23913ec0af88743981135a4aa890df0851faf4d310a573cb30d0fd4ccd2f

SHA512
55e1207cad594b18bea22fa27520ba0cd3dfc34724e989d747ccc347bb4a373cd745429fbedfadbd3ad59143ae747d80b3a439711e4a7b91c4efe849457ff980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
c9a1e00ac5c7b6b25757de688d35d5e5

SHA1
08b537e3e0be96eb3391809c1c93af0b53e96515

SHA256
addc82af25799b140d80e88ae5d2f3d7bf3fb7ba9f8ed928fce2374a8b1eef8e

SHA512
aa33321c9cc9a0155b36b16df456fefdf7a5e49d89996514eb69fd3840beb3cf34422bcea43a3c9c4b454a54e978ae3d330d2a27bf3478ded3c4f182fdd2ed76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fa1900dc3f5a06c41447699597579a75

SHA1
eedf925a22ce4c987a31e220dd34ae0398b9a9b6

SHA256
19fd94579fbbc6c51a7446bd0d34f0b6cbec0afe2515ed0790ab64cf590fd4ef

SHA512
1943f2f0838233fac9f49e7b4ab63739189c53f28c5d7004e14f05baef97d4720c3e894fd5b48cc313acc1e7a771d5e6d7a8c50f8832008bd03ea77cd453934d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0767082b3410edd06ab0551f1cc9241

SHA1
b9f0e0c23a3b2f5d6bbd45650490f9248f5fe711

SHA256
2d7dc266a41f010acf12c296bde11aac3b240adda78a55707c1fbb514ff4427c

SHA512
dfd991191deb4f64c554f59e12c93b4657a3797af4841cf07885f54cf2ec4b700551796834c2fd51caefa3cb6d87260bda3f3523cf11a928e0026358117c2cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b07ea5cc3e72068fc570ef36828eaff6

SHA1
7bba4f3d34f8a1933c398265ae5bcf77c8600341

SHA256
28010ea955ed6c87a00743fbee30b1772773a79e38c7100b0f08f361f76d4c73

SHA512
cf562c702ba3e250ba5b45d7eec7a0930defa989d83f85b3e23e82c08576e54a34ce6c64d14bdaef41005ff011196a6d0e24897b0ecd9f89387ae00b2815442c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3287cc411061bb0f86997b055db8c2a6

SHA1
3d304d6410687aa92ba3b3f4991874abc3031c97

SHA256
e18d0d031714efe6cf738fa2da18c70b35ce5e306e29bdf126959b58c21a9308

SHA512
15b6d7a16fc5d32c7cfce813b67fde9082da565641b3697d71a2f2d6ec02888b61b99e2123ae4b008f62dd5a360d6c8ee7a4af60d22e605b1869cf89f2b2131c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58676f.TMP

Filesize
705B

MD5
a935f4d6838a7f0759aad8a6189972e5

SHA1
796a8fefcb7af0c3862d6ec884177ab7377b5628

SHA256
e28b52a1e7a58742d3d7f50dd3b6e8c240dd73c29fc3afe948652280b9848210

SHA512
9678073f0d9894c9356da4269f6f1c8243b0ab1f1b3442d465539572c9177fb31c9fcfb8da8c8a0a910773b6d8750291b58df09c4801e29ba1e0641eb3965ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f840954d-5480-40de-a557-b72bbfdeecd4.tmp

Filesize
705B

MD5
82f5ba212402c9d7a4af51223dbe1ae0

SHA1
cdd6431f2dabca745f567e7022eb29336c114943

SHA256
30eb2860a090c19c3525ff516522211e2decdc66f047ec8842dd89d20e02bbbe

SHA512
dc0b529c7e76bfc0bbbebdb8b3102f2faa64edad53e8c3b0e18b4db8556338465817339b6cc6d8dfe7425f80bce3af33b58b72b445c54bab03164763e9e97d26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25f2b83df975e63543f141f09777759c

SHA1
f81a8844b8f899f302484c884cfd2c163ab684b4

SHA256
1961e399def37d130e02f795309cc0e766e2a24f2c6f0a06b13d1f45d4e78258

SHA512
cca1ae4e1786b1e6e5440baf3b71396796c46072bf988b29f05d6331970003916945ff46feef164f882507d2087436fff9eff7729c08ea99a7cfda3d1159fad8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 487853.crdownload

Filesize
17KB

MD5
e787763e761b600730c38b3c47d62f2b

SHA1
f1127b79126a3bc7d80be8a55c412b005497f944

SHA256
76bbd8b86fb0059e43aa2b1a809071ecbb9e65c409ba06bd0d147ee5196ee0b4

SHA512
5041d5ee7b082612b9f8adf3636f4c137c2d70728a8a831bbdb14063007a85e95e8ca8d3118980442640e34c5ee72d03c19f7db96b218a91b6f250bc5c56a7fc

Download Submit