213306ee078c7e7869a62b742181a13d6068e3050c49c1b9b2ff31fa745bfe93

Analysis

max time kernel
122s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-10-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Debug.zip
Size

1.2MB
MD5

f840c672727d783e8fa90aaaffd18447
SHA1

10e70458c1fdb65ff5870286d8840665757f6529
SHA256

213306ee078c7e7869a62b742181a13d6068e3050c49c1b9b2ff31fa745bfe93
SHA512

24031d7588ccaf2de3ac6c4cad8f14d5d863074884cff1cbea0a2c55412bd91d328129e151d5cdf0540938029dbdef509008708ec9a76a85ce9d4b51dc9c4188
SSDEEP

24576:SfswRpik71CjArzCa2YRiNg9M9I3rlw2ecCc9n6FjC/2PeKPy96mEgMJ8W:mswREk7FpvRiNg9MKrl3eczn6FO/2PeK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4584	WindowsFormsApp1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3396	4584	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsFormsApp1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
2660	msedge.exe
2660	msedge.exe
3568	msedge.exe
3568	msedge.exe
2624	msedge.exe
2624	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3628	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	3628	7zFM.exe
Token: 35	3628	7zFM.exe
Token: SeSecurityPrivilege	3628	7zFM.exe
Token: 33	4152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4152	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3628	7zFM.exe
3628	7zFM.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3140	identity_helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2236	4584	WindowsFormsApp1.exe	82
PID 4584 wrote to memory of 2236	4584	WindowsFormsApp1.exe	82
PID 4584 wrote to memory of 3568	4584	WindowsFormsApp1.exe	83
PID 4584 wrote to memory of 3568	4584	WindowsFormsApp1.exe	83
PID 2236 wrote to memory of 5036	2236	msedge.exe	84
PID 2236 wrote to memory of 5036	2236	msedge.exe	84
PID 3568 wrote to memory of 4264	3568	msedge.exe	85
PID 3568 wrote to memory of 4264	3568	msedge.exe	85
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1996	3568	msedge.exe	86
PID 3568 wrote to memory of 1916	3568	msedge.exe	87
PID 3568 wrote to memory of 1916	3568	msedge.exe	87
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88
PID 2236 wrote to memory of 1456	2236	msedge.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Debug.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

C:\Users\Admin\Desktop\Debug\WindowsFormsApp1.exe
"C:\Users\Admin\Desktop\Debug\WindowsFormsApp1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/watch?v=RfDTdiBq4_o
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xcc,0x12c,0x7ff928123cb8,0x7ff928123cc8,0x7ff928123cd8
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,418050087910548588,13791214878020925551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,418050087910548588,13791214878020925551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/app/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff928123cb8,0x7ff928123cc8,0x7ff928123cd8
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,1146277588522077818,13009965062594870134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
    3⤵
    PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1280
  2⤵
  - Program crash
  PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4584 -ip 4584
1⤵
PID:4516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
ccf098aa1cc996f0a47432d9bede385c

SHA1
85b3d76b34e22b40c1f50f6ddd16783681cf2de7

SHA256
c80a56c20af88d909febc462893cc51e1e1f9ae2871fb9ee54f80e91c29740ac

SHA512
867099612dd1723ef16996c022c8a7fa3f1ff17ed6f7d1eb6b6ceadf0b8459c267ab09307bb7b96399f56ed00d5a16ae3043b14b2519ef002eb114574254fd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
52b53b054f3e62e6a022f9ee4c1fd8ed

SHA1
a221bd97e6242130111ae7cc258a3501c209da87

SHA256
2cb75a667c84f30fff2793ffeb39846ab40ed4e58f25c77f8f39ae468a1961e7

SHA512
6e3776fb5faf0e94ca916d9823e06a026d0a28c18dde20d2831f244e7ccb378fc4baca484c37550c6e2e5127f692f174e1eddb576b10facf6d41b2c9f40953e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddd94fb1ae19066c5b5708d7d8aff140

SHA1
534dc7d617850b78050cb27dcb0707f9d3caf563

SHA256
3e91a7fee258548fb8e3a66aa4d24406e0e9988111b7ea34c4cf3451d80343cd

SHA512
9c40d44259200c992bc407cac0f77bedc82727f923bccfbbdbfa698dbf28442254f098a9d3893be8eef5389160915c8af04757f766180c433888dbd36c32cd95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02e60fdb0c6ada52a5cbfa5ce68e3e93

SHA1
a90f68d6f85231abf78933dde3f366513a2d41e3

SHA256
47ed6d1c66099226f7bc3eefe33b25ed7d533251f2082a8ef6520b1450880071

SHA512
457696d4544f2b3f054d0bb9cf369d3b07414e469a2f2cae9cec288f1697b69492c5f6b9a6dd0f3bb58a131dc5ddba468765823fd18d754f1b4df7d8c83dd04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d70cef0c9383c8bd5b259446495987b

SHA1
1ac093833e32e8b365b62e207bf5fe0900100043

SHA256
8caec5911d598622858db8870de5a52612342eb3512e6ded050cee9464945214

SHA512
34264f86e06ceed88f73e7cf3d2b21ad9038d18b810ad488451068185407abdd27689d05a1a96265509681545106ed291f134bc69fb861bce17f7297bdd5b6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fff97eff-a001-440c-b5ec-9366e8943532\index-dir\the-real-index

Filesize
2KB

MD5
caae4380f7107c42b4206b7904cb1dd6

SHA1
2bd5bea08507946c193898bcc70dc18d7bf64881

SHA256
cb5cf3e5da1e85d9070f398d7915e4bde981477d34f9346dbd61e881874d5e81

SHA512
d6bc085ded42533e8f12c2e572ccc95d96e3bfd29a8372a27dcecc5af6ed2c6b6ab8cab3bc033962e20f0a9d19c0decfe4ec76e650370eb3e9240fd8c68e321a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fff97eff-a001-440c-b5ec-9366e8943532\index-dir\the-real-index~RFe58315c.TMP

Filesize
48B

MD5
e9b66df9162a39e950d68092837d214c

SHA1
7e60190e7b894710604f7c2d8f6fe72c69946449

SHA256
1c38f4ca031e3fe5e0b52306955bd1a3c07d4dd3716b2fc461db13a872d5e210

SHA512
d0fe672d3925bba0539ccdb8ba020bd3c9aa71a2b339b5c7cccc7c72a4d6397686e677166e2ed39118db156d062b3e193eb319642a1608e4bd8222935f0864bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
7fdedaa8a304b772c883410a842e0877

SHA1
49e1216fd609a3f3adcab2054e8c141d1bf97f9d

SHA256
5df2f154071489a81dfa00d3a0aafc4ef7a23d3fb6a6f4bc70604ff15a9e9ae3

SHA512
20ad89a1071207ee7c07127b767a4ee0cc2e7c86bb53fe2b84816fd4ce712eca46927736adc498de834bd3f0ede4a08e0ca4556d084de32aaee65ebfe9c1628f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
23eafe615dae9a3c81cadc0c00952c2e

SHA1
62461f4a3691fe6d9adfa020c3ce8b15b17eef5c

SHA256
2f8d157dda8241c9894306434cc6dd91517a9ad04860813c873065d5caf5c76a

SHA512
29323638e5cbf0e5960472cf39ff41a2a6498a8c04d941fd8be7418ebb3a64cd70803810a8d15ccd5b53510fcb16ffd4e30f417297651ef8b6ff72647d8afbae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
570d49fb2a154f8b61e6218efe94ad7d

SHA1
3c41988522839271b98bc4c523bbd5ab5652fca1

SHA256
e364241c100f02d7971c33c22c07f1e6252eb247c19a57c9b352f3c0d59571c1

SHA512
1571ea42d9d94b2b8ef3de86a6a4afd68d0d9920ae0b16d6f8c911a1c9785b280dee170d07ee94d3dfbb9ad6634dfc8b80643e5ded97edd5af5ee06dd3d678ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
6bbdc7d15f1e39287fde273f3a5c33c2

SHA1
f94b686c0288aa5c349c1466e52f8899b139a571

SHA256
778882a58ffaaf6f34c2f1e52f393347d254824a526d0a300a4ef579c23ecdeb

SHA512
87ac6b2e6cff4d91c81ee017570f8e7809bbeb18fce5937858f2a8e9765c2228f575b8890c5ed943cdb65e829364f89b1a404b3b38ee80388c5ad7bb22a8ed35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
2b8f8ed20168cfc1764301a877735a1b

SHA1
fa0130c4cccd1cdecfd485c0c735d21ba11c5721

SHA256
5b43df717fcf512eab28dc2505bcabac0bfe09e341abd1110d2ac559e52a7ebb

SHA512
0a76902217121077d4b35a6f8494cf20176709fc24db85ce8d27ac228611bfc4974cdd23b0d33105c98fcb13b4c7f97a42a573da223d55288a55c58c78dbe9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f7c.TMP

Filesize
48B

MD5
ca571f2ddebb18240d4e119d77124625

SHA1
2e932727545b4240b70b8e297bea57b1315a8a12

SHA256
9016ca641ac3606d9c8282b6f686a0afe17ddf60373085d7b3e83e6a080ffd3d

SHA512
29ff02fe505963c63d90c3abdd1ae1fa257b450f985eff6cbeb2857328abcdc5ccf5f439b9e6921bc2783623a9a25a0b4770a114535df43548cbb7408910ee86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8aa9f01bdaa56ff7b7265a1c12a51b10

SHA1
13cd9cc769d59942fc3afe2b9f6eed3e241b87e0

SHA256
29b9641eca3742311ba11a19c01c2cbaa8f3ca0958fcb5fc15cd31b6e8075670

SHA512
403f7c64a541f3c8bce43a1490e2ca1b3fe2812039f4e74d10d9332b487f2eafc749fc341abab57246d9b8384eac886d7eaae037aa09722b744ba1f84b61b0fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5869c1.TMP

Filesize
865B

MD5
2d8ffdbf25966cbdd88c507443a007d0

SHA1
3396116967a6b963358f4403bec47fc9e5e6dca4

SHA256
da0fcdd763c1f645af11eb0681ca9b53a46760cc4fb48aa5d90ff0655df1de7f

SHA512
7874650b4d0e268d1a91738a18577073fe50f798245dc55f7948bee8c8d389ebb2cdcd185a94ce1d26790b13380d0a69a1a560557272ae033c6a58403a6dcf82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
920e2b53cd052a9ef7b73d6b18d236ed

SHA1
e33153bf5c0d8cb0fc8d5264d9d686b0dfff00a8

SHA256
6f14b128d17a4ebe36d330ce3367fd6128e183383830b1978d266b7d6796bb98

SHA512
c2f1792571cc04506764b1231cb20ca1c7c84bd583dc16c68df68679a090db4d5f5f4aa19579a728e11a1cf9942d761d4009e972feeb63298f7e130394d62a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
785814ba60150e2b4f8b6afd556f4a17

SHA1
7ccd73ee274b9ebcb3ec29a25b0397952471d2e8

SHA256
ccfa16d1b8126892f46c152fb6b4992985f4b155d3ca93f68a946c0da8715c17

SHA512
ff6f7fbe6cb4ebb341ec0f698560cd7739ad3d8e9bcbc7b99520be5a613a121a2ed217768ca514fc3fca24ba18aa2717b95513bf7e0ffe8591aea8be467bb770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d09d3eceb912f48b5c3f33b4a82bdaeb

SHA1
5af0b04a48193a251fbbf90f1247381e276b3a69

SHA256
850f2bd37dcbd8027492e8087d89c96df9ababfbb2beb5be4de3ea2650d5b6d3

SHA512
445dfbb9110e48d7321d50c25f71478b89264efef5b06b81d0e8d414bde7938ac2dd7d78fa8f1d36c0782a4880e5e28c089487695408a78a4949fd2050066db0

Download Submit
C:\Users\Admin\Desktop\Debug\WindowsFormsApp1.exe

Filesize
158KB

MD5
7f5069b3c0acd856ae9a9b4c0d106477

SHA1
069ddfc4f5161a30ada55466725050fc7a873de2

SHA256
7419c050c7272ff914c7d2177482c3d92b423fa6831189790f4c1bdbcd56318f

SHA512
37aa6e5b4eb94ecbc6415a068c42d3104335c9d9eb191e318eceb81daa3552b042610d8a5f38f4aaa2f539cf100f9d9930ab45f776dde89347cfb8a56b4986e0

Download Submit
C:\Users\Admin\Desktop\Debug\WindowsFormsApp1.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\Desktop\Debug\WindowsFormsApp1.pdb

Filesize
117KB

MD5
0a1358d89e68cce16d7ef99682ffdb7d

SHA1
990348448c4110f782a18222c3138e85a53049bc

SHA256
d93c84f80aa62e615071648b8d6b519ea4a5dc8ac80053c46e4252b6fa0ac63f

SHA512
d566a20f8c5014246bf827d906110ffe993c8baea2f991100a6f3c54281822180f7017c312535e93d4238af18f31393f65d5b87ccb109c698445be6713432cf1

Download Submit
memory/4584-17-0x00000000059F0000-0x0000000005F96000-memory.dmp

Filesize
5.6MB

Download
memory/4584-19-0x0000000005410000-0x0000000005422000-memory.dmp

Filesize
72KB

Download
memory/4584-16-0x00000000009A0000-0x00000000009CE000-memory.dmp

Filesize
184KB

Download
memory/4584-15-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/4584-18-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download