Overview
overview
6Static
static
1URLScan
urlscan
1http://google.com
windows10-ltsc 2021-x64
4http://google.com
android-10-x64
1http://google.com
android-11-x64
1http://google.com
android-13-x64
1http://google.com
android-9-x86
1http://google.com
macos-10.15-amd64
4http://google.com
debian-12-armhf
http://google.com
debian-12-mipsel
http://google.com
debian-9-armhf
http://google.com
debian-9-mips
http://google.com
debian-9-mipsel
http://google.com
ubuntu-18.04-amd64
3http://google.com
ubuntu-20.04-amd64
4http://google.com
ubuntu-22.04-amd64
3http://google.com
ubuntu-24.04-amd64
6Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
27/10/2024, 16:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
http://google.com
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
http://google.com
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
http://google.com
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral5
Sample
http://google.com
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
http://google.com
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
http://google.com
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral8
Sample
http://google.com
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral9
Sample
http://google.com
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral10
Sample
http://google.com
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral11
Sample
http://google.com
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral12
Sample
http://google.com
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral13
Sample
http://google.com
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral14
Sample
http://google.com
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral15
Sample
http://google.com
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3b0acd5f-b597-4131-aa49-cf51d2c14c42.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241027160129.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4808 msedge.exe 4808 msedge.exe 4644 msedge.exe 4644 msedge.exe 4832 identity_helper.exe 4832 identity_helper.exe 5064 msedge.exe 5064 msedge.exe 2356 msedge.exe 2356 msedge.exe 2356 msedge.exe 2356 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1100 7zG.exe Token: 35 1100 7zG.exe Token: SeSecurityPrivilege 1100 7zG.exe Token: SeSecurityPrivilege 1100 7zG.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 1100 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 3904 4644 msedge.exe 80 PID 4644 wrote to memory of 3904 4644 msedge.exe 80 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4836 4644 msedge.exe 81 PID 4644 wrote to memory of 4808 4644 msedge.exe 82 PID 4644 wrote to memory of 4808 4644 msedge.exe 82 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 PID 4644 wrote to memory of 2144 4644 msedge.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe50dc46f8,0x7ffe50dc4708,0x7ffe50dc47182⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:2692 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff78a5f5460,0x7ff78a5f5470,0x7ff78a5f54803⤵PID:1388
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:12⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:12⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:12⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2600 /prefetch:82⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9957192247120291055,4395175762034476295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6312 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1032
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4036
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23582:114:7zEvent220271⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ccff51f965f8f4176e4ad112c34c86a7
SHA1eab249ca0f58ed7a8afbca30bdae123136463cd8
SHA2563eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33
SHA5128c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd
-
Filesize
152B
MD5c29339188732b78d10f11d3fb23063cb
SHA12db38f26fbc92417888251d9e31be37c9380136f
SHA2560a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2
SHA51277f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c
-
Filesize
67KB
MD5fb2f02c107cee2b4f2286d528d23b94e
SHA1d76d6b684b7cfbe340e61734a7c197cc672b1af3
SHA256925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a
SHA512be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82
-
Filesize
62KB
MD5c3c0eb5e044497577bec91b5970f6d30
SHA1d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA51283d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
-
Filesize
19KB
MD576a3f1e9a452564e0f8dce6c0ee111e8
SHA111c3d925cbc1a52d53584fd8606f8f713aa59114
SHA256381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
SHA512a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5d5d672bdccd9e87d1d0ae157743513b2
SHA1eeb1d86e21a17fd049b3c124206ebacf88869774
SHA256807d908fbb92757c3aeb1b592c62ff70ac3136b9b23ae2fb5fe4dd33ce72992c
SHA512a35964059967cbecf1bd54bd04bd175f449f7b52d074749a474125f136a73cf72909e7d6b2336a4d1a20b28322aeb5bb746839b3ee11871aeef00bec0ad60a43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58684a.TMP
Filesize48B
MD5d50c0858c81368524d58ad6b230600ca
SHA19da4476cc69b20651a7008ab7b3c4f87b697371e
SHA256da77f0edf253e3cd7107e1c43a6cec81faf5f798a149bbebdb89b00ed7a886ac
SHA5122c57ffcaeb765a3c162227e75b0e3c57ebf250e22a3d1eb021a36e0226b37b01a672713d29438b57272a496403f812389a9ee59f796c53b51ddcbf8d2be697ee
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD5cabc74974627d54470eac58964a285c2
SHA13cd9bd507992336c43da6157dcd9bd9746061aea
SHA2564b759903c2b0515aa408d93ed4483cab997c490f212483f8fee3a22212a8bb73
SHA5123a2c5db63850e604768c9476805e6f3782a7a69ad509cb0ffdbae33535bfab59ce6cdc1c2a6a4960004be1a5460b83b21743f4b4ad5c0b6b5c564f4dbe7806b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a94b.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
6KB
MD514ff5e1892d96600debaf89820d8a205
SHA1af406e20cf3ea720e0ab9b3d0d52121f8728281d
SHA2566f1d2bf37fe3e98a944fd3fb166f38226298ea2ecbc3cc428a7c7a2ef9464924
SHA5126e6ffa3caaf39a0c66e25a4107f427a4c1b2aadd91f9764009f4fff64a145cfa93c47a1fb7112ce8d32b5f96aa31006da7ba9303ebb3b54f3b22727215326bbf
-
Filesize
5KB
MD5056d4cf4097976b0378ef5ec3c739c70
SHA11e0e15af80c11798015d0fd24bd9ed820a8fa347
SHA256c54d19d7ebfba277b1e8b631c3808d0c9fdb6b4a35cb87f99109f7ca1a142ba0
SHA512263980cb69cfbf478cbde8525c7b4a2b2e94f684bde8d8771d0bdd63dd119fc333b96a2699162f335b48b036c4d97759344db2332244f2c1fe1a7ae47ba44834
-
Filesize
6KB
MD5814a04a8cfac1666ec72335b50306a54
SHA173d7a27dacb95c9ec1ef4692415499282ff3c729
SHA2566870e6b24819d5c9cf41fa7f9b44c2d155c6c55a7802d49ee0dea1a09914e142
SHA5128935f0f56c372e06116f4b7f424bc77d7c96da2b176645032aeaa48b2ce2bbbafbc16ac9bf60422f45696976a8ec9eb7a9ef74e58f9c56c2927424ac42de149e
-
Filesize
6KB
MD565d607e29fd445d0e37f15d9e50d0dab
SHA10cacfde3c213234f4322bc6a55e6aea2b8dd9422
SHA25649245d96bd5475c334e9fdde9fc4c671e43644af1525b64e881f59f5170ccfea
SHA512dda4937acbc2e2c8f02e9882bf7d64ee3ae0d3b113f577179772c7fca4ca6ecac4a1484cd03ba4cbd91eeb76f6b83f62755f59fe601acffb802adbdcec522ed4
-
Filesize
24KB
MD526978f38b0bce48572b90b762b7d937c
SHA18b8b88012fab1d37fca79575a5db81674b424867
SHA256b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa
SHA512501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379
-
Filesize
24KB
MD586aa28ffd286b08415aa197216684874
SHA1d99924976c73e3220108817ad6bc1d8b1795ca2d
SHA256a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d
SHA512a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa
-
Filesize
706B
MD5375d22b281e5b388eba545e0accd0277
SHA1e4c3ea57065af91e9d05f0b5eddedaa93f38ca7e
SHA256b327fd58b2cc68c31b9f8a29226d36ac4ba393edefa56388ebcf1d1055c3b227
SHA512808cbc7580740b9e9c4213f8dff9250c0341946bdedbcba251d0aa1d2db94c48b3afb2cd45aef42ce18da838e514655e916e8b14e32d2b1b129eff0f36a0c673
-
Filesize
1KB
MD5e8b2f16b33973a584513b0270249531a
SHA1ccd86349345cba866aaff633d8871cc6e0e0834c
SHA2567771f9d7e423a621491a614a50ca75de6aabfe9a9b575e64dde1ee7d9c121e04
SHA51292ded361ecc45c86b50c5e1bd3e98c6edea1be8c931996cf35deceed8bf993ed2285fdea5f0f4ef8b3c600a861ff2157720e4556f30dcd13a2d293ed119d8feb
-
Filesize
204B
MD5ef8396e00a44e6e0ee76b7f021d5100a
SHA1c057edb11ededdc17691fcac1d117a9d0c6f706f
SHA2569e35426d07c9a5a3eb4dda92d93ea818b1b81a26a8a613f7ed91d38cf8880f03
SHA5123cc240fcc9a23c262cd75b67a102877fef5483a173e9037b6c84368229a1476c3f461383797e6f0e0646a1d8d2f24517cc2ee3707ef66af800ba6844a0d14889
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD5bf5746a6db804cc4c60ed1e50bfdf0ab
SHA1aa4270707bc35805613d7d3cebe5b2266cdee19f
SHA2567b21aa7114db8e6423dd27b5ae43b17d6211380ea30d78d99b1a020ab4ab3f49
SHA5128ee8cb87a880f78ce04317ddba68be4e96cd6194e8cdc6abf7f01b6fe523db6fa52b0156fe7fb5b551beb81a20750e4a12164873bbc90303e627128f3f964ab2
-
Filesize
10KB
MD5d56b165693c08b7958ef02764a79dbc4
SHA1a1f0bfb9571afc38b3cdd097d16e06975879b360
SHA2564adf557f92537be55252775f75d5f4670a2258dcd630a6b10acab15fc732df23
SHA512a105e216f9e5601d048c6d682037b6909be1a41893b7c584be23945aecca34e057d378ad7296aae13ea9228c78c69d6fc938e5c4fb5e739da33de72ae4ba085c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD555feb0a829daf68216a911311ad02ccb
SHA1c830f565edc9222125f041e8c0f55b53a0379011
SHA2562bc3eb30f4afa1697da707f195b07ad685f51c165675c39b19be0a0efc2753d4
SHA512f6e9a1f3db4a393244af50e9fcc955cb55b54b23e1856c1d0fffefb366f3e66fc8c0b5784812463c9555b6541079a8a7e7e16bb45bddbdbe241a2048f80c6d5b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD506d931bafb5e89017344ad99176a335a
SHA12507d960ad547dd497318e90b9d9acbf88b2581c
SHA2569a8d2cbd68c835e5d41f4f7a5e58975aac5b09ea5bb7737b8b67b779edba01fa
SHA512fcb7dd18508d291a2f79b7384075157e0e0bdfefc2b61f06097ab318a32d89c6178d19ceb3fa51e62163b8a2b1c64ab971f172704f104e19b5a162a2dbb36125
-
Filesize
12.1MB
MD5c8bf514a334eaa148cb3c6135c2fb394
SHA10e47a89c3729db5a6f195c6abb04e5129d788df8
SHA2569127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67
SHA5129879a258f429ef492cf495dbddd4f2b9c9fbc061e325aa8ad870ed05049b7ad595b26d223d20c55fc99f403fc9b5d0235353d71bf5d9a39ee4462838feb247ff