hxxp://email[.]double[.]serviceautopilot[.]com/c/eJwczE2OrCAQAODTyA5ThfwUCxZv0_coqOJJom1HbZO5_SRzga8d-4ffP0MKRcKWQG0OMVjforMsga04XpR789LQSOkxO4pGC6YFiSjHbHTnsQ0pXnvtot1yXZL1Gthyr2SJckV2vXkQs5bMsUNk5LqACCFoapQqh4SYAzgzigPnEZEAMEKeQw-1xc5OKcWwwORBjm_ddL70fEZT_t7HZ2zHPbdjN1tZ7_szLf8m95rcq4nKOR69Zr0m96rje487ZnOWnd_8X8_Jwzq27RqiO7-Pc1__mKe43wAAAP__Gf5XhQ

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://email.double.serviceautopilot.com/c/eJwczE2OrCAQAODTyA5ThfwUCxZv0_coqOJJom1HbZO5_SRzga8d-4ffP0MKRcKWQG0OMVjforMsga04XpR789LQSOkxO4pGC6YFiSjHbHTnsQ0pXnvtot1yXZL1Gthyr2SJckV2vXkQs5bMsUNk5LqACCFoapQqh4SYAzgzigPnEZEAMEKeQw-1xc5OKcWwwORBjm_ddL70fEZT_t7HZ2zHPbdjN1tZ7_szLf8m95rcq4nKOR69Zr0m96rje487ZnOWnd_8X8_Jwzq27RqiO7-Pc1__mKe43wAAAP__Gf5XhQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
3668	msedge.exe
3668	msedge.exe
4024	identity_helper.exe
4024	identity_helper.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4400	3668	msedge.exe	83
PID 3668 wrote to memory of 4400	3668	msedge.exe	83
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 2276	3668	msedge.exe	84
PID 3668 wrote to memory of 4608	3668	msedge.exe	85
PID 3668 wrote to memory of 4608	3668	msedge.exe	85
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86
PID 3668 wrote to memory of 844	3668	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://email.double.serviceautopilot.com/c/eJwczE2OrCAQAODTyA5ThfwUCxZv0_coqOJJom1HbZO5_SRzga8d-4ffP0MKRcKWQG0OMVjforMsga04XpR789LQSOkxO4pGC6YFiSjHbHTnsQ0pXnvtot1yXZL1Gthyr2SJckV2vXkQs5bMsUNk5LqACCFoapQqh4SYAzgzigPnEZEAMEKeQw-1xc5OKcWwwORBjm_ddL70fEZT_t7HZ2zHPbdjN1tZ7_szLf8m95rcq4nKOR69Zr0m96rje487ZnOWnd_8X8_Jwzq27RqiO7-Pc1__mKe43wAAAP__Gf5XhQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5f9f46f8,0x7ffd5f9f4708,0x7ffd5f9f4718
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6881277630975033959,11685196197355327108,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2a10976d268299fab92c4320dc6bd70a

SHA1
a33a3cc3b3494ab3430aa89203e029edfacf986a

SHA256
4ad81a8761b5fc1b483870fc6e17d653b6586bafd83b37c2184e1760f18db849

SHA512
47e317d9be6eed8ee82d21f0839436c547fa908eeb8a0903638951e70a3f5c80265dfd57e04a60f22bb36b4940551d6f8ea1fa63ab6b28ac5f7ae320d3d062f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7d0c4a701bd158018426746c98f1c4e8

SHA1
aaca737114de5ee065741cfba2ed8f34395ae955

SHA256
710d8f1d14b0d52c0b0ab7169d59be9e4b343a19843fea976d1091a84ff70048

SHA512
4bbe6caceaf85e0feb6fc36a5205187660ecbbfd75e1dd2cf76a1ed259561937e6b80e1810fa24c9b18d38f709624f1097e1b0df2c88d4f906e4b4a536c1352d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c5a47558b3bb14281d2085dd05f0408

SHA1
292709f05b135a21d1502849711e862666d129b0

SHA256
1df7ea02a45069b9846a0f86f652d6f1b028c1da70af191a5902b1f23bb77227

SHA512
a73fbcf0298f3b1a08b07435c2e187519a5ff189df6a34fe3d2754800309205ab0eb58ff3e2dae8a62c570c174f73ffa7d4e407df3675f19218b28c5ecc9340e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3aab426e62a86abd97fb2f05149420f

SHA1
83a9905868190919244a98ad6ccbb4926f279272

SHA256
2105e2c560bc01ad27c93fe36a1c47fa39d70f6d1f1ae5c2e1f4222a53b15bbc

SHA512
a1588fc6824ebd618f769bf0705b6907554a68d6d084ef72ad95ac4fae25fbe597697fe21e4e36a534ca9f96dbb5cdc8711326b95c1f5baea0033f39cece2258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
509a58a304158b4c602062cc4bb459a2

SHA1
6e3c1092196b3daf8d1b06bc7754cfe1fecbfe6d

SHA256
cb21d5d5e7ec9a6dac09658b509f1bc62aef8336d041f842a815ee1c37a67a06

SHA512
6148f6c4c9aae8cd6da181dcf3b07c3a4cf10f7b2ad0666664ca37861be21eba9e0185b9a684f461cb7659bc015c05aa10bbc34ab657e6eea982fe40ae3ed31c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe600dfe.TMP

Filesize
1KB

MD5
4f8b03bff29d8cc6bdef806c08493ba5

SHA1
9f0b140f0adf589e34f3cebb8eb4423e20a762d3

SHA256
06e4eae4e3ef9a30a5a55ff8826d5f6e7d7910a72b39c47ba1d05b0029aae432

SHA512
f17f9c2dac49f5f7aefc855ab23ed0d0fe26a830e4decf9670fd6bbd8b89050eaa2646b4d87d268defa4f1edeb2dcd0bfa4c42dc526051a7f7980910bfa1a986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad1b2937-0dc5-4c67-8838-c4de78213831.tmp

Filesize
1KB

MD5
ccd7431913a47acf27973b0da8d94916

SHA1
9489ec86ee3dd4e0bb2a17a18607a3b4e4f25874

SHA256
a78bcb1358a2850164de7873ed18c9375a6163dbe5cb4de9d5791c0eed43a639

SHA512
2f28bd1d181e9af3cb34af4c676e9cbd9e82901e5c3101a522072c19b18ef4da9bd379ed8f7d223492e9eb6bf72ad9bb8b148e6b643201356eabe8d9118da4cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e6db575cf646b66b2f31412dd355406

SHA1
847daca3e21dbd9fadd729a798533adea6a10e2d

SHA256
cfb16c5f22b359993ab61ac9fce2e94b46539e03db87011c980dba3eb029ad79

SHA512
ed0df0c01bde875e965782fa36d940f903f4b9291343dc9ced2ac55e598133a8589fdc2b155763b62aa781a2a3daa777dacfcddb6ff533cfac84cce915293cd3

Download Submit