hxxps://www[.]google[.]co[.]ke/url?sa==rafqigacjrvqoavmesppzxoc&rct=zolesnudazazmzgsjvwdvqzilxazcumsnbozxtjbwldgyqzgdzrrmmqlnmokqbxpnmciglrj&sa=t&url=amp/manganiellosrl[.]com[.]ar/pole/lpur/bWlhQGJyb3duc2Zhc2hpb24uY29t

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.co.ke/url?sa==rafqigacjrvqoavmesppzxoc&rct=zolesnudazazmzgsjvwdvqzilxazcumsnbozxtjbwldgyqzgdzrrmmqlnmokqbxpnmciglrj&sa=t&url=amp/manganiellosrl.com.ar/pole/lpur/bWlhQGJyb3duc2Zhc2hpb24uY29t

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3216	msedge.exe
3216	msedge.exe
1100	msedge.exe
1100	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1100 wrote to memory of 3588	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3588	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 1008	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3216	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3216	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe
PID 1100 wrote to memory of 3732	1100	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.co.ke/url?sa==rafqigacjrvqoavmesppzxoc&rct=zolesnudazazmzgsjvwdvqzilxazcumsnbozxtjbwldgyqzgdzrrmmqlnmokqbxpnmciglrj&sa=t&url=amp/manganiellosrl.com.ar/pole/lpur/bWlhQGJyb3duc2Zhc2hpb24uY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2046f8,0x7ffa5c204708,0x7ffa5c204718
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,979627980406271352,3756153175822090164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f2a948a3c66be8eeb7761216f11dad08

SHA1
7e0635faa0510625e4dc95c2ec7a435a8664db55

SHA256
5afd7d072cdfeb3bf6f1ff349e93983f535fb2fc7370c14a41fe7284fef5cdf1

SHA512
7727928c4272b0dae1a89728eae065ad31f9f191b839dacff05892fbca1671bfe5d8a14b16d1d43bdc46b33ec9b5657fbd9096e5ebdb46030f56b709732edf0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
1a14a8d15894ddec9b255d0b234dd91d

SHA1
b2c01edd6a1785c9d3f9b2f7a533ef310f7e6421

SHA256
56496d161d95ffabf15170216744826213a059ab5fc6c005d660e87a4f1514ff

SHA512
cafa829a8cca3690c51f22201a513627749d9d0f27753249a747f37060aeb745bc3fd1cb78dcc2dc7cacd860ba965c677001d7ffd687f48e6f2dc3bbfbfcf239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d9ba12c05e5a71ab8f6aa4ce048cf03b

SHA1
49b87b50a3f2d852ba7f894a593fbdf318b64a42

SHA256
88c45b7475f62baea43eb5956ab7caaaa615d0317e59f2cd8b9f8ca9869c1cc2

SHA512
293c0c6f718782ddffe850b47bf85d03ec40bbaa0a0b5e8ed2349a741333ef4dba2d72bc6a9c6d54651c77c2d86ccb3857354d5358623144d0bfef19d7b92d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2b6a19d37b230314d3588daf6cdf9d64

SHA1
a1d721036d6864b5aad3f8582de34ca202377f1c

SHA256
71652dcd00a5c2c937614c1c159070b6124ac588e0f7573ff2afe392aa6ee901

SHA512
b6468e860b3a00893bc52de5dad69bf9218112f246690c01c1cfb651d8ce19efceaee0e23ccc2dd71d6192b452ed3c02ad9006ce0b359a537b748079fd279536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
59d630f5d63e8cae3fe80fe62dd8a5ec

SHA1
6cef48ae8645df2834f31fd3551d4afe7643dcef

SHA256
1efdc4d7a508964a7ee75ac0175bbcf05b1974a56b9cec6edf76006d6dee1073

SHA512
c60610fc4f74988007500312cbc2f41b158ecaa17b60e5f5666a133269442ead4286f31fb7003f999eecad1fe8d80299059ef4e3af2eb39f561dbbc6763482f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
74ed56e151bec5c5360f7b435535dbf6

SHA1
bec0d94c356861c19f99dfc7e1f19189917676c5

SHA256
d44359102a0b2824705b86904341781a4c8033741cc64fbceca8dacc47c93713

SHA512
08e32dd3658187111d7b7d5a34a98f3557dd27d45317d5e8c8e2459bb9ceb2b850e8d9e17593de29732805f2b71ba8a370b5dcb4aff839676781d105d79b4429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cac1dfbfc0c246edff244353171f7a5c

SHA1
7fecf83212eb52aa3ad01b9543df4228b0ec4785

SHA256
bdc03c99a5df8212adc85603d705f5db5e69fa8bb57c99f978da43b5db0f9491

SHA512
2c9eadddcc5e4ca0883994f4c6fa5220e99cf908add9eb97767d6e65eee8ec1e4096c01122de4b184678e30fb42eefa366866894911554c510bb91a0f23ab94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dd1f152dc762eab15220096a5ac59db

SHA1
52f74d0f450e526d789d668b6730b386676f8830

SHA256
85a792285d271e99a61bfc0b5c6e418afb66fa5c63b13499e2a1e7254edb57a8

SHA512
0a0a19dcd58737167578688327dc71336eaf8ea793cc9dbf1efe09965daa23cfeef999157d6776a90b5447073c9eb4499f0a97e6b6b1256146b094fd83981208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6c101db9d94f6946ef24a0142fb0de4b

SHA1
51009d822995092addbab1f55565b2d1d9932c4e

SHA256
67ce4640030cf9168922bdda374341c331af670671d57929a0b59dcf78d6b493

SHA512
2d45589f30eab63c9cb45fa2dce0b9f69cddb8fe76b07254b3d84df74a110da7c45b3d94b76639f1d030351dd1fb9b788698c77bd97be88d4f4b855c7c1f99b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
15c1b697cc5a539812bd36cffc68997f

SHA1
738e37038b7866a0baee46ca665e951d02bfb9c0

SHA256
def9d67437ddb8158bf1b64ee65ae4eaa56d5fa2aa447135f65e8d2468ed8b12

SHA512
f30d7aca3fa7a6527cf586b68e4d134b4e1a707e1b596975288bbdef0db1a3934ee599ce3382cb4fb555c350c06e5c673d6afd9995ee50244796c8935836841a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5866d3.TMP

Filesize
202B

MD5
d7cb1edb82743e83c735ad991bdf342f

SHA1
335811a15d83ff0d4055370a3db35f60edf8d4ed

SHA256
c4cc78c4e469a76656316d4023f429bcc46521f404577fded5343c115e98e96b

SHA512
8a5da4aba663ef40186759f1d1741813776451db0713ca8335ae8f3348469d7e2dfa7dd25d445b19b95767aaff4b9a9ff71ae93118df23cad3edf9f897c5609f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a1a4f6c816be4f329038c6623bbeb20

SHA1
b60e424292fa6b2728cf5899e020578d2bb67f5d

SHA256
3e0fda246a1691a44d4733d12427dfdd26390b29f82fa19e2af4df05684512f4

SHA512
45237af01c27c94e4754a818a0f0845b9e3cea2022fc36f86a67430760bfbe915d15e950353eab81794ab25b34e55bf74416a04f1cf034af0379efebafa52c04

Download Submit
\??\pipe\LOCAL\crashpad_1100_QQQRHCREXQPAKVZT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit