Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
9757e3242f6...b4.exe
windows10-2004-x64
976fe72e0ec...ss.exe
windows7-x64
776fe72e0ec...ss.exe
windows10-2004-x64
1078d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...B3.exe
windows10-2004-x64
1078d4cf8df6...59.exe
windows7-x64
778d4cf8df6...59.exe
windows10-2004-x64
378db508226...69.exe
windows7-x64
978db508226...69.exe
windows10-2004-x64
97965f6adf3...ss.exe
windows7-x64
77965f6adf3...ss.exe
windows10-2004-x64
77B75B33BCF...B5.exe
windows7-x64
17B75B33BCF...B5.exe
windows10-2004-x64
17E3903944E...72.exe
windows7-x64
77E3903944E...72.exe
windows10-2004-x64
57dd9312307...ca.dll
windows7-x64
37dd9312307...ca.dll
windows10-2004-x64
37e4c9a7e39...1f.exe
windows7-x64
97e4c9a7e39...1f.exe
windows10-2004-x64
780eb72d781...B3.exe
windows7-x64
780eb72d781...B3.exe
windows10-2004-x64
1080eb72d781...9A.exe
windows7-x64
780eb72d781...9A.exe
windows10-2004-x64
3845263c869...c8.exe
windows7-x64
9845263c869...c8.exe
windows10-2004-x64
98524224187...8f.exe
windows7-x64
68524224187...8f.exe
windows10-2004-x64
686be3831f5...39.exe
windows7-x64
686be3831f5...39.exe
windows10-2004-x64
68791931bac...DA.exe
windows7-x64
78791931bac...DA.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:21
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win10v2004-20241007-en
General
-
Target
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
-
Size
56KB
-
MD5
a865cae4f9a553fa100932e8786b80be
-
SHA1
1c691b07fa9c59c1eb6a993723887a9ac08b301c
-
SHA256
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f
-
SHA512
df149155fc97c72f9401826f614dfb16edbf982b64c6fb3d7302526cd9c4ee8368dcfdc666c1c1fe2a522115176042f135723e9390ed4755fb35b4ebddc263e2
-
SSDEEP
768:9Wf9/O9lXRyz4M9XyTm/O94NOYXkGQ40d4Wg/i+Pet+F/O9LiAU3UF3333efYZCz:9EmRyz4gOmxNOYXF+yzTPSwjH33wk
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe\"" 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 icanhazip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 4808 msedge.exe 4808 msedge.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 4480 msedge.exe 4480 msedge.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 4480 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 84 PID 1832 wrote to memory of 4480 1832 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe 84 PID 4480 wrote to memory of 3452 4480 msedge.exe 85 PID 4480 wrote to memory of 3452 4480 msedge.exe 85 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4644 4480 msedge.exe 86 PID 4480 wrote to memory of 4808 4480 msedge.exe 87 PID 4480 wrote to memory of 4808 4480 msedge.exe 87 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88 PID 4480 wrote to memory of 3456 4480 msedge.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe"C:\Users\Admin\AppData\Local\Temp\85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fileice.com/LINKHERE2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f37546f8,0x7ff9f3754708,0x7ff9f37547183⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:23⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:83⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:13⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:83⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:83⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:13⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:13⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:13⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:13⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:13⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:13⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:13⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16099571261230456287,10657198956161464120,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:23⤵PID:1228
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2464
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
5KB
MD53166dcfbc22da11a439151ce5501f8f0
SHA14f86705a106713664b43babcc6c23ed85f501316
SHA2561030d63944ec6e069771d6f4ce0e3051ccb88f07a97d603e208f45d076e0040a
SHA5120c7ebbae1ec5d2e69b6b6c7a15dccd53af20859575edaacce1ca4ae261642994baf705871092f13a9724cc59be438e48da22b699452222cdc8e1552bcc7fc462
-
Filesize
6KB
MD5a8ac586b5943aca972b24095d7ea2447
SHA1183fc0e86daca4f9361154910079ffafd233d568
SHA256bba7255d979901b857aced70d138d44ec1cef87f7803012bce206597a48feb3f
SHA512264487ce86ea0c3d7e91b6410e457a070a7a1927f9d31286c49c63d0b235b1e24d43362baaa8f16f9b864790dfce92f97ba96b40f86162a8231ba27aaf18f00d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a6eb3bead44836d59b546e1f1c56e688
SHA154f3973e0d10561df93e0b3bbb4626f2217353a5
SHA256e91a1a792183f59f7d4f3f048eb6f05c87feba016f97c5cb3d5774c365f123a7
SHA512bc88f339a802008a1f29752980b0ee6faf33d1a7c76c1d0866f35a4c38aed2b9023fb230b086e0b3f65e1b823ae177cbdb11b94a6b8b23f2259a592a1f2f6221