Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2024 14:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=tLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DtLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w%22%7D%7D&flowContextData=RreH99JA9cXAY1ECi8NGU6YSPcPEjs2ap2mvjczkF28gqSgCD6i4advAeib157z3UXKckAnjsgdNHB-kz1Vm9oUGIsVz0O8B6lOtNcziLGwA1Nux_5sDd1_3r-uisMnbJSaWUnukEAqsxFfWzq_mKZp7rHXUXPkZyQBK6g7DlZCvGCa5dJ3tkJEzlA7LwhYbi_h8j5JE74_DEBmd7aI2l6bJph85-_uSAhiBj-iMBMNE874hjBGLLOScM0IiUP3vnNQP44uJeC4Rb4tmLCiEdWtts0qgh1ynhfspb84r6hfVBy5KTcQHa-NJZq53Xe1cb9pO4TsLlnExxb_lCQlroIQ4nRJ24iIsEnp3xbBc6MEUS2EtBIRE0Dix1BP8gbGNs0raz_XIiGFizgqzBuW2J6I3FP5Nqf3wXJP8NT9xJSxj_FnW1vhnFS_fMIW&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&calc=f5715153d3118&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin
Resource
win10v2004-20241007-en
General
-
Target
https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=tLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DtLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w%22%7D%7D&flowContextData=RreH99JA9cXAY1ECi8NGU6YSPcPEjs2ap2mvjczkF28gqSgCD6i4advAeib157z3UXKckAnjsgdNHB-kz1Vm9oUGIsVz0O8B6lOtNcziLGwA1Nux_5sDd1_3r-uisMnbJSaWUnukEAqsxFfWzq_mKZp7rHXUXPkZyQBK6g7DlZCvGCa5dJ3tkJEzlA7LwhYbi_h8j5JE74_DEBmd7aI2l6bJph85-_uSAhiBj-iMBMNE874hjBGLLOScM0IiUP3vnNQP44uJeC4Rb4tmLCiEdWtts0qgh1ynhfspb84r6hfVBy5KTcQHa-NJZq53Xe1cb9pO4TsLlnExxb_lCQlroIQ4nRJ24iIsEnp3xbBc6MEUS2EtBIRE0Dix1BP8gbGNs0raz_XIiGFizgqzBuW2J6I3FP5Nqf3wXJP8NT9xJSxj_FnW1vhnFS_fMIW&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&calc=f5715153d3118&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3756129449-3121373848-4276368241-1000\{95251A05-54AA-41AA-AD50-24205CC2A0F6} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3004 msedge.exe 3004 msedge.exe 4456 msedge.exe 4456 msedge.exe 3628 msedge.exe 3628 msedge.exe 4220 identity_helper.exe 4220 identity_helper.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 3716 4456 msedge.exe 84 PID 4456 wrote to memory of 3716 4456 msedge.exe 84 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 1856 4456 msedge.exe 85 PID 4456 wrote to memory of 3004 4456 msedge.exe 86 PID 4456 wrote to memory of 3004 4456 msedge.exe 86 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87 PID 4456 wrote to memory of 3016 4456 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=tLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-76J51654HB0957815%2FU-6B6290400X2477803%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DtLjYoRPv3hzgIqWhXLrXK1tEfe8rPkwE2Q1c7w%22%7D%7D&flowContextData=RreH99JA9cXAY1ECi8NGU6YSPcPEjs2ap2mvjczkF28gqSgCD6i4advAeib157z3UXKckAnjsgdNHB-kz1Vm9oUGIsVz0O8B6lOtNcziLGwA1Nux_5sDd1_3r-uisMnbJSaWUnukEAqsxFfWzq_mKZp7rHXUXPkZyQBK6g7DlZCvGCa5dJ3tkJEzlA7LwhYbi_h8j5JE74_DEBmd7aI2l6bJph85-_uSAhiBj-iMBMNE874hjBGLLOScM0IiUP3vnNQP44uJeC4Rb4tmLCiEdWtts0qgh1ynhfspb84r6hfVBy5KTcQHa-NJZq53Xe1cb9pO4TsLlnExxb_lCQlroIQ4nRJ24iIsEnp3xbBc6MEUS2EtBIRE0Dix1BP8gbGNs0raz_XIiGFizgqzBuW2J6I3FP5Nqf3wXJP8NT9xJSxj_FnW1vhnFS_fMIW&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=f5907da7-b0d3-11ef-a405-3f2c46499e68&calc=f5715153d3118&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa461946f8,0x7ffa46194708,0x7ffa461947182⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4700 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13974173859777374869,16078157511180867781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4852
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize936B
MD55ca488075be2c9b74fbaf83a6f590718
SHA15630dc174f3e9216adb14d5e8544e8938cd310e3
SHA25695db462491cfd70bc62c62b0f42fd423387f23521fe1741aadce1391b52fcc3f
SHA5124dfa749a4f205bf93ddde920816d4eca5b1e3856454dbbd8ca033de7521fc24290df08f32a938973b7b88f5509b39d960db08ce059a5b38dd05bd9294aee90b9
-
Filesize
1KB
MD513c6e0dfa33ab5f29406015c3133d798
SHA1d193ee34a109791fa0b3a920b626f956d2329391
SHA256b6792931782ced09aa86a2064774565a43f9047cc9e3f254ebd443f7dffb14e5
SHA512a6ea67bce05b3f777fde9fb07ec72e241bd307fa58780c78faaa4ec5a9d2ee84f61875937688bc2bd1104cd863af733df49d1bc3ca9d3a779028fef12111479a
-
Filesize
6KB
MD59639545968cf884511780263f9370961
SHA17b31f26c023d146f54e4ccbf456b0d1c1a746ca5
SHA256fd90b5f65ca82b4ab7928bbe3927a6adb9b36f075d3ff7573c92d5e15a45857d
SHA512b733c85f69a4a0181e82b707bc1c4330e08090e2ba3b21e62d0261297182ed42a2e4e01055f6bb8502482e4af8ee40100af0fe9946902833dfacaee900eee50e
-
Filesize
6KB
MD5b2b27207dfdab22524aebb273548dda9
SHA1952a8147068d57ef6aa6cba5b68f0478ee6a3a48
SHA256082d1c2239c25177295d9a8e36dc9535540fe46e52e37e51ab0db83da8052c63
SHA512cba72533b4a57eeb46651ae01e5e26f2179ed6ae2634f3c97393bd07440eff45cbe0f090fd0aa06815de4b103d9a9245bbcf8bfd44e0cd5d78cbe41236686a41
-
Filesize
1KB
MD58db7466c9ae1d313616140799ec31064
SHA1a9e25398e0aa21ba633a5937fda85a5b14b7b82a
SHA2561c838e234f8219b48fd1064fe25861ce25aeebf19390f54a4d3af39c7df6e103
SHA512152f862c64e2b11a690021cc43f322e6862d9336df3bb3bba58f6e6480d9fed0e0ade6bf330dee18af53f4e465d2fa02eb71dbc9399ea834c542e90d218d41e3
-
Filesize
1KB
MD5d55e5f06c5e8a9137f9f5fabcaec875c
SHA1e62acc162970f771f946e9a1b72763ef44296282
SHA256aa9c939eac0e351ae66872222afaf234e6ff8c82c3bf902739758fd0af10f6fc
SHA51231feaa49969c41ccf805506f7e9c917a4709395e480592e581bd236b8d6362e49b7387e5915f8e3c28247e2afb01973bae16415e648e88e15824ea8862bc043b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d9f82163ac92b2e55b1c506718c52ae0
SHA1cf9a4def3e777bfff174c903a8289666d9a06019
SHA2568ff0fb92dca8e048ef11e3a584a899cb4f0632dd7d0c7fc7d2728767c5d6a746
SHA512d0e70b066caeaed575e5aab958a4704e129951beba1706c3edea44849435dc38161efc5b6d7843198874ae20e2b1ffdc9fe3bca8245d4ec2424f4164c40573cd