Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2024 15:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u48431706.ct.sendgrid.net/ls/click?upn=u001.0jtXymQrrP8zUA-2F-2BsChJQ8lprVbTFv4YX-2BokjfrITU0Y-2FWzLEyvng4u3imI-2B2sbASciNnh265TjHL8bmKWdg2vIbJAlJsx5jq6JVB9nipZcfPKdTBaWesbk-2F-2FgTJ86p1aIzoQduqmccpeRA4rHjHyv8fUbJYSkdOtbJ9YWc-2FjIlw2JOPhjC3LbKxrIpGUZrnRFtVcFUF-2F0uHsUfjnAzOsqG3ilZtyXiU-2F6cTlybGWnXNKfp0qQSsUEexX7xJEDvGaTYRRwM-2FIzR320AexC9-2B4dtxlaW3ZoFQ92wqsU7B3iviU0FQONyLlQ-2B-2FWSDdeyRP7BVDc9wbSa341kus1LMNEmVI8Zjf2qtdZcYgixpQXY9WHsi5b9kSypaoWvGZqbSc3cdcWiMf1mpAy23QcgwRRrCjfsrzLsZFjE-2FbAkjCgQWrCsRlz91Vr4KZyHOue9kt5lJcsdTPdw9sx2Bvu-2Ftg-2F6ngDmR-2BPQb5hL7xkbR0-2BOn6041L7rFHHBezXb7c4ZgmqtnL9V8Or82JE-2BHhZoDIVwjtnKROZkTJsxZoOdwEFM8SQSAhpKbORaEZeaxrx9X2zmFn1nQAON7QKGfPRx79MqYVqflhfc-2FdzfyIJWInP6vXNWgb1XU7GbkqxwAcRM-2BiAgzO0AsP6qX6mTRhPVYoaXr1PzteDcCrF2S9t89x-2BDj7a-2B2yJ1nBxJHKtC1TVvUtV9LvEGTTdr2VCUiYKiyuYVbufGL-2FQWllhme6IZm6K-2FPasYtIHvQNd0IAoMMmayWpDZeG0238GYeR2lwwq-2FoLugqUu-2FXJ36JOTxGUD3T1xBXYZBAAVwjPGRZf0ufWFaGXNEjO8b-2F53pkbvf81PTL-2BoJ24-2F9pI02MZGRJWo9Th2Ehu0gfcDmlaUb-2FgCGsUIQEmg1sdGc5FT5V-2Fda6ms77RA87mXvlaqjdWGTMvAne0Auiz7d2LnAuwpVcNA4CJN5I4Uop5a7AeGCsIkNTQZ0-2FKJ5BAurYzLKvmEba1nEt6K4KA6Y8nKd4RC3xQUGcjOn7uQEUfJ3U0WgDEAZZpieQxEQ7UwnMw9xWr-2FxnNw0MmewvOsQGuEBzWLP0CFIY7EDiEbCRJznGKtnN5IJwXn1PU77tnjrFCA2ekk671eyclQnPm4Im7DMFRmvRzSjJp4MqKeabz8vB2cUTOm-2FA5J8jdz5-2FF0ghw9TkSQB4gci2CE-2Fr2zs-2B1AaHAvS7v2FnFs1iHhvjEv5XauSP8OZFVk57Kzw3Q7O-2BOgppNJyFIse-2FJz-2B66UGRUjDIdsIaRh7kxAvCnWG48wKC12EoGhSmD3EYjNAq7fpohkufXiAwe52ymJfe9tm5s2Yc-2FATiaiV8m4IlIhOXS_XOkdRMx-2B9QZGLuCdmWUx71VSlWTKMAHZ96QJAx6HQ9UvZ-2F5kMK3EVUjKshM22IqKMVUePKd-2BNCcPj7fFDl6GSUJQOKkRNwvOQ7Tn6JS-2FUZuEqV-2F2UeYk74dnDQru0QgrDMqNMR4MIbUQSATlDzCPa5Rqp82PBbE-2FUpjdP6cV8hv5k-2BGKpiNrpeduxgN6172Utl6G-2BsvCc-2BQhUY4xr1yX21LFODOmVoNX9jWoIpQOmGe5HeBilvNyhYGTHI92W-2FDUZ-2BuSZe2RWU9YPHOXyvNLDObkAIThFj5MQcT1-2FJQ8R8p2zgariCkNtbGGPFNiJRGVpkgXGnQRaGM3IK5gWRJ89sNe8hSqk0cW963ID5XowP4jThQOuZJHPycCjAlIO96qIVSTcZe5EB-2Bld67OPf0DeZQ0EW0X4Tm2HanzhCYr3Ee3VcHyYScdV-2B8l0zlKAWFZ4rC0f4pHtvOPQ9njkYAtdY4fC5UE-2FCsy4Jtt5Gz-2F-2FolHHzxHmqeXzYOJFAUvxK5EmcCjmHsote7fxdQFTyl-2Fs41F7Tsd6j3CSrMFnjxZ-2FKbHQ6RVgvFbCDMG32c2k6epv2ArFEAaZlXHi9o5CNPMsZGtTyRH98lM7EHM3kW1hurrSyYufB7S8UMevBJtkE-2F5gRPa3AVj0ZpR8dggwQmmmcTUistL9LjlQ-2BNzoCDKrZxdJJS-2BMzQrOCZjaUT1s8L8qbG07GWskMbnVBUxdjZt5SirRinHLlQ5Jsj6tkloLSJkuF05xiHsxfoX-2FgmghaFz-2BNPEx8Q-2Fx-2FyvcNJ0bjcA88NfKKDrvxOODd1GoHy74nVxCvXD-2BLWQTgkuBVNVNbcaFOeTOX8gdEDIhVF6E2gQBaaynhj96YLuKpqeO2QBmg8BnErOMVpwK5Hhp8Wrq3Yn
Resource
win10v2004-20241007-en
General
-
Target
https://u48431706.ct.sendgrid.net/ls/click?upn=u001.0jtXymQrrP8zUA-2F-2BsChJQ8lprVbTFv4YX-2BokjfrITU0Y-2FWzLEyvng4u3imI-2B2sbASciNnh265TjHL8bmKWdg2vIbJAlJsx5jq6JVB9nipZcfPKdTBaWesbk-2F-2FgTJ86p1aIzoQduqmccpeRA4rHjHyv8fUbJYSkdOtbJ9YWc-2FjIlw2JOPhjC3LbKxrIpGUZrnRFtVcFUF-2F0uHsUfjnAzOsqG3ilZtyXiU-2F6cTlybGWnXNKfp0qQSsUEexX7xJEDvGaTYRRwM-2FIzR320AexC9-2B4dtxlaW3ZoFQ92wqsU7B3iviU0FQONyLlQ-2B-2FWSDdeyRP7BVDc9wbSa341kus1LMNEmVI8Zjf2qtdZcYgixpQXY9WHsi5b9kSypaoWvGZqbSc3cdcWiMf1mpAy23QcgwRRrCjfsrzLsZFjE-2FbAkjCgQWrCsRlz91Vr4KZyHOue9kt5lJcsdTPdw9sx2Bvu-2Ftg-2F6ngDmR-2BPQb5hL7xkbR0-2BOn6041L7rFHHBezXb7c4ZgmqtnL9V8Or82JE-2BHhZoDIVwjtnKROZkTJsxZoOdwEFM8SQSAhpKbORaEZeaxrx9X2zmFn1nQAON7QKGfPRx79MqYVqflhfc-2FdzfyIJWInP6vXNWgb1XU7GbkqxwAcRM-2BiAgzO0AsP6qX6mTRhPVYoaXr1PzteDcCrF2S9t89x-2BDj7a-2B2yJ1nBxJHKtC1TVvUtV9LvEGTTdr2VCUiYKiyuYVbufGL-2FQWllhme6IZm6K-2FPasYtIHvQNd0IAoMMmayWpDZeG0238GYeR2lwwq-2FoLugqUu-2FXJ36JOTxGUD3T1xBXYZBAAVwjPGRZf0ufWFaGXNEjO8b-2F53pkbvf81PTL-2BoJ24-2F9pI02MZGRJWo9Th2Ehu0gfcDmlaUb-2FgCGsUIQEmg1sdGc5FT5V-2Fda6ms77RA87mXvlaqjdWGTMvAne0Auiz7d2LnAuwpVcNA4CJN5I4Uop5a7AeGCsIkNTQZ0-2FKJ5BAurYzLKvmEba1nEt6K4KA6Y8nKd4RC3xQUGcjOn7uQEUfJ3U0WgDEAZZpieQxEQ7UwnMw9xWr-2FxnNw0MmewvOsQGuEBzWLP0CFIY7EDiEbCRJznGKtnN5IJwXn1PU77tnjrFCA2ekk671eyclQnPm4Im7DMFRmvRzSjJp4MqKeabz8vB2cUTOm-2FA5J8jdz5-2FF0ghw9TkSQB4gci2CE-2Fr2zs-2B1AaHAvS7v2FnFs1iHhvjEv5XauSP8OZFVk57Kzw3Q7O-2BOgppNJyFIse-2FJz-2B66UGRUjDIdsIaRh7kxAvCnWG48wKC12EoGhSmD3EYjNAq7fpohkufXiAwe52ymJfe9tm5s2Yc-2FATiaiV8m4IlIhOXS_XOkdRMx-2B9QZGLuCdmWUx71VSlWTKMAHZ96QJAx6HQ9UvZ-2F5kMK3EVUjKshM22IqKMVUePKd-2BNCcPj7fFDl6GSUJQOKkRNwvOQ7Tn6JS-2FUZuEqV-2F2UeYk74dnDQru0QgrDMqNMR4MIbUQSATlDzCPa5Rqp82PBbE-2FUpjdP6cV8hv5k-2BGKpiNrpeduxgN6172Utl6G-2BsvCc-2BQhUY4xr1yX21LFODOmVoNX9jWoIpQOmGe5HeBilvNyhYGTHI92W-2FDUZ-2BuSZe2RWU9YPHOXyvNLDObkAIThFj5MQcT1-2FJQ8R8p2zgariCkNtbGGPFNiJRGVpkgXGnQRaGM3IK5gWRJ89sNe8hSqk0cW963ID5XowP4jThQOuZJHPycCjAlIO96qIVSTcZe5EB-2Bld67OPf0DeZQ0EW0X4Tm2HanzhCYr3Ee3VcHyYScdV-2B8l0zlKAWFZ4rC0f4pHtvOPQ9njkYAtdY4fC5UE-2FCsy4Jtt5Gz-2F-2FolHHzxHmqeXzYOJFAUvxK5EmcCjmHsote7fxdQFTyl-2Fs41F7Tsd6j3CSrMFnjxZ-2FKbHQ6RVgvFbCDMG32c2k6epv2ArFEAaZlXHi9o5CNPMsZGtTyRH98lM7EHM3kW1hurrSyYufB7S8UMevBJtkE-2F5gRPa3AVj0ZpR8dggwQmmmcTUistL9LjlQ-2BNzoCDKrZxdJJS-2BMzQrOCZjaUT1s8L8qbG07GWskMbnVBUxdjZt5SirRinHLlQ5Jsj6tkloLSJkuF05xiHsxfoX-2FgmghaFz-2BNPEx8Q-2Fx-2FyvcNJ0bjcA88NfKKDrvxOODd1GoHy74nVxCvXD-2BLWQTgkuBVNVNbcaFOeTOX8gdEDIhVF6E2gQBaaynhj96YLuKpqeO2QBmg8BnErOMVpwK5Hhp8Wrq3Yn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 3352 msedge.exe 3352 msedge.exe 2544 identity_helper.exe 2544 identity_helper.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe 3352 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4992 3352 msedge.exe 85 PID 3352 wrote to memory of 4992 3352 msedge.exe 85 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 3168 3352 msedge.exe 86 PID 3352 wrote to memory of 4496 3352 msedge.exe 87 PID 3352 wrote to memory of 4496 3352 msedge.exe 87 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88 PID 3352 wrote to memory of 3268 3352 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u48431706.ct.sendgrid.net/ls/click?upn=u001.0jtXymQrrP8zUA-2F-2BsChJQ8lprVbTFv4YX-2BokjfrITU0Y-2FWzLEyvng4u3imI-2B2sbASciNnh265TjHL8bmKWdg2vIbJAlJsx5jq6JVB9nipZcfPKdTBaWesbk-2F-2FgTJ86p1aIzoQduqmccpeRA4rHjHyv8fUbJYSkdOtbJ9YWc-2FjIlw2JOPhjC3LbKxrIpGUZrnRFtVcFUF-2F0uHsUfjnAzOsqG3ilZtyXiU-2F6cTlybGWnXNKfp0qQSsUEexX7xJEDvGaTYRRwM-2FIzR320AexC9-2B4dtxlaW3ZoFQ92wqsU7B3iviU0FQONyLlQ-2B-2FWSDdeyRP7BVDc9wbSa341kus1LMNEmVI8Zjf2qtdZcYgixpQXY9WHsi5b9kSypaoWvGZqbSc3cdcWiMf1mpAy23QcgwRRrCjfsrzLsZFjE-2FbAkjCgQWrCsRlz91Vr4KZyHOue9kt5lJcsdTPdw9sx2Bvu-2Ftg-2F6ngDmR-2BPQb5hL7xkbR0-2BOn6041L7rFHHBezXb7c4ZgmqtnL9V8Or82JE-2BHhZoDIVwjtnKROZkTJsxZoOdwEFM8SQSAhpKbORaEZeaxrx9X2zmFn1nQAON7QKGfPRx79MqYVqflhfc-2FdzfyIJWInP6vXNWgb1XU7GbkqxwAcRM-2BiAgzO0AsP6qX6mTRhPVYoaXr1PzteDcCrF2S9t89x-2BDj7a-2B2yJ1nBxJHKtC1TVvUtV9LvEGTTdr2VCUiYKiyuYVbufGL-2FQWllhme6IZm6K-2FPasYtIHvQNd0IAoMMmayWpDZeG0238GYeR2lwwq-2FoLugqUu-2FXJ36JOTxGUD3T1xBXYZBAAVwjPGRZf0ufWFaGXNEjO8b-2F53pkbvf81PTL-2BoJ24-2F9pI02MZGRJWo9Th2Ehu0gfcDmlaUb-2FgCGsUIQEmg1sdGc5FT5V-2Fda6ms77RA87mXvlaqjdWGTMvAne0Auiz7d2LnAuwpVcNA4CJN5I4Uop5a7AeGCsIkNTQZ0-2FKJ5BAurYzLKvmEba1nEt6K4KA6Y8nKd4RC3xQUGcjOn7uQEUfJ3U0WgDEAZZpieQxEQ7UwnMw9xWr-2FxnNw0MmewvOsQGuEBzWLP0CFIY7EDiEbCRJznGKtnN5IJwXn1PU77tnjrFCA2ekk671eyclQnPm4Im7DMFRmvRzSjJp4MqKeabz8vB2cUTOm-2FA5J8jdz5-2FF0ghw9TkSQB4gci2CE-2Fr2zs-2B1AaHAvS7v2FnFs1iHhvjEv5XauSP8OZFVk57Kzw3Q7O-2BOgppNJyFIse-2FJz-2B66UGRUjDIdsIaRh7kxAvCnWG48wKC12EoGhSmD3EYjNAq7fpohkufXiAwe52ymJfe9tm5s2Yc-2FATiaiV8m4IlIhOXS_XOkdRMx-2B9QZGLuCdmWUx71VSlWTKMAHZ96QJAx6HQ9UvZ-2F5kMK3EVUjKshM22IqKMVUePKd-2BNCcPj7fFDl6GSUJQOKkRNwvOQ7Tn6JS-2FUZuEqV-2F2UeYk74dnDQru0QgrDMqNMR4MIbUQSATlDzCPa5Rqp82PBbE-2FUpjdP6cV8hv5k-2BGKpiNrpeduxgN6172Utl6G-2BsvCc-2BQhUY4xr1yX21LFODOmVoNX9jWoIpQOmGe5HeBilvNyhYGTHI92W-2FDUZ-2BuSZe2RWU9YPHOXyvNLDObkAIThFj5MQcT1-2FJQ8R8p2zgariCkNtbGGPFNiJRGVpkgXGnQRaGM3IK5gWRJ89sNe8hSqk0cW963ID5XowP4jThQOuZJHPycCjAlIO96qIVSTcZe5EB-2Bld67OPf0DeZQ0EW0X4Tm2HanzhCYr3Ee3VcHyYScdV-2B8l0zlKAWFZ4rC0f4pHtvOPQ9njkYAtdY4fC5UE-2FCsy4Jtt5Gz-2F-2FolHHzxHmqeXzYOJFAUvxK5EmcCjmHsote7fxdQFTyl-2Fs41F7Tsd6j3CSrMFnjxZ-2FKbHQ6RVgvFbCDMG32c2k6epv2ArFEAaZlXHi9o5CNPMsZGtTyRH98lM7EHM3kW1hurrSyYufB7S8UMevBJtkE-2F5gRPa3AVj0ZpR8dggwQmmmcTUistL9LjlQ-2BNzoCDKrZxdJJS-2BMzQrOCZjaUT1s8L8qbG07GWskMbnVBUxdjZt5SirRinHLlQ5Jsj6tkloLSJkuF05xiHsxfoX-2FgmghaFz-2BNPEx8Q-2Fx-2FyvcNJ0bjcA88NfKKDrvxOODd1GoHy74nVxCvXD-2BLWQTgkuBVNVNbcaFOeTOX8gdEDIhVF6E2gQBaaynhj96YLuKpqeO2QBmg8BnErOMVpwK5Hhp8Wrq3Yn1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b17446f8,0x7ff9b1744708,0x7ff9b17447182⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11295990444726458337,10646126419337010921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3652
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize264B
MD51a1f93584ba681be8be27736b3fb729c
SHA107a250645de731961d9679ad1aa9e52253e20056
SHA256b0c5eb0684d9da8eafbf27a908befdf06c55f77a47606a8edc3cc9aa62ff7391
SHA51263f13aee94fb3e95b3687aad442c2fdae860495c082fe6727322facf292b76c3eb1adef3df29bd16e32925a6f61fa738453adb098661b90806ae006dbccc5627
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Filesize96B
MD5cab395be8db6872094feea181c1d3d59
SHA1f3a30371f80fc1170982a7ec9f119a6ad501ec99
SHA256ae8c72a4579712002f14b56a47cee5b9b1c1fa0bd346873a70421f57fb63bbf2
SHA512b3b259fed0da7a1d87fdc59b16ae553b46227a28a36c32a21ebb73af1159fc3240ca0446de27164433b9ee66a2d6c0e2975d7c782d47eec762a187a2ab49e081
-
Filesize
1KB
MD510509e524bf7b751f901cab0a8ee474d
SHA11b277df57bba279562d45f7fa65942d542fc2f22
SHA256421568de53d3f875d7e5e76a53762879f7792f198a575863d8dc133be7c24f2b
SHA5127fc45e691ae285f3e44599f1d3e2059921147a8b726df19ca2520b7921dd05686ee6b5713e34a0149d03c974aab26574ccba4eb866cd9907419186086dc9ce32
-
Filesize
6KB
MD5539ecf22c986bd0d870b244226369639
SHA1eaacccb562befe57fd6681160a36c15eef4f853c
SHA256dc4280c53f008a7139e7a7f2e9f9a4ceb681400c927e31bda8d123d0de31cfcb
SHA5129c9133cd8cfea2bd058eb62eac3e37375495c7f285a0db99a5e534cb971f8e6d77646ac51e6c746f2c18ac9ca18b2af44d678eefcdf8a13af9dd6b9f676cfea6
-
Filesize
5KB
MD558f98d3c7e3ce8a66f5bf4cfabdaf677
SHA1eba6d9cd25abef7333916cd117b1943a6b096054
SHA256deddac17fb5577d93fae8c6ffd1b8642eafc2e954eee8f0943bcb586c9184f0c
SHA512861584458a01c92d14fc34f78a5a32637dba243cbcf1b7565aa62b9f363bbc15d73b18ef458f76ed7c57968979d6d0d83f58e9b57a1bb15e2cdf35ac35d3eed5
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD51b152012a204da1cd492c728ebd25aaa
SHA19433f78b7d3c3ac64ac0aa3c229b542612f15e0a
SHA256434ff13f380904aa2b71bf2877e3be3649fb036b9a586e9ea5cc382de7774b00
SHA512e3f3a2b27084349b68bb247013c4f4f421fbe1caee68ed75adad7634da48ec7aa45abab9d988fbc922f10e315e9cab2b52aed7ee5318f98667f5e6796084a6d6