Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2024 03:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.paypal.com/signin/?returnUri=*2Fmyaccount*2Ftransfer*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq&id=Y.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q&expId=p2p&onboardData=*7B*22signUpRequest*22*3A*7B*22method*22*3A*22get*22*2C*22url*22*3A*22https*3A*2F*2Fwww.paypal.com*2Fmyaccount*2Ftransfer*2FguestLogin*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq*26id*3DY.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q*22*7D*7D&flowContextData=BihMWwMEG4L-ELLp1i2qsrTkc059SpHHJB9YRaiMFqDFVGCRWWMEIZ9fuKsdBM3Lix0m93FeyqumLR6iUmWTPbyVDjTcmYn7xoR3G3dqkQZ8q0zEVmf9FbDJHDYsLkeClwwQp1-JQ2Iy6DbkXGXFViairxXU0qX2Arr_ZdU-p2SiPQbAkYHuEmAu7nld41vjMnoOuQT-2qXsM3Tepj89aLiC1ZYZi8ISnExX9uSKqKBea7phnb8xIm2ZTYJ43A3KUUTpGMw_Gjindt4k4IZ2vQo8zx1HTNTlKxg8dKaNnjKo1OX7zWh5eD7cjbq&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=96062767-b317-11ef-93ab-61582190837c&ppid=RT000186&cnac=US&rsta=en_US*28en-US*29&unptid=96062767-b317-11ef-93ab-61582190837c&calc=f504264a03aa4&unp_tpcid=requestmoney-notifications-requestee&page=main*3Aemail*3ART000186&pgrp=main*3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585*2C150948*2C104038&link_ref=www.paypal.com_signin__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!P5FZM7ryyeY!QCjFvo_ZFRikHtZCaIwm9AHNgjdUOgoX9Nrjx4hM-7RTF8MwdoGB8PhUf1Rp904DEaeiQSEExjSmK2xc_5w6md0$
Resource
win10v2004-20241007-en
General
-
Target
https://www.paypal.com/signin/?returnUri=*2Fmyaccount*2Ftransfer*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq&id=Y.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q&expId=p2p&onboardData=*7B*22signUpRequest*22*3A*7B*22method*22*3A*22get*22*2C*22url*22*3A*22https*3A*2F*2Fwww.paypal.com*2Fmyaccount*2Ftransfer*2FguestLogin*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq*26id*3DY.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q*22*7D*7D&flowContextData=BihMWwMEG4L-ELLp1i2qsrTkc059SpHHJB9YRaiMFqDFVGCRWWMEIZ9fuKsdBM3Lix0m93FeyqumLR6iUmWTPbyVDjTcmYn7xoR3G3dqkQZ8q0zEVmf9FbDJHDYsLkeClwwQp1-JQ2Iy6DbkXGXFViairxXU0qX2Arr_ZdU-p2SiPQbAkYHuEmAu7nld41vjMnoOuQT-2qXsM3Tepj89aLiC1ZYZi8ISnExX9uSKqKBea7phnb8xIm2ZTYJ43A3KUUTpGMw_Gjindt4k4IZ2vQo8zx1HTNTlKxg8dKaNnjKo1OX7zWh5eD7cjbq&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=96062767-b317-11ef-93ab-61582190837c&ppid=RT000186&cnac=US&rsta=en_US*28en-US*29&unptid=96062767-b317-11ef-93ab-61582190837c&calc=f504264a03aa4&unp_tpcid=requestmoney-notifications-requestee&page=main*3Aemail*3ART000186&pgrp=main*3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585*2C150948*2C104038&link_ref=www.paypal.com_signin__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!P5FZM7ryyeY!QCjFvo_ZFRikHtZCaIwm9AHNgjdUOgoX9Nrjx4hM-7RTF8MwdoGB8PhUf1Rp904DEaeiQSEExjSmK2xc_5w6md0$
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{3F1C566C-F3F8-4B20-8CBD-07947C49B576} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3336 msedge.exe 3336 msedge.exe 3424 msedge.exe 3424 msedge.exe 1576 msedge.exe 1576 msedge.exe 3752 identity_helper.exe 3752 identity_helper.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3260 3424 msedge.exe 84 PID 3424 wrote to memory of 3260 3424 msedge.exe 84 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 1420 3424 msedge.exe 85 PID 3424 wrote to memory of 3336 3424 msedge.exe 86 PID 3424 wrote to memory of 3336 3424 msedge.exe 86 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87 PID 3424 wrote to memory of 4840 3424 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/signin/?returnUri=*2Fmyaccount*2Ftransfer*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq&id=Y.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q&expId=p2p&onboardData=*7B*22signUpRequest*22*3A*7B*22method*22*3A*22get*22*2C*22url*22*3A*22https*3A*2F*2Fwww.paypal.com*2Fmyaccount*2Ftransfer*2FguestLogin*2FpayRequest*2FU-4LY55296D50427840*2FU-9W512734X9668662W*3FclassicUrl*3D*2FUS*2Fcgi-bin*2F*3Fcmd*3D_prq*26id*3DY.vdLOc9pATbAl5tcN8Es.adEbYrxfAMh4fm9Q*22*7D*7D&flowContextData=BihMWwMEG4L-ELLp1i2qsrTkc059SpHHJB9YRaiMFqDFVGCRWWMEIZ9fuKsdBM3Lix0m93FeyqumLR6iUmWTPbyVDjTcmYn7xoR3G3dqkQZ8q0zEVmf9FbDJHDYsLkeClwwQp1-JQ2Iy6DbkXGXFViairxXU0qX2Arr_ZdU-p2SiPQbAkYHuEmAu7nld41vjMnoOuQT-2qXsM3Tepj89aLiC1ZYZi8ISnExX9uSKqKBea7phnb8xIm2ZTYJ43A3KUUTpGMw_Gjindt4k4IZ2vQo8zx1HTNTlKxg8dKaNnjKo1OX7zWh5eD7cjbq&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=96062767-b317-11ef-93ab-61582190837c&ppid=RT000186&cnac=US&rsta=en_US*28en-US*29&unptid=96062767-b317-11ef-93ab-61582190837c&calc=f504264a03aa4&unp_tpcid=requestmoney-notifications-requestee&page=main*3Aemail*3ART000186&pgrp=main*3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585*2C150948*2C104038&link_ref=www.paypal.com_signin__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!P5FZM7ryyeY!QCjFvo_ZFRikHtZCaIwm9AHNgjdUOgoX9Nrjx4hM-7RTF8MwdoGB8PhUf1Rp904DEaeiQSEExjSmK2xc_5w6md0$1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d06b46f8,0x7ff9d06b4708,0x7ff9d06b47182⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4712 /prefetch:82⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4728 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:82⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:12⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,13439065365101822453,12003521111956528132,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize936B
MD521bc7fa9712d1d48e3e213f9153f2e4e
SHA14fed155bf4df1d6a067042fc977ceca8986e7f23
SHA256e0ee8baa530398995504f18f05f8a03f680857379e38fe360cfec75a00a39d9f
SHA51262c569d56602b22fdeeabd683a2e572c320234be75ddd987f60545165e345747bb6370ba717b7d3815931181521440e6ab3fc55a6f0e792af8ce21b2ef1ac353
-
Filesize
1KB
MD5395a92f8057b787d0f6e43815fbd5bac
SHA1510b67d7308e5f28dced9e5142c2a697620bb761
SHA25604578425a673a28305013c49312cb02a3f59bf86ae3ceaf912386e1d8b464f1d
SHA512c38c1dbf0dc37e00ebc2ddf9b468f82c0020e3fcff232a60ea54162924997be7792aec3553b25c9b4eefe7a08adf0836b1e8a1f4c6493f34eee67efd4fae871f
-
Filesize
5KB
MD5edaa915b4c064ce5a88da3ae3bfeb9a0
SHA1b26f8d34868bd8b2dedcc7be791b9007685f8b13
SHA256d1119736ae657b06d19eae295cdbce6b8b854281f45c3cbc2d924ce8e575c1ca
SHA5121b767f6d75cd5067580a60a07dd8eb4ef6134061f6196a2eef9f079e3a41dcbe618c056e0d78b565015a2abf2ad66e5838bf364e36a9cc8ec925cd8b91b934ef
-
Filesize
6KB
MD57bd1ef408bc1a73bcf08302177220b90
SHA15f2862503c7ddcd2b534b6285249f354c3e6e4a9
SHA256919a558c451e8ff88d6795c392d67549270d7e623e7fc7a9763e2dc98bdc2075
SHA51277b89563ebcc5bce098a2be1d8227d1051db82b117adf4cbe2c2d780bb545e7a66bc5806cd90a3750667c49a0881ddd79cc1f70236c9be535076b7434628519c
-
Filesize
1KB
MD51f58669ea16cbd2a31e9c9cc6244209b
SHA15520219b116b394d2d0951a4da95bc82bf72fd04
SHA256b18aa833ba2edb0378039cd39ee627686eef1722562a7346f090be5e602695a6
SHA512891fcffb02b601faaf26b61df1d929c9ab0bc6f38cc909ebb3ee8c37535aa142923d70ffd538685647bd2e39db2994b6058982edb6e704e4525086944fd4a7e4
-
Filesize
1KB
MD569d8da7022e5cb1ebeca96c44dff092c
SHA1f0ab095513c6b7c1f8a83efe3dfc6276afc8fd59
SHA256b4bcf4ed1ac8af77fbbd830a1e1bfdc70a944926de16f5ed1ea54bd2a948b508
SHA51283b164af8e15baf2bf4e1559382d2c9744dabee398a7d46a985f11cccf5b9897fbf68cdada3ccec9e32d40281680a5d83e9f9e05ce94dd2874db9f84b0cf243c
-
Filesize
1KB
MD5475b3c48f33c84badde3c96aa3e7c8a4
SHA16f5547f204057b349572f4e50491e3043b8479d7
SHA256279dad4dd5127a29d4d2a63be27befcfe0d65097261455b5d3fa7cfb32908bd2
SHA512a1835f612783988750405d6de8daa133c915c15b6bfd07687715322bfa80b76881d42e683d6a53953ba4def66480f78741d978d691aeac704ca69fc296d45c90
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d066b3fdc09ca688fd8dcb7ad9173662
SHA19d6476b8e4fca2a7227f85ff73327fd59a7dad57
SHA256656e877e63bf42ba98a79d74e56495a7f5e0440ae2dc1b3987a2f0987f87588d
SHA512cf342dcd8398fd76b51fb174761517530dc6233775ec42d6b93fbb2b99895b75f160a08bd0b15901a3148a0cd4834a7dbe2fedb5d88d322159d818e801e03e5d