d8a9f2f1a98bb212dc8c114dfed0bb0f16c5eb208ab72f1da46174b2521621cf

Resubmissions

12-12-2024 14:04

241212-rdccgswncs 3

12-12-2024 13:46

241212-q3f7asxran 5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

attachment-1.html
Size

228B
MD5

e3b9a28a8536caccbcd94fb5d610d8dd
SHA1

25c54e735d36f30fcdf6300ddc191cb3ec4c3070
SHA256

3d5b88c59182097305c2fa6d6fc54963bc2d81b803250d4bdb777bcaee23bec2
SHA512

733c39bfba53c248ad8b5173adb9fcae5e9ed77a64649649c6e4b7f6c8de1de422230d4638b360e2acaa78df8ca94eba183ce5b7dd2927e0d8e2f9b7b6ea2545

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
4912	msedge.exe
4912	msedge.exe
3080	identity_helper.exe
3080	identity_helper.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4936	4912	msedge.exe	83
PID 4912 wrote to memory of 4936	4912	msedge.exe	83
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 768	4912	msedge.exe	84
PID 4912 wrote to memory of 2372	4912	msedge.exe	85
PID 4912 wrote to memory of 2372	4912	msedge.exe	85
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86
PID 4912 wrote to memory of 4128	4912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\attachment-1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9ef746f8,0x7ffd9ef74708,0x7ffd9ef74718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15384431746509415211,1670938786158946223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56648213-e279-4570-9be8-cc43f143a850.tmp

Filesize
8KB

MD5
8b6a2f7aa65e8e65d133986e228f7331

SHA1
c463de3be3e7ad21c09da7d60d71c474ae9ab47e

SHA256
8f38aac38eeb43306e06528c0ebfbb0725a8b94c2423a68c0062458f10be4c55

SHA512
095ca91195353499e0e03f0945184f001e5aa2c27487d0026dd5de01757976aa2c6ac9109957180fd266d391964e3e10d5e795c1bd3ed62338d4d2cb2d515c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
a769d6871bd69219ec81ad1162220f4a

SHA1
d11656ccb2259405dd7711298747d505b7e61f68

SHA256
285f7714170767b9a6a1b099bf32b92e876c544dc96b01b38e30e9b65cf980fe

SHA512
934b9479b8179d7898a71be4087527df6976eb1120cefab5d283c063e2a8e10414110b6a9b72abf2b08379ea8cc43d312e708cab8476c6bc66edac1560b1aa35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0f2b530bc8389d51daf49cb958cef8ef

SHA1
7a17b7d638dba4a601075cf7ce3ebb045feca180

SHA256
e433afed2d4f211a2406d537dd112bba3ffb03e0009fc4325002f5dd71daa1e2

SHA512
8d20e3398e533399945e31f795026d3886344afcf1a9213b8a20518f90265bd7c357a1a4a38a51e25e468708fbafc5f2653705b7f4c65260bf037a0ed131d383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bef7673472e9c7e654d6f2b76c3fcb87

SHA1
3dd3e14f4c55d6e002e27bec29bc509cf46cbdf5

SHA256
04dc7729758c4d5e48f10b241a96eaf171935059d903c6a5014729423467e254

SHA512
60190ac20dc0a2bd1354cfb984f7a8f28a8da00419abf1655015ea89c34367ec7d295286a99055207ba3e12a136d3e3db6e50f24fad1b98125b4b8d7ad8974d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
df62aa330ddd2df4abf70dd46934b3a1

SHA1
eff3d145e3f4d7494fca2dad801290542bcaf99a

SHA256
0100addb8af40177cd3a2d326fa6d8eb5fcc96069f3bd9da7da299eeda5625a4

SHA512
f4445a47657eb4f78a2a2880770724bbce48157b7c039bda8befceeb0af569c7211bca788864bc7d2bdf4450c4cf7bad51de149dc1b9bbb49e50034afba25278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9dcf89a2c020c43e9a1ca628f986e570

SHA1
f248ec81c80a307f3d8a6748455d47108f86470e

SHA256
f20f5f0fddde58ffed9b07e8adab221861898e745bb086dd7597250cb595231f

SHA512
7e18a78207e017de127a156be2c8c926f6c5bdb29dc9b8ff4809958d94755847c2b24008f31e52a418c538fe0e70d95580d35ee609343479855f70471abfd98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48a003bcc4d4f0b60cb84f5a9aa41fcf

SHA1
d1fd31212a8da953688d27af539fd0cac6825330

SHA256
f2dc3a57afaca7ac6e253b60ff13b443cabcbf91ce9424be39b56ae5985998bf

SHA512
ccd515f74d90c2d4502ec685024aff194adf1174daaec48aad0869e3fd5db44798eb1fbd018c394d53572ce256b73632b3046ace8d3e8ed2cd07cfccbe8afd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4cec6b097a4ee00cf0f49cf45c67aa3

SHA1
734f71d6b7ed7d14a5a45447586360c8237091de

SHA256
8ce35c36381b7b3192c98e0fe54e8f3a0ed9ac5af387085d3fa4233120d2e28d

SHA512
1213b3a77ee87ed77298ebd66ce83ff1a2d4479cebe55fa3804409854e182ea8f9339cdaf4d667f379d79638ec60c3e09b7e46101d1cc70b40c3e1e6ef3fea01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\1ae11bb5-d193-4352-bca4-0b05170464c9\index-dir\the-real-index

Filesize
96B

MD5
0e0b9222580be3b2c586fefa39b9f6cd

SHA1
ecd3df5832d6a4b284192707fb1207b2109f4d3b

SHA256
958d0a860e545502bc4ed068bf74bde5334fee387bbb59fb3bb56c395be937f5

SHA512
eed3f7b085be6c2b86c12537d0630ec4c4e7ee731287a73631167bf9b759c2e324b81276bfb712d19d164a1e1fcb88adf66a93921ddc140737886616997d7888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\1ae11bb5-d193-4352-bca4-0b05170464c9\index-dir\the-real-index~RFe57a393.TMP

Filesize
48B

MD5
1b55d5b117748dcb59f62959ff739130

SHA1
20b774b80de51938e4828656fdb84fb05886fdaf

SHA256
6b4721597f7140d084bd693d5767c069dfc9c5f5b114dcaa96625de6d0361c14

SHA512
a5cef6a688686143067b404e75bc11fb7af9b24dae67ee19dbce8dd336dd5ee70eabff95c08f21a76842b363c5936b3761b3193c77a3b815b1f24665d730877e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\66c76fdf-323f-4055-9f2e-b409500737fa\index-dir\the-real-index

Filesize
96B

MD5
389f0f5ae1a63cab7ee527ba46e8e3c2

SHA1
96bc846ca19a39da1b7993158447f375f68b13b0

SHA256
76fa6ec34a3d162f19408f6c1349f9c169ff72807aa44dc20980a606b1b073e0

SHA512
5ee77520d9879185cd045f721ae079ed8e6a45803cfe4c22204ade4a74ab843d5d64738b8fb9d614c67b753726ee0f1945e06a118e74923a73e7ce601450a89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\66c76fdf-323f-4055-9f2e-b409500737fa\index-dir\the-real-index~RFe57a393.TMP

Filesize
48B

MD5
721a7b69a06afbcc6b177a6648830bba

SHA1
b5b1ce87605f35648ab7397454d5935523d8162a

SHA256
725f240a0eb9da5134efcf19b3d406a323f65b681322f7857a225dd7f72c46f9

SHA512
6ff5084096a6d663e0b5e3fd36f40e8d5b4b9afbc4ed52fc6bc36e5dec8c0f9a139a993cf8778c358c6c2e2a2f5604b88100e0ad7e967e9b139d64e634ccd65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
179B

MD5
d6d83286cf36cdf04ece2223010850b5

SHA1
38b66a87c95d1d4ca3dd513e5c2ae43d1a12c5a9

SHA256
44e799bfc145891b72f2361ed7edf3b6b6fadc1a9a17d34485fe3adda9a13766

SHA512
3c60a927f5bd35dd7565fc70aedbe06fd6934b310573e1d3ba0a598818e9b3876a15052f0fd66594c12a9aed6e64e0c4f2534c7b60b5b4540494de09d172704a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
107B

MD5
a01cc0eac35cdc7e08062ad15fbe573e

SHA1
09dc2548a641a23d2475e8e4c0f0761baee9c0cd

SHA256
7c903355d2d0823f93d390b63808805033412690cce3c55525f321515ec77ffa

SHA512
f7173a881b77afa558cd1742d64e690f6d3412ff0a384d1dfd085ba1963fee716b7c5f77b6d3f40fddd980ab2691803e20cc352fa7908c292e55433552f0c595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
175B

MD5
2b692d2c55af238339840542e2420e8d

SHA1
984381d33f8b19f62b413a00dd0a7feebe377c1f

SHA256
f94d9fee714edf765e5e94e5c9ba2947d7ccbdd4b8d4f1d8362c7eb705a7ccb3

SHA512
c3bf638afd267e814d23175e8bbceab3d8475a51013eb8a1f948b6c143f7869abbb62ae43140e75706e76f296cdbb7b588e9ff5e6828aef58488535eddc2dc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
90e2f17bb64e0d675bbb07f2581384c4

SHA1
3a942a79805e598a5a743a3c1e860152b8880eb7

SHA256
6356fd53f559fc7c2039ffdcdb4b9ff22d0db8bc5d2a1f044393fa1a0b04f3a7

SHA512
8e5a5db59d36955b0991a0705b89641d8734cad0a04367581649e0ca786a97bc5cfb6adcea1143aa2f31afe51330ad5302a06daf24a235aa445c5c09b70cba93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5886af.TMP

Filesize
48B

MD5
a0ae682cf59704b75decab3361c430f5

SHA1
127f2100c22f11acbb221377082cfd85d356507b

SHA256
343e6b3eb706b08bb47bbf341040f2fdbabc32d13bd3bf8a498c76fdfdce7a90

SHA512
a962dbfed7b1185b7d64d0c9b339826f37548f642f344f439a02a3d9c0d1bf9bb01e77e56fec99b2ab6131f43b6a54ed7d5a78775b986a386cd837feccd3d594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ade12bdbbb462661b625ab1d32e2c4c

SHA1
b6d93724baa7085eaf1398a4cf93134963d46372

SHA256
f55929d4badb8183c4d94a4284ab035c0e98bed07ffc1f9bd48c8580a9f0fea7

SHA512
c86c97e1a6a5abee708232dd04aa18f98473f8c4eb5c805935b9b6feabee67a0e499695e63e075a80921546c898a06d5faa6ec84a74697bfe45ec1059ac653f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dda764b70aa17ee1a40b935229b3e09a

SHA1
b47e8bc22ba92099b882eae082d966231700c398

SHA256
d4d4c00c55bd787f8b8c0d9fd6a1ee5f86af8285eb3ddfbf70ba1412f2121eb7

SHA512
70b2cb0971827307c853d9c5569eaa9f49f2d8ff87854bc4c56484ec1acd3b19cd5dc9a480fe28117b0872a41418b855aba8189bc1ba5694217be9b7393990bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c92c.TMP

Filesize
706B

MD5
0de193c3eae2482d452e657668185bd7

SHA1
1b5637e437f7b787ce0d4d3acb188a7523ce34a5

SHA256
7c840b9d30b34c6526b5939c5db7be8680099228e1472f126260ecd2462d28da

SHA512
ca13f0b6bf4cc6cfa473c8ea09d070f4e2b919000eff22a2d822d5e697c8697e18a5c019484093be903394f9629a905d925855d74be64c9d727f81959d48b60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eda2d7982f07dff1b8a78b47b359342c

SHA1
2fad42d06a14870c3dffc8a855ebcdc3cad2cd52

SHA256
810813303dd5911503ba8b82a30b5bf33b1f41b80ad281bb3bc85f8a2431856c

SHA512
3350bf6259eb32ac5453b3298438d0a67582c82d467c20e94a97430d4c6fdbc784530db03ee41e4c3c5482c72f720e76e8c34110ce562d0ffe00922571a06cd4

Download Submit