6dba900ba4e73e88cf3d3a062f71735f30e615436d01aa96d18545e97d31a5a4

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nezur_Interface.exe
Size

154KB
MD5

7e7adfc3bdd9b766fb15521dc6b00f25
SHA1

ad6abf2d4dc87ae133be0aa8f2e77dc098ae8f8a
SHA256

3e08f027849d86c17909b507b25df78521afe175bcf30424f70ccabbfdf7665f
SHA512

29b33965f5a0b095b3fe8c16c88015584c62067fe3d78da4e4ec131d42918450dbec71e63bf7ba8917c531a4adccf8c0badf8c043523d959d964186789c01fab
SSDEEP

3072:WAi4pxpEHmAdx4/kyHRZa0YiRAl278IVn2JbS1cJa8lWjfl:WAi4pxpRkyHRZa0Gl278IVNc0cWD

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{F3CC1587-D53B-40E9-9975-0C0389590104}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
1056	msedge.exe
1056	msedge.exe
4108	msedge.exe
4108	msedge.exe
1180	msedge.exe
1180	msedge.exe
3048	msedge.exe
3048	msedge.exe
6004	identity_helper.exe
6004	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	Nezur_Interface.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4108	2980	Nezur_Interface.exe	81
PID 2980 wrote to memory of 4108	2980	Nezur_Interface.exe	81
PID 4108 wrote to memory of 4920	4108	msedge.exe	82
PID 4108 wrote to memory of 4920	4108	msedge.exe	82
PID 2980 wrote to memory of 3272	2980	Nezur_Interface.exe	83
PID 2980 wrote to memory of 3272	2980	Nezur_Interface.exe	83
PID 3272 wrote to memory of 3620	3272	msedge.exe	84
PID 3272 wrote to memory of 3620	3272	msedge.exe	84
PID 2980 wrote to memory of 2240	2980	Nezur_Interface.exe	85
PID 2980 wrote to memory of 2240	2980	Nezur_Interface.exe	85
PID 2240 wrote to memory of 1012	2240	msedge.exe	86
PID 2240 wrote to memory of 1012	2240	msedge.exe	86
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4516	4108	msedge.exe	87
PID 4108 wrote to memory of 4392	4108	msedge.exe	88
PID 4108 wrote to memory of 4392	4108	msedge.exe	88
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89
PID 4108 wrote to memory of 4484	4108	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://execkey.nezur.io/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d1a46f8,0x7ff99d1a4708,0x7ff99d1a4718
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4044 /prefetch:8
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10058970301831363232,5905540143936957242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/nezur
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff99d1a46f8,0x7ff99d1a4708,0x7ff99d1a4718
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,12243936064578968558,2468122474675702571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://1cheats.com/store/category/69-nezur-executor/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff99d1a46f8,0x7ff99d1a4708,0x7ff99d1a4718
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12214869201420581557,10250663859332385293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12214869201420581557,10250663859332385293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
b7769538d9e3551fc7cf9e20ab931880

SHA1
b066445cf80ac6e0622c8822c444ec46ba6ff6c3

SHA256
2c19e9cc600f8ffd15c8ff9d44c42967a286f1fa437b205105d968b659f63a7b

SHA512
500cf571e9e38f685a6ce76e7db51c374b9981abf67cf00c43160a45e6fc71f10ae4be9263a64fdb65c5ea4a025cdea08b75f7d2337e4e754498f161eeb20e7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3be07b1aee3e710093ddb7f55e6e54fb

SHA1
6a4dd767a8fc735f7d8376199b24489c18a34f10

SHA256
6b54ca9d6a06ef246571cbdd87f5aa000749b676ca3ab7d814cd07d39e462209

SHA512
c040142e95f248d7ea5c4d1296d92228b086f4845dce10dd46e1adfc2445c05ec7cbd3daf8f3acd9aecee83c36b33dc5b533e05d2bfade06b29a96db2c4e2626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
915b6689de8c23539c5bd4499a9e1f23

SHA1
85220c0e9a95e29c4303f312cbc846dc310701a9

SHA256
bcd394cfba635c390926e85c179d4a87f3cd7e09c08c79a2016b7144b2158876

SHA512
89cc112bf7ecb6bdc98d91152d590e6c2a2eb761301671bceb5ddd3e3c052acc5a409ba6d541c034ed90cdac1295ee0325222c9d1ca48da18e96ff1b1236d22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65ee94de70828ceb44669d8f0b91173f

SHA1
a1ee98e7f6f4a748307cb398971a436c5276ae5c

SHA256
02b2922ee2865e4456c8aed8039e3c5d5a40928378325471efa6a9ecf2200e94

SHA512
d7a5062002e298edba8065b4b9675f717f7ff0906a9c462c6dd0b8c690e6449535d8b08f751cf282e8e9f2ddbcebae0c008a739fda71859f5985b3257926942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c28f354f7d2d432d3c11b5e10e62e4d

SHA1
ccc947e1704ffb8463d71422337f5df2aacbe699

SHA256
6c908934a943a19b9708843a95f2f9c90547d23bf443a1a1b82b732dc08ed51e

SHA512
19c6292b09a3a227d843889e9b2d2514d86cdc1889fe9d246d497c398cbd4028889eafa7b342d782711123e35ac6638248edb04a64dd6f5cf65b25d308a340b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\c7ba898b-6ef7-4579-8a5f-39e84f0e6527\index-dir\the-real-index

Filesize
72B

MD5
36cd963f2e85811e52b6fb675465a661

SHA1
0da271491f291c1093ada0b67a3d8f3ffc9a9d55

SHA256
64ab8a37a2ad0168c958934749080407c88da53c6bcaa5d7ed8d3f076a2bc62a

SHA512
c4ae49614260d81adc2ef46ecc23633075699d999d93e74d6bafb7d45420d4a355d4316f1b90f30562fb47ca90391aed2330093ead26224e0f7ff11a6f1271e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\c7ba898b-6ef7-4579-8a5f-39e84f0e6527\index-dir\the-real-index~RFe5818a4.TMP

Filesize
48B

MD5
3fc7cbccde6177f95da1fac9a3aa261b

SHA1
4844f8458a8287d406de9216ee8e876a956af486

SHA256
c4008676799373895d4595b6ad1ad91756fc35067ee2fd7666b517abd8e3ae19

SHA512
0dfc82215dcc48249eee5219d22407306ae3efd7a5c289f56455b5bb1c35645ee6fa5f9109a0c97d3e64092e8bcadf3e0a75b4252785c1dc375012bc05008699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
116B

MD5
7a36ab5a1c34b1861193b57e0241a4fc

SHA1
3b83b32218d9b5af31a686df58666ec13a005c70

SHA256
722a80ec3cbc58e5d5a2368db3e54055197da71d90f88237bb1c4383c4e9b3eb

SHA512
7af6a639beacb8c0e038d3de5c50f2e50c2f7dac6a607f4646d40c8cfce14ec9ff2ade68c9f990bb5f65968e21b033da2cd0d00742092224fbd7ea67d293ec0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
110B

MD5
ba6a6214cc0dcb72997c24cc0ba3f640

SHA1
89c1a33086ce4523758bee93810decc5470fed17

SHA256
803b37b1668b22bcc905c35fad0f408ce738f6818429dbd6421284b54a8193a7

SHA512
9ab2297955aacc5af91ecaa94358e6b23b61c25c610c3bf2e58debf5ce102985a2f62ab8b22258048437b9f008b88ac5332c33585fce30b61afa8aaa427601e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
bba9a64f937fed0bb45ef38c8da27a6f

SHA1
e846bedadd0cd64bf541bb05fd626ffd692ecffc

SHA256
b9cc4b3b630e4d36b8f8f085a9f51cc417c223c2271af6ef15ab070980edfa8a

SHA512
2d66dacbe8b9a9d60e557c27563c9888492b7c24215d4221fe303649e12c61abc8407d252e2144f12e00e41b554311307d16235e89fd8b547b7b2ffb98fdb291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58174c.TMP

Filesize
48B

MD5
ac3f042f5fc134ca904acbfac75cedc6

SHA1
91b0d628e9fd2c31757f4eb3fe6f9c5d2b236d38

SHA256
2f3d34e3c342d84fec2e006d538303e3e73a58cafabe03548ca2458352fa1838

SHA512
486420d4263735c60c39ff5aa82f6e02798d0bd5d5b4b1eb4eb0f2d2fd233655a1158a208157f058834081c6241c49dbbb3dcb8e7d378fc4dd16b1df033d94ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff75cdfe555894070f747046f166a900

SHA1
1217f4e2166f86c98817524e16ef821d182a22d0

SHA256
07e387b214c06cf35a3db02d2c3a6326b4ee6bfc557b06d470f493c8106a6f86

SHA512
6ea0fbf693984614b9573692c8fb9fce946779d52931800e7997e05ace477e7b0e32bcd71d5f74ba738ff0be1716b8ddb30519942319ed2a9ec187e7c860c5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f3c6.TMP

Filesize
864B

MD5
44c326f871ec0a3e3451b2625e24f2dc

SHA1
8a57f0ec72c9df8d3ac4d259f2a7615d71c38e25

SHA256
ad16dc7b0aea84f0ef6c52d820e49bff4ebd8f6ef9fcb71aa15aa5faf82296a5

SHA512
48ec5c79bac7129b6cfd080fff3a9bc4c41f3bca5ec7a23d4b88ec3734a97db8d58e027d99d02b9fb50408ff6d307de3f11b43f3523e4585f9e15617c265524b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b4657a17a8794ae9bb739d1dc7b3ada3

SHA1
cf28889acbbc689eb7e13820e2ba57c23a25c6aa

SHA256
99838ade56aa60ca171a15a838522a3889651eecdf076b1971a8f283c8d4f40d

SHA512
2080fd24594551b5af0a02fa0200270dec6868ba1bd4ec8c875acfb644c349b26b19a3cb9a660ada3c6a460c5a5d974945157a7200d3b565a2a01f8186192ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b70f766bbdcb6cd79334ddd29614da62

SHA1
9da132020c93db1afdb9ec097b517c788924c81c

SHA256
da6f414cfbda862666e47c64553d9aa7954af933470138053e3f29038456ffb3

SHA512
b33f9755ad3e07e9a9f2d8261bc1d2b40a6c41927a97ff472712fcd12f64795547a911fefe3f359a274690adb36e9b52642504aa774a1a878f1be3c6b8990f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
948bf44e3031cc1a88b2cf85babd85b3

SHA1
0bbb01b627d6dcfd4b21098a19b310904574bc7a

SHA256
9be5279821e9000560528873d0b6483edf13762995df57643ba7f90f2df53d5c

SHA512
14538beda829013b27bd8a341a0f45311ca8f07cfefcce75a16d69dc1b7cf01a542ff29f6ac1c7faead255babc0e984fbc72156072cecafb410c43a4f543b929

Download Submit