hxxps://drive[.]google[.]com/file/d/1UbLtTmSpJOI0A9SqEb3jq0YZ-GgsAlep/view

Resubmissions

25-12-2024 16:00

241225-tfvb7axqdj 6

Analysis

max time kernel
51s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
25-12-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1UbLtTmSpJOI0A9SqEb3jq0YZ-GgsAlep/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Script v7.95.txt:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1372	msedge.exe
1372	msedge.exe
3260	msedge.exe
3260	msedge.exe
1988	identity_helper.exe
1988	identity_helper.exe
2408	msedge.exe
2408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4136	1372	msedge.exe	78
PID 1372 wrote to memory of 4136	1372	msedge.exe	78
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 3444	1372	msedge.exe	79
PID 1372 wrote to memory of 1152	1372	msedge.exe	80
PID 1372 wrote to memory of 1152	1372	msedge.exe	80
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81
PID 1372 wrote to memory of 3080	1372	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1UbLtTmSpJOI0A9SqEb3jq0YZ-GgsAlep/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed83e3cb8,0x7ffed83e3cc8,0x7ffed83e3cd8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2697741714387898511,15766314470661565395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
6475a4afa02878aba743451522eb5e43

SHA1
c0f8d41970f233ab9fb258b06674d1df7bff58a9

SHA256
db13973812c4dd5f62d6885ad06ed9d86f59089de6753752618b32be56d72fc3

SHA512
a016fd71ebd5c38cf4c4f4fcff4d0c555e86ebc201b8da4cd29e5f68162ede89922458495df44b05347ad62c76ee9f82f3147bfce1e5b4bfc5d55332de3119df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
20KB

MD5
077e3f0d3dddb018c1e71fd8e46d2244

SHA1
b50954ed5904b533372fe39b032e6a136ca75a7d

SHA256
12ea854aa2a6588219451d4af53fcd368e24b109085062deec4e5b891e059e82

SHA512
f9cb475d16d3e8dedc6ef2feaee4f9bad365a8bb992352163a0a9f4ff9e809bf895fc0ffd59375e60a44e5c5bd1f43217177fb44ffc0cc76cc85e45a612b9b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0a335a03b2a32b99e83f77a5778c1b4

SHA1
cbdb2adf68db9868ea2d761bdd0e85e8c716e402

SHA256
f8b71984609a3bdedb1792bdec7dbe4c88c14384c302e06799f83e1a183c8ceb

SHA512
993890871b5a4bc3a1c4744a9269fa94acb91bd850474ec557ea8a2043657670069e3612763626cfa88e724535efd654f5bd7cc69ec919da50fe70f09212e2fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
017d5f2436485ab0da1d2304fce12aee

SHA1
def2959834b5fc7b97009b60585a59d1d4a0521e

SHA256
1bcdd3610c6f4063a49c58ca3e7539af4e9c26a71f2e7cfc44e60a4f4a72d006

SHA512
b60fd68e7b2f2c8bfeaaf5fd261d81621fcdb24206c049350a60eca11865f84305346239272c1d1ae2aaff100ee444ed4d30c7e6c170fef66f705c4538b5d8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c504c83acf8f86c24a336800f1247ba

SHA1
6ad5054824947ef6bbdc2fe64918b4614b57eaf5

SHA256
57641a2a3051a26aeb85cf3edbbe39571caa7c8f4c0a15915ea6ed43e15a87c4

SHA512
1537223bb09c65e00d77dc10cd6ec8c93104aa4516a10e0bf2bc614b75fb570dae53f51156ebd2ba212686cfccc90096643a4f1c37ce5c735d76be0c3facebfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b29188abc0dc53fab0050a974ace5fa8

SHA1
a701ed1004079c07ca7e49138a5d76c2146602ce

SHA256
5df0f77ece03e92ca82ef80908ed0404770bcd2599109df7eb9f65e7b6e87829

SHA512
4fed89a00c2a48f1e3017f78394f1e3e869efdd55228a643b650e48413796f9ff554b9ba7eee0d75b9c673ccb418f4116f128e94216ceba0faad0ec8439ad779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5cdc70fa97ede84858c2a059efe2370

SHA1
fc018e6923cccb7205de43eb9b6e46ed8d16cfbc

SHA256
2f47149a82dcfa908edf7f9172ffe9c1c4522a0118b9e01e3215744cbdb2925a

SHA512
da17d635dbe4b3b8dff6e4295a72be1e4bbe6efe0b2d3533b527936948f1abc010229ee1223114313fef17d21f286f6b697ab258db0f3fe88295f8f1d300421d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe584532.TMP

Filesize
99B

MD5
b2ca3d7020e4f87a9a1c046959e9e8e8

SHA1
cba07f4a3d6654649094766b704e9fc6740dabcb

SHA256
493da02a8b91045b9437cec9cc8b1c28ef40df5194acc6787ec1fced271bf132

SHA512
e2e4b8c50b5f7bf6c78a4c28702953af0b582d806aa12a6b98e169f0701845dd030d76a9f6e715afaac86f749faf948fb34c0402058494d0a3f7b3c777e5eb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
59476e202d8bc36ff36904cd24058dea

SHA1
06c714efd540dab36e5866cbf892168c5f9bc19c

SHA256
0fa04ca1040de6caee2b95e2c97e48d30f14dda31fa10bbe8d211ee22bd05804

SHA512
9c8870766022bd34408acda07f844deabcfac94dd2192f069d7d70b86b92868bc14bf156b88782a6526d899a32229ac29d7ad788895dc535c6f895c23aba6f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d841c6757bd78d91ccc3ad60b0bd3a7d

SHA1
63340bec28335b79710b2f9065a1703488cba851

SHA256
4437f74ce88919e62bbbeb4e3e5e0413ba8ef7103fa3aebd4fd94eff97226a8a

SHA512
7c961ab86577f535313cd4abaa0de6f5ec07eb781ecb08b7f02dc8bf5a87e83a1d594fb7aa64dbf2f51e04aee58b21881e496dc3bbb446e4f3d990b9a081d4f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
23b2a69fe86c167be459a2eee4abf376

SHA1
b36a7e6c69616539f67b3d161fe1ebeb4c49bb7b

SHA256
b9605f5266a8c9a08c307e6245f39b733dd8992a056fa58fab532ec815ec15f4

SHA512
e84e86000e9ea0aa91060dbafcff0804a9898bd115e86fcc0f028d858a6914e604f3a69e41b5a5c16b68fd8b083f7cbcaadd4251b93f46ed77a0c4349ede2f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582798.TMP

Filesize
1KB

MD5
c15b7b78cf6847a38f0d02fc63b20f50

SHA1
9e0f7f26eeda83662de196343f3c703ee0352d1a

SHA256
f3bf3ea7fad7f5e803131c70f7c0440b6a56295922277942ca9bd12261bd105b

SHA512
179fea4299f895e6d0d568685997def02d1fad310eac8fa07b59fa4a94e572d806e21d8102318834140bd9fbf3f4505d0521aee92bf1047ac1b87d3b2a1f8e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
364f24f149e62eaa6d27f6b33dbf645a

SHA1
294b57a50b897d7b0cac021c431a94b41124cd40

SHA256
f52dc257540bdc2f9a4c59ffed913b9ebb97a48149e71e4a8fcbde20a262a9d8

SHA512
da338ca2f2987c09085c27cf77561130aabfdc2d1a03e0ea83fb7eccdd9c71377e5550c7da321030da99d70030c959c53627bc949bef9690845ad0abd9fcf6de

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1301a13a0b62ba61652cdbf2d61f80fa

SHA1
1911d1f0d097e8f5275a29e17b0bcef305df1d9e

SHA256
7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

SHA512
66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

Download Submit
C:\Users\Admin\Downloads\Script v7.95.txt

Filesize
58KB

MD5
43df02da3ffd68615456798d6b5ed3d8

SHA1
f1770cde945a2f6357b6ab8506652e9527e397a5

SHA256
67e561f20c2c44c3b36f79fccec4534317b3749620169eb3ba5f6840b55d2cb6

SHA512
eb86543c4d608b76c3fbba24422f34262611e0e4ef4f57ad130ef86d9eb82c4e5d07aa8f89359bc538d833dffc0c6960e386d286a578ffb9bb67d37920a1386f

Download Submit
C:\Users\Admin\Downloads\Script v7.95.txt:Zone.Identifier

Filesize
173B

MD5
f8fcd9dcc12609358748e2265307ee5e

SHA1
0b83c9a466c1cf3cb59eee0fd47312f7a92ba8ee

SHA256
fd7f22b31bc39ce774e685234827f40f58f05c1cd7fdbc6478018d1870dd6a6e

SHA512
2d775326a169a96e1282ca60bd3af369aa348541575d2f9480ae3e9bc0dc1752d840fc54946a76c18be94583b69c2ab985b0313f0d7b4e5ae2b29f3dbf1031b4

Download Submit