8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
5076	BootstrapperV2.06.exe

Unexpected DNS network traffic destination 30 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	discord.com
34	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3416	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2045521122-590294423-3465680274-1000\{A0AB81E1-3643-49C3-9940-8877DE536DDC}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4864	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
3616	msedge.exe
3616	msedge.exe
964	msedge.exe
964	msedge.exe
4112	identity_helper.exe
4112	identity_helper.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeDebugPrivilege	2704	Bootstrapper.exe
Token: 33	4164	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4164	AUDIODG.EXE
Token: SeDebugPrivilege	5076	BootstrapperV2.06.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
4864	vlc.exe
4864	vlc.exe
4864	vlc.exe
4864	vlc.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
4864	vlc.exe
4864	vlc.exe
4864	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4864	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2540	2704	Bootstrapper.exe	86
PID 2704 wrote to memory of 2540	2704	Bootstrapper.exe	86
PID 2540 wrote to memory of 3416	2540	cmd.exe	88
PID 2540 wrote to memory of 3416	2540	cmd.exe	88
PID 2704 wrote to memory of 1712	2704	Bootstrapper.exe	90
PID 2704 wrote to memory of 1712	2704	Bootstrapper.exe	90
PID 1712 wrote to memory of 1444	1712	cmd.exe	92
PID 1712 wrote to memory of 1444	1712	cmd.exe	92
PID 2704 wrote to memory of 5076	2704	Bootstrapper.exe	95
PID 2704 wrote to memory of 5076	2704	Bootstrapper.exe	95
PID 5076 wrote to memory of 3616	5076	BootstrapperV2.06.exe	96
PID 5076 wrote to memory of 3616	5076	BootstrapperV2.06.exe	96
PID 3616 wrote to memory of 544	3616	msedge.exe	97
PID 3616 wrote to memory of 544	3616	msedge.exe	97
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 3924	3616	msedge.exe	98
PID 3616 wrote to memory of 2536	3616	msedge.exe	99
PID 3616 wrote to memory of 2536	3616	msedge.exe	99
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100
PID 3616 wrote to memory of 2380	3616	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.06.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.06.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/8PgspRYAQu
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf38346f8,0x7ffaf3834708,0x7ffaf3834718
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4152 /prefetch:8
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12030807020558716058,4371853039180410992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4ed2a143b7e82a4bb77c01d384f9a130

SHA1
837c2c6812866a5cb687188072671c714ced5aff

SHA256
2279e82e4eac3d5aa1bbc9d77f70fb831f7c575de4db2acf325bb3b9fae28617

SHA512
179f2e8cf6c5914f4a76cf1abe95862f91481619201403f23be8c783a3af68e41453576a49d2fdf84351db1d4fe63a38d9568d98cf6c244095470a4904084c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
768B

MD5
fa89ca012a4eb52778366b6e2cb7b6c8

SHA1
27d59fbae9afce483adea13f9b3150e23e1b7b8c

SHA256
0f8a1d2ce1f1b4a234829ef43d379ed5b9b56f27b26501e2b547db1718ee691d

SHA512
282f91644b4dc5675da293609cd1b08d9fb9775f78694405f977f8c7c515eb107e0732d93e626f32fc0ef720a033bf6933bdd8abfd942b7cd06a72a291fab32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed9f0edc27b9d96b6fbf37b92d592698

SHA1
f04fc1bd587595434a24a943c4f76657bdb02e2f

SHA256
f8cb793ab1ae084f390816625024c626ecbf205f408ed52a1038bbb930b5d614

SHA512
ba7b28ea696cfa57018555f7497819dd817d08bfcc328f77c804510b1bde686ec925fb8631f9fb95028fe4fd0760bee96edc2c087c22621fc94a7ff1dbf958c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b479b34f18c56d653cef147240c31660

SHA1
612948ce6bf456c41cbe8f83994960f1c7b01b5d

SHA256
0a242fd9a263a04304f7ca9ad385567c91bce4d25c6580b71fdf7310a9eaeef1

SHA512
eb8a76b0be9420184a1ce155f36bcd311958935e5956c7b9320a76889f6ef0a3b69c8d06024c75dd83920c1d248f01d7bcf7ef511864ca5d09ede8a674a7668c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45cdaf12f7dfc54179f9d930a5306f0c

SHA1
8883eb580eaa755724524c5775b1e626dc652b23

SHA256
5c0242dafd59dbfd60ab650ae03674b6eeb88c4419d76d83818f9f3c168fbf2f

SHA512
c5909abb0112a346cd00a66ad3ccefebec072f578e0d234e172e43d820cdbc9a858cb34cfce4a7d19dcffdd3463ef4e4203df65f0cd4094f74d607b031ae64de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f9c18c1947e72a8a5f3c5a5500d4200

SHA1
469c173ca37f67bea5b06eea42826fb8872b8826

SHA256
29016cf9838d9fc7fc7000011320ad80341260fb6b32fa4eb36425e156c736ea

SHA512
f334f71155e0f188b833a410f0176b39b47b5e26f2c686049e3138064e08d620621eb9d8e40117b853e42dee12e3ba66c0dbffc804de3ae02243426ce15e8167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
668a8caa432fdbd36443e7b7231b4df0

SHA1
9a41689da2981e9cb4ce76f702c721254c4503f0

SHA256
6af55d0ca0194ea2712e4b7f6438417c5657c0de070d3165db1c92007b3f113a

SHA512
913a4003f10d4ba63ea06596843818eb363791b281b9b32cdb1bc5b0ebe58db781f15ff890e789310f2db678abd344a7a201b058d8d5b0e247ed76a0847450d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fd40f52df7a065c07a2dca64ec0630f

SHA1
8f13841a011bdd633b78d04bdadd18ba1fc54a85

SHA256
b00a7889eea59b1a231b28ad24c28fc92030d2a37423b8ea43628057eb46dfdc

SHA512
8f0f6a08df5a7e8742efcb8834016fd607bc4edc1ca971099fd013a82fe8e3ac764e3414de15ca347a3ce60fde0e11faf7ae1d39a8d6dce6927a2254d4dd25bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5963eb0fb191d53b0f2014fa149939f6

SHA1
569e4b379f308928795ec15e93c22cfde42c4263

SHA256
f49c02dbe40a49d2521827a70fc7d60b70c4505b9a57b34092a309ffb16a98af

SHA512
f1fad5e70146f4efdff1194c5277f97793a21ea3fc3d5db6649f53eace280e7ace5170f24a897c35b87940f991ca2a13f9f4e1f5a4265643014ff4de34b55abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58406f.TMP

Filesize
203B

MD5
7bbf67a3b9cbc9efcdac498480f69e9e

SHA1
03e591471629ec4d68dec0379301f638a99e3125

SHA256
08cb21eb8247d31db07e48a6462f0b9d74393e8bb633a7e88ff5babaedb86ac5

SHA512
b5d5281884328fa964698f35d4d50efad186bc20a1532f338e24e6e43cd37905031d0699889e8ea94d7cda24cf49738ea35d61160048439451bad3a9f2c0b15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24e24ed7a5fbb4ae779fbc9120f23758

SHA1
f9bf74340116c78731283b19057fc3f47691e22e

SHA256
d99f94d3bb9909ada71e5c802e5552933b0c3c9b44c31af78e91b4e134b23f39

SHA512
b75a6dc4de372e6ea468889807f964616eb3f3cfd73fa1d440b438067be5020dc532cd256621d168dc5bb974debece0fecd3a46c21ae7f191c02164ccc377a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6bb9ca4439c326f89622e3da6bf4598a

SHA1
9e0310c55360e2de99437e5986f6862f00ab125b

SHA256
99a9bd6c3cca0d68a9b249d65c6363c4272c09b09551f4a36a6a243215a5f992

SHA512
e9c11329fc795d0c1bc9217c9bf3c573e165d5b99867ef67ef5f03462b689f76a2b1f3e4eee0baabfed53112f42e0f45aa12bef3340846fdf673660163178f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c1a4a6cd6466662ab96e8730326529b

SHA1
be9f9f9ad1834e7269a09a08133bdb7c61685178

SHA256
2179743fe1c5bf129c59bcebcfe9e85ae1aa8d6a646facc4e037aab1af50a817

SHA512
4298d792bff79c05e343b04ff7bcbd1cf0a62c66725bc603ef89ce984a09361c2bb2d62cb46f370e0aef52758653be4d6c2da4b72dbcf7903fdf2240a9a97af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.06.exe

Filesize
2.8MB

MD5
39e8df24e97198e03948922bdb59abd0

SHA1
c1e47ef7f162f4eddb42b561cad5814688d36dee

SHA256
8c2ce489ff740b7075fd4e683f239acdec314f87325ed3a3c62161c7d8fd9c9c

SHA512
19041682bb30346f0402bb967faa39852568af9a5c9f8d7be4154b0f4c3db4e75a36b0cce235a7b607e263e6870267a72f2d82ee1b3aef7ce1a9eec98f750551

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2704-4-0x0000019F24230000-0x0000019F24252000-memory.dmp

Filesize
136KB

Download
memory/2704-2-0x00007FFAF29E0000-0x00007FFAF34A1000-memory.dmp

Filesize
10.8MB

Download
memory/2704-0-0x00007FFAF29E3000-0x00007FFAF29E5000-memory.dmp

Filesize
8KB

Download
memory/2704-1-0x0000019F23C90000-0x0000019F23D5E000-memory.dmp

Filesize
824KB

Download
memory/2704-20-0x00007FFAF29E0000-0x00007FFAF34A1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-558-0x00007FFB061C0000-0x00007FFB061F4000-memory.dmp

Filesize
208KB

Download
memory/4864-560-0x00007FFAF2420000-0x00007FFAF34D0000-memory.dmp

Filesize
16.7MB

Download
memory/4864-559-0x00007FFAF3B20000-0x00007FFAF3DD6000-memory.dmp

Filesize
2.7MB

Download
memory/4864-557-0x00007FF602F80000-0x00007FF603078000-memory.dmp

Filesize
992KB

Download
memory/5076-26-0x000001F955790000-0x000001F955798000-memory.dmp

Filesize
32KB

Download
memory/5076-17-0x000001F937160000-0x000001F93743A000-memory.dmp

Filesize
2.9MB

Download
memory/5076-23-0x000001F956230000-0x000001F956330000-memory.dmp

Filesize
1024KB

Download
memory/5076-27-0x000001F955810000-0x000001F955826000-memory.dmp

Filesize
88KB

Download
memory/5076-30-0x000001F956340000-0x000001F956348000-memory.dmp

Filesize
32KB

Download
memory/5076-24-0x000001F955760000-0x000001F95576A000-memory.dmp

Filesize
40KB

Download
memory/5076-25-0x000001F9557E0000-0x000001F955808000-memory.dmp

Filesize
160KB

Download
memory/5076-22-0x000001F9555D0000-0x000001F9555DE000-memory.dmp

Filesize
56KB

Download
memory/5076-21-0x000001F9557A0000-0x000001F9557D8000-memory.dmp

Filesize
224KB

Download
memory/5076-28-0x000001F955780000-0x000001F95578A000-memory.dmp

Filesize
40KB

Download
memory/5076-29-0x000001F955770000-0x000001F95577A000-memory.dmp

Filesize
40KB

Download
memory/5076-18-0x000001F9391E0000-0x000001F9391F0000-memory.dmp

Filesize
64KB

Download
memory/5076-19-0x000001F9555B0000-0x000001F9555B8000-memory.dmp

Filesize
32KB

Download