16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
208s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2025 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
20	4612	4363463463464363463463463.exe
26	4612	4363463463464363463463463.exe
37	4748	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	PowerRat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4740	PowerRat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2168	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1560	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	4363463463464363463463463.exe
Token: SeDebugPrivilege	1560	taskmgr.exe
Token: SeSystemProfilePrivilege	1560	taskmgr.exe
Token: SeCreateGlobalPrivilege	1560	taskmgr.exe
Token: 33	1560	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1560	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe
1560	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4740	4612	4363463463464363463463463.exe	92
PID 4612 wrote to memory of 4740	4612	4363463463464363463463463.exe	92
PID 4612 wrote to memory of 4740	4612	4363463463464363463463463.exe	92
PID 4944 wrote to memory of 1932	4944	msedge.exe	104
PID 4944 wrote to memory of 1932	4944	msedge.exe	104
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 2308	4944	msedge.exe	105
PID 4944 wrote to memory of 1964	4944	msedge.exe	106
PID 4944 wrote to memory of 1964	4944	msedge.exe	106
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107
PID 4944 wrote to memory of 4008	4944	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:4740

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjA3NjA5QkItOEYyNC00OTQyLTgzMjEtNTMyNzRBNjI5QkM4fSIgdXNlcmlkPSJ7QkI2MTM2MjQtRjEwNi00OTlBLUFGQkEtQ0Y3RDVCNTk0MDkyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODU0MjBENUItM0ZDMC00ODIxLUIxMUEtREJBRkVGNjM4QjlBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODQ5MzU3MDA3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2168

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff84c8146f8,0x7ff84c814708,0x7ff84c814718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,5249424834393412100,10320691427028203822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91aff9098a47bb8e012e47e54f6bceaa

SHA1
7993f5174f54489cac8b04c1356b7b47da944202

SHA256
cc46d5631b8526010ae5e52980fe9fd9b38c4cb27f56cd524b321ab091685cbb

SHA512
184defaee159dc93c128c5a7a2ce15e9cbf99bac58ea2372642c30bf6f1f52e178a110e0e86204ba65d82b7a7fd5514cbe7092daacceecb1aab6cc6a208e850b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a230789a90c3150dde7ed452a9b35a08

SHA1
e934d8dce045c99a5d4ce22d6e470f787ca2e027

SHA256
b754b918a9236857008c518409ee816120e5f55430218c03a7c9b2af56cdece3

SHA512
f258391b4cfa5f4b7537d15af1af661dc58926a63fbf8238fe564e9e80525fc3b4b04719611d1619e036f56808c460363205ae06c835570b77f97b31009371a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d0c15bd598077d38154ac3744a4cbe6

SHA1
b8f9130ba6aea74a42f47cb821eb83b2ae846bc3

SHA256
d3ccc00537684165539d37289ee8310763470859b320a2482ccab01f08b49666

SHA512
40b054f4b59045aa101c487946c208845be2996e97afaf9ee89103ece7d9622123bc473f64c660aff4c4421f557905d4860db83a633bbf6037d9f4c7bc1a4939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87e2477f40c6393e46c8dd734fea36b0

SHA1
55622e19f617dce304b2acfa1158d2039a16278e

SHA256
1e19b7541d5303d9c2482798162c1b3d14d3a3a1a6dbff9dcbbeec3bdc77abba

SHA512
9da3b734b18fc59f7d282fe232086a99a8a20caf4f4dc771dfc7588061bd0b0303de46f1fdb498c93164c52582420e428de26e5e08e41ae61f726d16fc7ab651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3346761e290fd88c2339c65e7d1dd84f

SHA1
68e00561b4a454bf45b62d32268490a63e55f0aa

SHA256
3de2e69d07b44514c2cc6cf7c5b4dbe4d896b7006ce4911ba80647d7abe4ca4d

SHA512
33e45ceaeae23975fb9d7f85fb38ec26fbc5194cc9e3209d901744895e88aa48ede7ccb4574c69c894ae9bf893fb74b4d7d9d1a8eaee570eea9e9e3b66889639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe

Filesize
463KB

MD5
f8a989ff9bf3894acb35c791d053cbec

SHA1
afb3cf59d939b5be709ed23d8b424987e618dbe4

SHA256
d417caa99ea8b4f00e4a6cc324a7901dbfddc0dbe19de513bcf4e84ceac90d21

SHA512
8dc32c1c7b408dcb8c95838d96ee711acf6157ae54fb44c1f07834eeec9618977ebdbb134e27c2663593b3372d4855146f5e24f4df7ffdd6f5028c0818cdf01b

Download Submit
memory/1560-35-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-30-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-23-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-24-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-25-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-29-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-34-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-33-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-32-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/1560-31-0x000001D9AE990000-0x000001D9AE991000-memory.dmp

Filesize
4KB

Download
memory/4612-0-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

Filesize
4KB

Download
memory/4612-5-0x0000000073B30000-0x00000000742E0000-memory.dmp

Filesize
7.7MB

Download
memory/4612-4-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

Filesize
4KB

Download
memory/4612-3-0x0000000073B30000-0x00000000742E0000-memory.dmp

Filesize
7.7MB

Download
memory/4612-2-0x00000000050C0000-0x000000000515C000-memory.dmp

Filesize
624KB

Download
memory/4612-1-0x00000000006E0000-0x00000000006E8000-memory.dmp

Filesize
32KB

Download
memory/4740-22-0x0000000073B30000-0x00000000742E0000-memory.dmp

Filesize
7.7MB

Download
memory/4740-19-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/4740-18-0x0000000073B30000-0x00000000742E0000-memory.dmp

Filesize
7.7MB

Download
memory/4740-17-0x0000000000010000-0x00000000000D0000-memory.dmp

Filesize
768KB

Download