xworm | hxxps://gofile[.]io/d/dmXlFM

Resubmissions

28/02/2025, 15:56

250228-tdkd7ssj19 10

27/02/2025, 00:02

250227-abmxrsymv7 10

Analysis

max time kernel
960s
max time network
964s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/dmXlFM

Score

10^/10

xworm discovery rat trojan

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d91-78.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
49	3756	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
103	discord.com
104	discord.com
102	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-100612193-3312047696-905266872-1000\{AA93D258-C3F4-46BF-8B4A-0D3786AA3AE7}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 230258.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
5780	msedge.exe
5780	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4732	4756	msedge.exe	87
PID 4756 wrote to memory of 4732	4756	msedge.exe	87
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3116	4756	msedge.exe	88
PID 4756 wrote to memory of 3756	4756	msedge.exe	89
PID 4756 wrote to memory of 3756	4756	msedge.exe	89
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90
PID 4756 wrote to memory of 1256	4756	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/dmXlFM
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb88d946f8,0x7ffb88d94708,0x7ffb88d94718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15308608878423644488,12609990789690886470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39c51e5592e99966d676c729e840107b

SHA1
e2dd9be0ffe54508a904d314b3cf0782a9a508b7

SHA256
29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3

SHA512
b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e376ee2f541e6b1ed0bca701e8fb59

SHA1
bfe3cc2eed8721339d433533aef6e18e0a13a9a3

SHA256
80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04

SHA512
a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
a885891768a2561d6fe275cb9a7dc9fd

SHA1
8a30bc38affafd749d2ab3075418e5bab5e79673

SHA256
921fa2ea88e3f8937e07b79354b7df801184bc1793710bc9d2b599de52d9b0e9

SHA512
f60711206eab223d77239cea471f945e8fa13790cc7368b0df40954d0eb89134c18321b0d6134617dbbd13c15fbf9c6bce96a03e1fb7d53b19dbd07e81af4ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
889264910c6a938059111bb928d5378b

SHA1
666af9930cbcd7038ad05ef03c0839c2874df0f7

SHA256
6c5d38eaffd61800b2ec5bf5c90b93746e1fc37090df41abce15d1db98af1716

SHA512
fb69a9a38a504e64d583a2d36a78375662e58ad9278d74586065c4e67b97ceb8543269961bfc0a11b86067af69829141c66ddaadb55c622fabcfe85d1df45081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
761808fca1b3a5334f32854390f7fb2a

SHA1
ad4f158f79e14131062592386ab68c1420f4aa77

SHA256
5373746235cd913be5963b9ecebcbda1a0c0bb8d04c1926af9e2db2cd6de6cae

SHA512
196dde37269bc3e66e5e9bb12eed70d7606d318b2964934e9cb2d21d8a40d6bac0fbd43e8c91f857e899be80dc9033caa61a3ab178a13c0e0c845b6092add71c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
deda1f50e6bae64dcfd32f8f60bff4c2

SHA1
7aca94c618d44a4ec2e80bf2c22c39dfac33df3c

SHA256
afac8e2883800e0940b1f14096ef31e9bc3baaf2ad4cc68933679bd5db7e599d

SHA512
a68e4f7fb3da39d5cdaa31d641389b82a02670e81b1a3192f9ba6cf48f040d778509407b129d9223316c0a27b5a00b526a31f7e8ef32648e02d9f6b23ed1bc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5d01f1f4bb2385b1ebb4ca50d70a0408

SHA1
4424986e468ed7084752d48ff64d89986db0e249

SHA256
f189dddcb4ee663615b845cf076d634e82aa3c20c3cd260fa6c760141cc1175c

SHA512
79d3267c552e88dbb12bbab8205a8c2256b9a0541e304cad91cbb3a842614dd298bd985713fc012b8e1bb112a4a580dc333a979b79b9d77efc61ee13147c0bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2c96ff491c3dc0ce97b89e5b8f0f8948

SHA1
da11b15619f46dfe506764114295bdb42871d556

SHA256
e65e6400a5e043fd8fadaa42bb4fb37bb65f35502e348ec8008457a860304c9d

SHA512
6613147b894362529a5f1dcb37e3addaa697e87c8c01af8b6d8c59dbc6425873d5d5bc7b54766032c176590090dad261433417982769feb9c0ef7cee75b44a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
904B

MD5
1ab5fcc8f11815e0d64b9bf682559d3b

SHA1
09e91a3015333140da571028ccaae8b034113386

SHA256
3a69bba30bcd6945bd5b737a5053b02b56001b16198541b7e22e74f426e2b7db

SHA512
fe2184fe8c52f7badc06179e31316bfa7e5c6669971caf63dd8961f5724a5a94839a9e184643edadd4ce659ed478d41727c3e76cb2810de9f6cb25a22718d751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83ef9d270a54612dd99e0f16b2466a48

SHA1
3597b613d130efc3ee728d9ac6f6ee5b20be53f2

SHA256
3eae8c291c58328a808b731ed3a1359310396e94b57652cd5558b78f933cd6fe

SHA512
1e0996186a7a5b1f149a4610322bccdcdd8204c7856dcf700380be82e2449b2dc5c1e2a93527f06cacd1f9052ca4ccb25ae2e3061b48c26819a80d86e04082a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5dcd73ab318b217f37a1ac37661e5ece

SHA1
e248600cc841ac32a866ecafbf4f495c526aaf79

SHA256
4059faccc7ffc26a784ecce57f041ffb61c3ce8af7d4e3343445b45f6e991536

SHA512
aecd05bf37e94e2fc331c32c6fb0996930267e5981b9ae3782ecb6973440ee4c74ebf0d28a1da1af28e2478328accf05c38840316a3d354264485be2219d4eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05ea979d436e6fb93aec9e085571ac29

SHA1
bcd5a70840a29eb39a907e29886219c5b5765a4a

SHA256
bf4c820cc9caade3e832896b8bad0397c677d80d529e3e40ac7430eac9fc9451

SHA512
42b085b0bad63f3408cb56bc10207b6a27ff333e98668a701e5025f5d30029d0fd34766f5a000065122762b845ae5c4f6ad7095d8ae7ad3889a68b20c8992faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65772ae6a3b2b89fb4bde9fa7f91da78

SHA1
fb1da0944da362ac42597ec1c9e284077d5eb46b

SHA256
3cc14e6539e3dae9894787ff195158977ef294675e46c05e37e852a67a06d2f4

SHA512
1ca738f6740618c0cd43cbd3228ca36b5eab481be9ac260bf697cd5627cc939017478d1d5b57717c145147e5a9b2f0dc6d16b472b21259d0016db867e1430c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19e4df3bdacfdc91e8d27031b9e7a5c0

SHA1
baa168e35851433a34c4850600e65a1434145462

SHA256
77cc5fb24b8efa428cec31fdec44b745cf546d3d91adbfe94673ad8d6757fccb

SHA512
43f47de2fc1666c79e1f115f1f70bcbe1fb24522b85271d08f88527297febd563d7dd6eea87c198164a4b7de1010687c273992b25f82ebfb23baaf123efd9239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a749ee6f2aaa7451ef71990fecd41ae9

SHA1
51166b060b338a12bc4b5344d453b29bb74b6ce2

SHA256
8c28265d73d3efd8d858e016d48e4fe9b281815af04b3e90d5dcffcafa7bf4b4

SHA512
011bf5d04c3e2ee483523eb263dbc5f29c722e5a5572f9368af47a4d8cf79c67f530857155066fab2fda8b86fe274ebd31378eb6b059f8ce7d746afb476eb788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cd70d064b4ccea0d6de843ee520f6612

SHA1
17523b28f2287186f2081fd1b4a3e5ec72033796

SHA256
0d3ff5a5632a6e3da3e0d4fdb5bab8af089cd8c2f0634f52310c21b853b5037d

SHA512
ce8b908e883a09c070b91b19782f32d2d14d04e5e1b88a231a25ed1a251aa73a6956fc38f606f70e86560f13f1e6690b8e3f9660943b6967cc64e9dcb0b73458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
747ecd7a9768b4dc2814a0fd9a82a513

SHA1
13efe2f350b0144c3cdb7d26c7d8a33d8df3c69e

SHA256
bebbf2fbb3337e4c9c061afe722593120c98568f0453e9a16b711cbae736c35c

SHA512
bee0857bcd3b36f90a1f3685a26c93cd1d4c5072facc72cafd8507ff36bb43ad8883fe0bc886c108c3b75395578e351c13611a26e964125f201ac2fe4668b4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
33798ec02814e5afd6bddb49b21cd1c7

SHA1
f3564d47fc987accf86f57a960ec28c9bada192b

SHA256
595578fef8f722a996922c20ddea0577c96fc8c1fc479591580f41550422f11d

SHA512
748437b21bfd7dee5e08182187f3d08830a1b56be8ec6241f89288a90be87a84f3e301cb425259f7ff8957fb33103b0d0bedad6f060cf99cb29d088ef730d9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1a8fd3dfdd3e49e22260d62e7089c0bc

SHA1
abe00ecf87f8353c8a2f4ddfa70e0d9886e9bd8a

SHA256
7506a61427ca1f218fb4a787de3428897647cde5e469eda03f4b9c4b1ec7259f

SHA512
d0aaea368af4b3b9ff248c1b0093ea21bc114e7fa8f68868dd65fd75d073c48f4a1078fe2db8151aa16eca801aff81a4f873318e89efca0979d1b655c94a275b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
4e8161084da1b6a1b535ca55858dc575

SHA1
d89d1557bde18c8c8476465838b60238dd824a81

SHA256
0bc06d7ab5c77e951d30f35d1656e3492f82bfb7ce136f5213f2b6d2e1aca17d

SHA512
cb737ce63347ee933a2e8fc032190acbbe11da55c03deb584f6d87855574318d18d20662bf0105033e3f99baa13b2b8296ef2b9130aa74c00b3ab0c2908b9ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587133.TMP

Filesize
370B

MD5
42816a4fa4386837e55e507b5690dd03

SHA1
401e1e0cde9b4438beba20ab6f1af21273fbd9f2

SHA256
6f7995a612fe3a5fb6e5e8418ae5c5e92979bc35066149c2c3a9c14b16c30655

SHA512
ebfb6e5d83004a2554733b265d4fd63504eb66b93211b0686e14c46c74d1611edc0339ddd704d28976fd907c4ed9c209f4eeb711a17f303441fa4a6785e6e05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e3fad1a9077675e76492e111445a06f

SHA1
5e87d3dda3a7acda39264bc92fd6def8605247af

SHA256
6daad5ded91f61fb19c4bf68fbbc9186acf0c22443aa5a07321a6aa02e4b3725

SHA512
c8f08dec634c9a598afe0adc764eea6afbb1ef250cdf90244d481ecf7b918cccd1e2e038ae72b0071d7a08d836f87f237087c3cdb7e0bda3705ec017ced3352d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdf2777ae1e2bd0afdc28b4eddd2c413

SHA1
9d4d58165529b44f8a50b1082cb312b8fc8845dd

SHA256
1571f7ff08a753514627ff24c4dc70dcd7d3e503dacf3766c0346441b3242084

SHA512
54f747cb3391bb59792a23d31f8d56d326daf3e1942893903c2a6df736f7400ca15118609120d8fe3da77a44171ab316cca1c9d851b5c33c384f1e426a17b9c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
80041b9b8d8181a83dee8e8558808629

SHA1
d6d60e5a900bddbef6d4a77562f2c8366d2a0bc5

SHA256
37ab5ba1f3850b00f57a3f19ae9cc9353063b149472b0b7f1ff6c94a9876c764

SHA512
e5c804cfb6a70365e0ce09495482d5a99a27f6d6cf0bea8611c8bce5a48073da54ab91b580fae3f16ac38d8107b78053850ae8e63db22e51214e651e1cce8837

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 230258.crdownload

Filesize
90KB

MD5
089155bd7fe0036d253cb868ccc05c7c

SHA1
21ef7fc422c7746e743178706d4425687af5653c

SHA256
ac2499041f86963a7a87a112d832ff8a4ef970b611c0925fc21b141649c74572

SHA512
af687cb980644ae889615e85a198fe8e62c3b154e4d94d98c8dce0f7e10c60773a99020aeecadd1c939f338508541bab0672ebd65d8ac2a0116aff89ff92ce5e

Download Submit