4f07343768fa1159c166497ad325f6c252d15236d98fa1e8be86415939e94bdf

Resubmissions

06/03/2025, 23:21

250306-3cg25azr14 10

06/03/2025, 23:18

250306-3artjszry2 3

06/03/2025, 23:07

250306-24e66szqx8 4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

profile.js
Size

113KB
MD5

d6dd31741815a84eef01da448a52dd54
SHA1

a5b965a0cb74fc5c1cf0fa5460f7109c2bc0f271
SHA256

4f07343768fa1159c166497ad325f6c252d15236d98fa1e8be86415939e94bdf
SHA512

bf97f5bf8b0db4457db67963dc667e15215d86fea294d99bf9ee666b7a4fb1d1a74482ca05fcd51638ced1807f73019eead6c41225282e0638864cca2410bddf
SSDEEP

1536:kxdXYb25o211qRTd5w0EwVyyhAVPynhOPRmHbju2BcJWdYWS/Rn9T:kdXYbS1ynhO47jlS/R9T

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
696	identity_helper.exe
696	identity_helper.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1548	428	msedge.exe	101
PID 428 wrote to memory of 1548	428	msedge.exe	101
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 4340	428	msedge.exe	102
PID 428 wrote to memory of 3344	428	msedge.exe	103
PID 428 wrote to memory of 3344	428	msedge.exe	103
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104
PID 428 wrote to memory of 4668	428	msedge.exe	104

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\profile.js
1⤵
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcbcdb46f8,0x7ffcbcdb4708,0x7ffcbcdb4718
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15467728687053265220,7835151070117128796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39c51e5592e99966d676c729e840107b

SHA1
e2dd9be0ffe54508a904d314b3cf0782a9a508b7

SHA256
29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3

SHA512
b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e376ee2f541e6b1ed0bca701e8fb59

SHA1
bfe3cc2eed8721339d433533aef6e18e0a13a9a3

SHA256
80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04

SHA512
a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a58666e4e6c190b7d9fe5c1dcb51dd14

SHA1
a92d690975d3cd6d7bad7c7b7386745e34c285b7

SHA256
d0624603012874a9c19e5cc09df1e331f88f56e7b47d1b6127b97c8d04b470a1

SHA512
5dd9e83c8c8582f098321ba82f8c7f33941ae9f43401e9a43ffeef983bbf8fb708f6c97407344168f14b0dfc21f12aa6ee31412530a4ef5655abc6f506109133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
355081cd8e9f71cfb28075e6487dc51c

SHA1
0e5812543406e6f04a7813dbd0ca5a5f836b5e4a

SHA256
4a6a33a928ca0745a0d5f9463c472a765274e03499bd5d67ec97697b9e23f77c

SHA512
df9e531ed1da97bc75a735388460738a1f0cb75753ef10c33561d127f89b253e46cff78fdcd2cfd94ae81a01f7173d6f3a3497a4a24fbe6558fac4ebbb19ec2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
48f079e4faab439c44d28c40fda20147

SHA1
593448fc80a7c3577335c39866db65e2887fbcfa

SHA256
f723019a32707b7aae6a7992ee00a7518ce1b9282abb1be22f6995771dcd3153

SHA512
a5cdce221165d1c6b19674582999a050ffd4db0775eb6884d287170a6909e54c0c5639192397cbcae2ea2a52a4412bf5652efbc5160e796299f411fcd5dcc831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
01536f43cfa0232ae9ee3b879652c94e

SHA1
44f1c75f9cde135eb7820dd4c5fe216178b40005

SHA256
3620282482fac04fd506663c7d3a1683098d4982c8e1ce075a7a42b4da7c2bd3

SHA512
e38df130ea1c64ed3869797af919c672384e7b806dc21ed9a6b094ce1c42cc2067bc297733ad54462060b56a4e0bc7b41cd4e04bd7fb497836ece57f5923411e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3e7f75da64e8cc497f1432d52cf752fd

SHA1
2dfd0be23de67f6e96367000a1accd585122c03c

SHA256
39b8a24fec7618dbe6eb662cd3a88b79071a5422a3ca0401e2939ac9132e2207

SHA512
059162c09162cda5550df39b54dfe1c1d67eae4c0a4e462e29b899d251bc33dd9d32a75f53775d1ffd90e72f887ae15d81e6b6187144e7f858f27f814d1a97e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b97ba332c18ecb811954ae878b522be3

SHA1
1796ad6da69a935d4666ac3e43ede9eafa6e422c

SHA256
46274c615bc917463420e4af330c1cf9510611eebc1f0b625b4464672b59af37

SHA512
5fc49fa120573d657e77000de9066be80b879f220c8f586ad1e2a8ff3c15bb2594a27383e1bb5fdacb65d779911ea555e639a3c18ed1d041c6893aadadfc6127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6aa8d078e104c1f0a1281453ee97938

SHA1
088af04270d4c9e7ee81362b0e7fb0e3589bb18c

SHA256
6fc4ea56067c06c4deae9ca0a27c316f99f5e98555759585cfe9b836faadad1a

SHA512
5cffaabc7ad8abe6cde3b20596e1c4baa6f19f9d32f5f1d284c274a264dd9d1c57bcab4842e6f5d1aae023a738576210dd02aea0bf43500097e3c310a5d04594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66b56b8a3f5a5f9578058569f361ac17

SHA1
5af00c6c86e0718ee6c9e8d7d6db7fe4cb58f995

SHA256
022c73703ee03287ae440640dc6b73f3d165609c6632c1019a2666a823773a56

SHA512
1398608e3640c7f203552d890a81fdcae34b1e1504595187f2f1d8ece202e6cf384309fbc11c6c19fb364c03e3846562847f83811ee98d24f263e67987a509f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef280d0a91d9d7de4b4889c7303a013f

SHA1
262aea0474c27520d0faf952d8ba5e03f1976940

SHA256
58a7c546da33684c0b12733443b76c8d9758c039333ea337a98d45e6784cc288

SHA512
63b7c744d3efb790292ebb5568bafb454dd9ece804c0b1a9ccda41cee622d91347bf65d1718e35585766697512551c5e845f8b1730f84122a13dfac2184d7e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3d393f2d2bd5a602cd86c69b11d72a2

SHA1
4068eb1540c7c806ccc2678e21978b3b7f798115

SHA256
1dba90c75e54e31664b574b0c07ca10895832cf963f05101fbcf2cf5eccc9cb0

SHA512
abf9d8276261e07630940a15c680099069c8fbba053fa78a395ae5ec330ba34ba2b355969dd1dc6bf07fda2c575a1809453625d5303fba1dc0f7cb4da3effc71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
a8d4608f28ed239aa2a8304f2d6f3fb8

SHA1
848f9c49b53f32a881329d073c5b50fc4ae34a0c

SHA256
4cb55f956ac262d7ebbf7d1dcfa6c2dafea859d3a2089f408bdb9733e92d076c

SHA512
b85c67676185077cccfac0ff4131a8366540b9827b1784eb092fa8f899e634da02a5a7c6e2bbd9bac2f5f5c6ad998e5d56c2e2dc6a285480c751985c01721244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c814e243b0f49bdecf00ad2a5a1250f4

SHA1
5e1e5c971a0ff9333eac559adfcd88121223b2ab

SHA256
f86929ce48ff70c224017180eaccdeb5263ba604a38aeb6d7be250d3dfe0373b

SHA512
c72870f05768a50b112f92849143e5deede47e3b0b69e5322c7ea9fc0ee40dc6c3cda5fd8412d0bc6c764ad3cee03e12d6763392fa68f7cf05a0784bb1a9c178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b87490933e8b094d537d011d6a4dfb6

SHA1
ec5d8b49e8adc6e5abf21a6ec9bf2eebcf403865

SHA256
72e0ad24c4a71ae137310064d31fa5938cf3c1c6d19d686853f4b00484b08212

SHA512
57541587a7383de085c6c871b0d7af77e3c14d723415bcb1c82ab43433dd6007dadf14c910a499eca93fe21b7721b8a4060f396eaf4739b7773cc456a90ef860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c853a5bdc70ea5bcd070d1fce337c67

SHA1
613b85d6a06a50acf633f7e613b0b384d00f73d1

SHA256
b8d754a843d8b6d445f9ee57f718752142ace816b37593057ced837e01339c79

SHA512
adb77fb177a00f972e1d038ca88600e6b57876031945e01609b6ce72a2da327aa5322d04fdd017d9ccdf89a306d563ecc0bc035e9b95e46f4d694281ac1f686d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eceb.TMP

Filesize
1KB

MD5
ba2b225cd35a370b60af4b1b8938a682

SHA1
b9f24a29a5cbe6d0f8be252073f1e7629e6457a3

SHA256
df0dbd78d189166a67b487cedb67a3a9bc23c3e357fd3a1ef3a20afaa718a4b8

SHA512
efeeb3fcb717d8a67928b9c9bd9f67e3698722a34a41e464faf5f2cdebbc690b82b62b6a6e19197a0caa19ac6d9f7e8ef9dcbfd45f1f8bc0a3d359f5ef6fa427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74b8c0f01457a9f88c17f53e8dd72127

SHA1
13086d71f73ae8a24e923c0f684b5aab8db2e94f

SHA256
10a79fc1e98f77a6ac6197c85258da6757d1b31934f2806521ae17c8bb82b4ae

SHA512
3473021fdbd50facf761f6c37092b728674a3ebc78b47409357ab475c2e544b9849dc832a1505dca21d1b7afd5b96b88973039fdb1b6ce188fb540ad2895f7fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit