Analysis
- max time kernel
34s - max time network
34s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system - submitted
01/04/2025, 17:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://myappstcs.com/
Resource
win10v2004-20250314-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target http://myappstcs.com/
- Sample250401-vmfcaaswf1
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\msedge_url_fetcher_3040_1513165943\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\offscreendocument.html msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\lt\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\en_GB\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\sw\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\gu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\th\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\fr_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\uk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\kk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ms\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\az\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\lv\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\fi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ka\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\es_419\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\fil\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\sr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\pt_BR\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\eu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\mn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ml\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\da\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\hu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\pa\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\hy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\id\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\page_embed_script.js msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\tr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\am\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\zh_TW\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\et\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ko\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ca\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ar\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\hi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\sl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ne\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ru\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\en_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\offscreendocument_main.js msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\pl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ro\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\ta\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\zh_CN\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\en_US\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\fr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\pt_PT\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\bn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\af\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\my\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\fa\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\hr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\si\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\sv\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\is\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\128.png msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\service_worker_bin_prod.js msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\zh_HK\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\el\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\kn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3040_1080231223\_locales\vi\messages.json msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880007791186216" msedge.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{EB7A8A83-5FD9-4DBA-9842-CC62B704849D} msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 6028 3040 msedge.exe 87 PID 3040 wrote to memory of 6028 3040 msedge.exe 87 PID 3040 wrote to memory of 5340 3040 msedge.exe 88 PID 3040 wrote to memory of 5340 3040 msedge.exe 88 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 2732 3040 msedge.exe 89 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90 PID 3040 wrote to memory of 4348 3040 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://myappstcs.com/1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x298,0x7ff96a35f208,0x7ff96a35f214,0x7ff96a35f2202⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:32⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2464,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:82⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3408,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:5344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4764,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:82⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4992,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:82⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6044,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:12⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6308,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6560,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6764,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6976,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:82⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7016,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:82⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,13711030826290509837,7350666219198029872,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:82⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:5840
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start2⤵PID:840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93
- MD5 df2d1721cd4e4eff7049314710dc7c11
- SHA1 f5aed0158b2c0a00302f743841188881d811637a
- SHA512 11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
- Size 216KB
- SHA256 e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b
- MD5 50a7159ff34dea151d624f07e6cb1664
- SHA1 e13fe30db96dcee328efda5cc78757b6e5b9339c
- SHA512 a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250
- SSDEEP 6144:iprd1ItBjbmy74npup6EFUdzziBu9u60ZNgxNrk1mP:iprd1ItknfEqzio9u60Z421mP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 107KB
- SHA256 b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
- MD5 40e2018187b61af5be8caf035fb72882
- SHA1 72a0b7bcb454b6b727bf90da35879b3e9a70621e
- SHA512 a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
- SSDEEP 1536:IRWH74CshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHNdRiPjU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 24a91f3be9bc0cc4d40f8594c15a1168293930a86229bc5a0a90c587f6617504
- MD5 2b13c3dd8837f400b1d49d07f4b27a25
- SHA1 707f304bf4f80e6a2fd851d56e617ede4a52add2
- SHA512 ca49c10ebfd6d1190147d0f1bffe94a2c15bf42ad009ea2c092a71263c3b5b8876655ca3e3572113fb3eb74f56afa698158d18b60a31cfb382717ae24aabdc56
- SSDEEP 192:sVXR1JyMqv/Ky0Ml8M7rsVcwJXwM/G9JhWn+FSzoZ8pSHo+WNo0ewmQQlkzWcIgO:sVXaLjrs6GXde0n7SHCMwskqAO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 c2b3644cc17a143076b4147283353aab18a7450391ebc34057da00b43b34a9fb
- MD5 bb0666e31f14bae18cbf16e2fe9985a5
- SHA1 ede81b6e328d1ac1e7c4e6b1832c689f624c70cb
- SHA512 688c75f0eb9d3871983392d6faea4e8fc9fb72a9495d30f62d0bf9eded215bc1f10eef065d133eab2026ff427887d793ebc32586bcfe586b7096448c02720205
- SSDEEP 768:1F57Xf+7pLYLp5OWF+iOa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuXY5LlJD2UGro8:1F57Xf+mp5OWF+iOau1jatXY5LrqU9mp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 22KB
- SHA256 93fefa7c0b42272d1892baa3b08d554533a5e04bef37175f490bb1b7777acc30
- MD5 f27357a3e8aa899112bbf6db1010efac
- SHA1 fb961a8b57194f96a71d317f89663d9bfe9594bd
- SHA512 b7e47c7c18653b3d973401141cb98f372f3c616b4e124eb560818338070d3b453850c32b422e582d5f0000119b28bc6e42927f00985fe8ab50467b33789303a8
- SSDEEP 96:FpKjOiKfDKPhspoM2W2a4uDM8aKCiq0bSrPMK5y/KzwKZGMKI9Q5NXrngLzy5Vgu:4NtZ/9Q5NXrn+zy5VhrPViv2dtzL681
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 40KB
- SHA256 282930427091d0bf6634c58bd7a8ff0a15c2dc47d8afd1bf1229dde2d79f13d1
- MD5 7262085aeda58259d745dfe796993a51
- SHA1 eb5cc3127c230c174e749b26c14fa0bee3a3734d
- SHA512 31f0d3ba88e59fa0a615bc06f2186be320fed1214542498e11e4581332f1b7ec61766c06111159ba50c4ee1c0b882361fa90dbf622b021895ed243bdb5deff12
- SSDEEP 768:3liE6esE8lDldUGz3rbgK9CQpiil5EcNKQKJ49+HS8c7NIdCLEH6nz:GeB85d73SQKXy8UqdZH6nz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 40KB
- SHA256 ecaece273bbdf021c7156aa796f1c5d9b511c0085642d8a95c3a47a226aa4cb5
- MD5 1c58a618e5860325ad4ef8d956241de8
- SHA1 33b8db9fe65877d540cb1b4a780d108b0dff56f0
- SHA512 8f8ed5e92da4293236cb9b2076b5eb954dc031cfcf4e54dceecb8ecf497162be3aa67a2a2118a3aa49e4b8725bf96c43a6d1eb5dff4351f5af718fb6af801aea
- SSDEEP 768:KliE6esE8lDldUGJ3ubgPECQpiil5OftdWCHdeS8c7NIdCLEH6x+z:veB85dx3vBN8UqdZH6Ez
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
- Size 152KB
- SHA256 fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
- MD5 dd9bf8448d3ddcfd067967f01e8bf6d7
- SHA1 d7829475b2bd6a3baa8fabfaf39af57c6439b35e
- SHA512 65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
- SSDEEP 3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 dda4465d29044f01965ef41051704a15080dc5ebffb4651e735d1cb1df00b091
- MD5 31fe9d9614f900b584ff6afe681d8d85
- SHA1 0fbd83cee468c0abc71825cbbc719e3be21f3e39
- SHA512 6a04aef43e0970600212c006cebea414c58688e47aae80d6a3bb5cd63a1d6cc9cecf4929dc5e97a59bff43b44baa57f724303b2ec2b395cba96b64c6fd1a004b
- MD5 SHA1 SHA512