hxxps://aliyedbjn[.]page[.]link/6SuK

Analysis

max time kernel
197s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://aliyedbjn.page.link/6SuK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045988481-1457812719-2617974652-1000\{9114049D-A0C9-43A8-B3EE-456E8BF65029}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
2820	msedge.exe
2820	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
1876	msedge.exe
1876	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4696	2820	msedge.exe	53
PID 2820 wrote to memory of 4696	2820	msedge.exe	53
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3916	2820	msedge.exe	88
PID 2820 wrote to memory of 3196	2820	msedge.exe	87
PID 2820 wrote to memory of 3196	2820	msedge.exe	87
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89
PID 2820 wrote to memory of 3088	2820	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aliyedbjn.page.link/6SuK
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd894546f8,0x7ffd89454708,0x7ffd89454718
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1432 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9221938157725898904,6596196434177711490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
22KB

MD5
da3a55fe173cf5614d9438f647bbd7ba

SHA1
601c1cc658845da3251d41b1125c35b47d556b8f

SHA256
063ec4a0e0efc41ada3e666fc20dd4a7882197269f17cc9f11cc3668d696d1fa

SHA512
58ef49514825d8decb5226986fe04873dd684ab6715e7500bf4f9b30971ab5262d2f6e73c3e18cb63bdadbc9ac59f8280e73e793ed7df6fc222519f949578693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
28981746e68f1b1dafd84f9a84ac3b61

SHA1
1e826b2643aee873ac48657404a823c108a5d329

SHA256
4bf6baeba9b55d4eee98ff1ce66f57268339784c048fd464720c7c9044aeb557

SHA512
dbfad740facd6bdfffbbf768f8e386f6078fd6f48d926d5c0e428eeb911c648ce56ad7f5143b9656af61284d72f64971092bc394183876ec078d1a9537ed48ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
14f6f12ed84f42e67404b416e078505f

SHA1
7ae3be9bd2b55474a134f758927e25d9f08c4a27

SHA256
32f9bcfa55e0cfde789f3bb68777518f810ba79c72e61696ee988a53ffa4f14f

SHA512
13e032501a3e3e1ce614dd6e8f20ff32ae613d469d8fd00ad10d9acaee4604e4061013d061cd00176ce1f66683757fbba05dc485a18c62e8c8c5298c1ffe2771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
876f291dccae457aec5caec43bdf1658

SHA1
a4e8d4d8cca3bdedd02ae7b9c311cc25a73c689c

SHA256
a546a60e2d092fdebfeb64e66fc5f3d387f1b8341356f0f4d7ab4011a59d7487

SHA512
74108bc4338f6754e52e05f93925012fc7ed88344dd74366868a5b314667039ffdaa1214dd90ff337a7b760c6b4bff77b54ef9d83be9f5c7855d97f34962fe55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
973B

MD5
a767d210ce3d34dc37497228d6d5ccdc

SHA1
bdf81adf7a2c7be86d3227c3f5a59f018f58c0cc

SHA256
d5ff7cecacab812c384c5a06a9217a0c902b220d1910a0a704953b757b3ab356

SHA512
9e16b9284c4d777c837d582ff38fa618f2258389aa52a0729281fb7e16f504630a5865672e57cc614d50deb97d9a87c52a6f7032a033dd2fd7a2eaa7f8206083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
597B

MD5
898c5568ffb0fe62ca8247230593f0ce

SHA1
4f55d4a045080809471f550720a5c7b7dac82138

SHA256
39ec046916a8e080e9faa75368e7562f7abd60a7252a85450888b68fa6ebf7a1

SHA512
21f37509403253d6bb370e351800743f96d6967b79502d153f947c70ada758767a4189af1b72b14db1cd588e0bbe950770f714c942b1bc184916946be287e17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc5004428729a46a679b3cec425725a4

SHA1
c3f70863dd683472fa6633695e54e4db59d9ae74

SHA256
b646be2e673440801113bbd15e3633134bb33c03c050e0c5368d42dd80313ee8

SHA512
21ee49ee47a88ebd80dc01b60db4ca5f36d9bbf02bd46bcf119286c858375f6a841dc8a234a879960dff20acf79056ee7a143b3954d231e7a3f39e6603c7973d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5173eae213bd91a82054a7683d402b5f

SHA1
d52da31d6c65a7ca28ece32b162a9b66ab0a2b86

SHA256
018d7add9507618db51463782b9ff88496befb9bf069e77271c553a18aa93cfa

SHA512
6e1096df3ff92a5519b92378ee9218780f0a07191bdae26fa677baa354609eb992f6029f3dde4ce9de8a1bc1cf99604e4b3d1820973d1d8cc980018c8d5d3b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c019d981b8c4916f8ebe2ed01ed95f46

SHA1
ab113344e30cf326849c4f7536ab60c6cf75e102

SHA256
12ea0ea091c55d03e8edd33c6ed5c554952092dc0abd3ba9793902a260be91f0

SHA512
aa78d965cc6c320dc09de779741659f3ee698577e0f30d87de17db67b36a3cc69a23430b00972f7afc0241aa7d760bb74b309fcaa9867372436e07e825231d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f84aa9afa9355a3553bbb98540fa6b84

SHA1
d2b7588b821f7757b721a2940b06b225e5a69a6c

SHA256
4d030283da48390c24be1b26580d87494c1e915f071f907266654b7e2957183c

SHA512
733e0317881c802f0a0ef7a6f0937a2af98bf1d563f4389061085390b18943c403e5d5377dfbc2c42dfc20a60e58582af70182c1ebd3fcb5ba9431091cfbbb08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d7cbe66b36ff95a20564b782102a680

SHA1
c0cadb5f7096c41a8061cd1e4bb036bf375e594d

SHA256
2058679152ddbb98cba3be9bc7cb2f0c5e904c271d15cee0ef5445246b2845f7

SHA512
955b95f2e42c2fdbaa66def766fe69e1933c238bc648b265e94af4afaa4c65caa599bbdde063dd59601fc38cb5a675fffe283a4c5ed7fff70716a03f7bfa6d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7aea8a5f56340a4bb0cd288ec6a3942b

SHA1
7d962e81229322981c02222c668116599f86e144

SHA256
d84d17c0dd33c2c98f4f9052de41308461ae3a4fde0db8b32db5fc9d2a1a319c

SHA512
845365c00684b5f75f47c338431f068aec9a7a680fc27e9aa4442d343c171029a5cbf54b4b40e792886949fd9e49bcd2210d8f2e1f2cad94014d8f87e78c14fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7ea4df734444d17b2114a211febcf55

SHA1
17c6d4ff6a05305d28b773c6924eaadc359afeb8

SHA256
6e7a12e06e41bdb3a9c45bad173f663e64966c2aeefb6f1fede23b049a5d41db

SHA512
67baf8ecc0caf6effab1c0a7e20c4364a7c8c1d097a066b93a1f0c932c6c0de1ee7ab9f1f043ba4cd86d532b2f2be4502519e2f03357f5b30eb3eb06cb4b33fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ecd51eac9b3513e1dc4550f468a99dc3

SHA1
d3c7dfde9af4ca22b21fb3318f45fb99c7b720f8

SHA256
a5300f9bd5cfc428982257eed3c5128d97ad379aa04675ab97f0f8064adc4645

SHA512
8a5d0d7e31170455b80ca092eb0b493d37de25cdddc0814dbaf2d45e5fea08f740b11aa5d50c0897f9c5fa266ef30cb38dddeb8575c8206e4a41f6e194a32330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cdcc79cdd6ed8ffa9e6bb01f007ab47

SHA1
25a97d11a9cbc76d1444d8adbc25ca0ac47ffe7c

SHA256
bd14ae5fcea3725f9f4bc56a5cd90dcaf95eac73877e94e4fbba511ecec0ce1f

SHA512
19fffe7f5839cd499a1b3494eebd6e84fec8e320074b59ad58d354576d5aaeb7d083adcd1fe9d8a8efbad985b246b1c720e549bd7ce71f0f9669dd0e73ce54de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
937553b84cb281258d01b7b85a992bd9

SHA1
07122c23de3c04e495a8f1ba3efbc0cf4175a546

SHA256
e6ed66e94a7831f0fd47e8d1e45c02b7683bc6c559affcf59cf5e4cb8992d078

SHA512
de7c2f89fec0291ef9074b936b3f273eb1ca6267a85ac0bd42603ddc7cad2dc5fa75023c561295bfe5b482d882d57d692f0f063fffe73238ad8a8845698117f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
132af473e9abbe589b0a735539dc9247

SHA1
7a39933e916c4bd2bee3c2b6ae5f867642e6cd33

SHA256
ad429b8ebdf83a3f3c79fc571e511476b7a84338809793cbac8cb360fb6b45b8

SHA512
c09b3f110304d58c2007f9edfda93b56d15bce1baa10aad1a0d43a3d8adf222f2142d21aa8645a9163f32f67116c3dbb6220642bafefc69b8e60a00ac0129efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
862B

MD5
88bf94e7cc4bf4192d71dcadff2b96a0

SHA1
ce0d4998de3c0df4018a88a205cdc138e43e7bf4

SHA256
53867b89cc69f07cf3c35a652f2f0268d03586a4abf7f3dc6d72ba97fdf32515

SHA512
33b3a97451e4f8d686eb475b3a273b03eb1dfff1e3ce4f795e0cfded418f893586ef4b19d2d129f875128f6b5bd595a90ad0b5968ba1cd775147a978ddbdbe80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
2b23e122f85d106be65fb69ac47222f8

SHA1
932ea4af653e9cb799e9ca4497ab1676b6ef9536

SHA256
4a03ed4393346e9fa876d63a8b36902d84b1829c76dd470478824edd4bb56519

SHA512
9126f3c2f360a455dca1ab65be542621f2ea07a5e7e9c11731996fc9b4982651b50dbb752cef3600d4c61778763e5727d80cc9bc7e23ae1eec30f463a1bbef11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
f72d785479991169d04650d533f04990

SHA1
78d8ccc2c0666b1337ce5ad1a99c590b51a0e413

SHA256
f7a5149a777a6994d225d1e98852dd93aa096e9e5e4d0827ef632e7f05f7638f

SHA512
2c9b202ca9f10ddfa91f612bc336fedd162d52072f9562f190738872dd6ccb263a3eae8d9907194d371dabcb2e7a00a45fb00c77c521a5ae9c0266dce4306d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
4b14fd1427ddfe37b30e2a5b8c678aac

SHA1
9d58ddcc5cf04d137df6ddc3fbe304cbcc1d2315

SHA256
e13bd7d7987fb7a042250b355722e526677e6ad3dd1ccab023cde696e8114d2b

SHA512
3819440c9678c835f09e1f7062f6e3ddac168729445d9a292056807b7d28bbdd294a0c5ddcd3fe133ef14fcbbe1245cf1284beb838868a83fe0760397ea24d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
396dabd1784be454d7f8be19c13ab9b3

SHA1
4a52788d6691a9b3303b5adb577181328fe30f8d

SHA256
234449f723b9d3dc2dedfe56a3fd57e8ef03db84e245a633eca0562346eb1660

SHA512
c0845174a373c37b5cc7713253933456c3497eb75a60132764a1dfb714c1d10ac878e803f78b20040421604a1deb0c59cfbbb7e91feda05bcbdc5e74d58cb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
70b1916c03e85beee383fc7a45d6f98a

SHA1
96a60e9d47c7654ff2521ec62132d1457c1f7ef3

SHA256
96992916aa57dad6f5c9b8f9997ddae89e6c34f03105906178431c01930a5516

SHA512
2c4a9c4c0b0aa8abdc1f0eb239fe9ed83fe0e0039eda7b5ad56ad322c659ef74c72895905b3aa3eca69a3db38f9d3a2524245bccaa07d2c3b1d6aafa159489c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e9d3.TMP

Filesize
204B

MD5
f30467e856a045404dc185e273795ee9

SHA1
31b932fe85814af909507b1237c9ef27e7000157

SHA256
ab2951958a2f8ea9f73ac49f0955b74fb6e9892580ad5845c772083d0735ca06

SHA512
969d81871d83328621262a84412d2d05575f66f9521505b86e989717382304561f4fa06af32b2b30a816ce6a876b49c19252398cd68412de31bf25277739cb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28deaf108c38b8284c727fd62dbba453

SHA1
fc65354b76824febd0a5b1cb4448f50ffe9ec5b0

SHA256
cff0457c6ccc977fe971179ac6a35093d665bcb5bcc3f85df11a3849a65ca668

SHA512
383d6208a76fe7e35937705fa4bbf6684c18688af5ef7a0834ef4831e942aa2cade76c99622697b1d5836c65b6c5d2618e9881265dfdc99043cdf89404c193a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit