hxxp://google[.]com

Resubmissions

07-11-2023 14:22

231107-rpw62ahb4w 1

27-10-2023 15:55

23-10-2023 16:49

17-10-2023 12:22

16-10-2023 18:28

16-10-2023 17:48

12-10-2023 18:50

Analysis

max time kernel
1708s
max time network
1720s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2023 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-919254492-3979293997-764407192-1000\{DB99FB44-ADC0-420A-8658-95CCE9FFCD70}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
3568	msedge.exe
3568	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2724	svchost.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 2304	3568	msedge.exe	85
PID 3568 wrote to memory of 2304	3568	msedge.exe	85
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 376	3568	msedge.exe	88
PID 3568 wrote to memory of 2720	3568	msedge.exe	87
PID 3568 wrote to memory of 2720	3568	msedge.exe	87
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89
PID 3568 wrote to memory of 3176	3568	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffcdfce46f8,0x7ffcdfce4708,0x7ffcdfce4718
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11469613446014211913,4194384701887655318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7ffcdfce46f8,0x7ffcdfce4708,0x7ffcdfce4718
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
85350d26403e6f2962dcddf98c21ea4d

SHA1
dd8ca587f9cbbcc36276894ce035e500fa9deef2

SHA256
6e0a9114fe5d737c003a6a3a4e856b81c038658364bf13bf19c4aba6a3b8c7eb

SHA512
499e29b11b4f4dae0bc006fa56fdabd7c813828c657e5f41c0a16e3bb241d3c0cf2cb3a1f7aa115831dfae2e16e879d162cf6857e2df415772ca152a89100af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cc5a4df0dbf005c7a9e2aaae410b3bc3

SHA1
ac76093dc2795798c23e1a99223427bf125f0d2b

SHA256
c8d9b59cd83973ea3c72d3acdd7c1df71d1faa2de64462870b58817a65be0c4b

SHA512
4d53178b6dd2d3127332a8126a4f636ca03c7ca8969dfc1ff1ce1ad28a093765ddbb922038db02157550a23831cda58fd76f569ccac7928030567601f77e76c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c19b3cc63c6090470c46e2afa00f42fb

SHA1
aa17919aaf2b3cdfdf211b8a4cb6cf59e96a8a24

SHA256
8147fc89368cf44d886787d29575564bd1992aa09991dc3719f072338380a951

SHA512
dd317b05cb177e40ddb34e3dab225a502b8f9045a5821ddcd0687b35582285b9a12a31dc3596e467d69763b63c84a90913c3cb186de834f74675550b71250121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c27d0950184e48ecef3906aae9d605d9

SHA1
05b08d56d2cb911f24c71ff9150ae3d5c8174c15

SHA256
5cb34e13ba957c9e2f14821d64f9660c66bf674f041763c712c365ebce69a716

SHA512
e08730f2ad55712c6e993aeb07ea208c79f909ff5348a1ffa0be3c473e3724b0fd0f7099b514fad94acb38bf3e332397771ed1422ea27363dcc27944a7351530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8711aeab70f7a6900dc272e828ac5f9e

SHA1
7195979cca1d10d457840d60e6ec043915814dea

SHA256
07b50807a3a3717e4da375ceba903fa05891558d792a6d98e0610449a9a5fda5

SHA512
50d520955f087230bee3402091327b3f22618fff763808208461f21bd1ddee2291c0057f0228830a84f20330bc321a91525ab8465b37cd3b5adeac8632f795b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
689ad499e7f0a80915e95f3cbcd4c472

SHA1
e42f9f50b2dc0ca893c7cc35e7086771c832a723

SHA256
8be49b96506d617dc2d7148321d9083a96f1a65148913180e7aa67eb452bf3ff

SHA512
bef7863164bf33e953087209952680fced0c62533ca8975c68fcb6f5ed7ee12e6f3ad7beed3330ceadb87245b2e13cfd0921b6fdd2b364c53c442d1eb17480c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44995ecc863ae8562402f57f944716a9

SHA1
9b6798139446a14b73cc3d9638dd222ed3745f63

SHA256
8d74b961b6b26f79bcf29efd0085aa8ec7007a7d90d3b5222ce217c563120b65

SHA512
17770b8a7c3d0b5c6460333c5a942c3b27e8970ce10f2363bbaa2949cac6ce631ef7b3033f3bc474e5351fe4b3139568697b11896cc794adec5484236b11c7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
012fe88f6af541d935f26187db4086a5

SHA1
d8ed92d94b02a0b158688bf19b782e1ba4ce6c29

SHA256
812d96f20f4ecea4d530199eba4faacc9c977561eb5507edaf3b4fe498f21d46

SHA512
ab70405a2e3c63b93eac70adda6577905994ec4b08043dece36f334db8e3e26e95fc4c2847c431c701bfb36a849bb7d66130eb2de02a91c0aa75cba3b4720915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
6b683ee7b503c1b6f032d2fded46fbc8

SHA1
98b5db128c619f955cd7d5d92459a5d2789bc2b5

SHA256
6d92fab60aaae92b03f7315f03a525b2bbd0a76798aded06810e86497f439da0

SHA512
9ce3bfe74781fee21d251df063873e359f4af1f0d331bdc7ee6214b34c9243d3c94fd4dff2b6aee100b670477cf05d505ecac0a3969b19fb0854c33a8f67577b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
227c707f27e980ff181a5ee131d22c56

SHA1
d40fd237be538e120b0055abcda5104cd703c099

SHA256
0c050a84e5d4ae4bcf737471eae7a83803f94275070308cdfebf882edcc84b48

SHA512
cbee371e82a503752e35f107c3f254b79b8e8b77c585f72366d8886ff651cbc090e737ad01f815fbeb138ed2b4d4e01bb97c6d4bed9ae016641ed6ca821cd8d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588cab.TMP

Filesize
372B

MD5
0bd77eea728a69b7633f1e8baa6cc48d

SHA1
67e3863d7d14d31a231fa631c2af7eb0a5ea36a6

SHA256
194540a8c1ad03b2a25dd91f9d41824bed82a3bf5a32d61c659ebd5a04c1c0a8

SHA512
740b44d8e2fbaaa425dfa80f78179dcc1a62cec9a68071f4caba1425988f55baa80bf9d9f09135673bccc880f1390af8c7cd21b0f6b9cdc9052cb9d733a74d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b2493758cf83c52ef54ccdc99b9419bf

SHA1
408e5073d5a711e401be0940de6dde204abc05be

SHA256
22ad122948e37bb9783d53f897602dcbbffeb38a6c287ded6edee71a383888b5

SHA512
ef9799fde96e36a0c8a913670f5277633328214c795bc6aa2745944aef1f094fc1500ceddbfdbea52e12a2799426895a982048162d325af35c150e8cd0ddff59

Download Submit
memory/2724-114-0x000001E5FB230000-0x000001E5FB231000-memory.dmp

Filesize
4KB

Download
memory/2724-176-0x000001E5FB370000-0x000001E5FB371000-memory.dmp

Filesize
4KB

Download
memory/2724-166-0x000001E5FB260000-0x000001E5FB261000-memory.dmp

Filesize
4KB

Download
memory/2724-139-0x000001E5FB260000-0x000001E5FB261000-memory.dmp

Filesize
4KB

Download
memory/2724-82-0x000001E5F2F40000-0x000001E5F2F50000-memory.dmp

Filesize
64KB

Download
memory/2724-66-0x000001E5F2E40000-0x000001E5F2E50000-memory.dmp

Filesize
64KB

Download