hxxp://google[.]com

Resubmissions

07/11/2023, 14:22

231107-rpw62ahb4w 1

27/10/2023, 15:55

23/10/2023, 16:49

17/10/2023, 12:22

16/10/2023, 18:28

16/10/2023, 17:48

12/10/2023, 18:50

Analysis

max time kernel
1340s
max time network
1157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
1400	msedge.exe
1400	msedge.exe
4208	identity_helper.exe
4208	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2584	1400	msedge.exe	71
PID 1400 wrote to memory of 2584	1400	msedge.exe	71
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 2724	1400	msedge.exe	94
PID 1400 wrote to memory of 4812	1400	msedge.exe	93
PID 1400 wrote to memory of 4812	1400	msedge.exe	93
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96
PID 1400 wrote to memory of 4788	1400	msedge.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe067f46f8,0x7ffe067f4708,0x7ffe067f4718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6648450318143670561,12354162227005403628,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe067f46f8,0x7ffe067f4708,0x7ffe067f4718
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe067f46f8,0x7ffe067f4708,0x7ffe067f4718
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe067f46f8,0x7ffe067f4708,0x7ffe067f4718
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
71451339c80c35375ecdb1c88e88582c

SHA1
11c6560e8874fc4e7f5cca59710304c93c7e5f8e

SHA256
f7f747c2409f0812ca4ca117bdd4c3f4aa2a0c5e272643cd5d1e2d56189d64e2

SHA512
8628879d8487f2f59c7b5d9adbf1d303ace52f599d723427d4b5eab128435497111435db9881bcfa0ab979a772f0957ede02924e201d4ebc21c5265dbc4c637e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8249615c01d4ef568dbd383b69e614e8

SHA1
293f4abca139ce8530592051fcee92413ba130b8

SHA256
41b86d20953d6c2869358f6ebda47c5d9d7db5ffcab1dfdd08ea18e35f57a81b

SHA512
9477b373d9dcf086a46949a046b3ce2d6456284c6b739593b8455554faa9d8b9855716f849e479e7b375c3ce851c57410be421d3e832c8cc714f3477d841ab85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
70d7f8962560505810067a2d7b3233e2

SHA1
ab96bd013d7dfa237f3dcdfb8cea7b10bc86ccd8

SHA256
4e683003a6ef32551801ca4e491d93f66e5406171cb28336255613e8652e8365

SHA512
4f9202016ad507b4dc067da220879ca485d3c611c1e46642e14bb7b83c51ad8a0214c79612a6f3bce435ae38ab03c71c20c5b2d9ea2abdc4beb259959e790424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35abe1ec753daaf37c6ca117270616a0

SHA1
51eb8169e6130517e0e9231f2d87a31929d27587

SHA256
9205953893b5c734fbce60366a9ac28c3198bf1ab740d9deeacd8a0a04024933

SHA512
fdcfa8c343c3e692a8394e776f7737b2105131efccc728832b2695c72d211777386c4cbf721c30291eb892c50354554828a767a09f763843524149179ab2e963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
745576410167833205678ae549653364

SHA1
58645466887f224d9f5fbd3445c5ed2e5e6342b5

SHA256
416b889a977de760296b21802aad5675206ccc38fc6df40e94719732fe1c9dab

SHA512
d855564d470367077bb37b2f87a5e83c5a0d8ca32f301099554a6149248e9d6c2bcaf329e9132631eb594d593d5a3d6dcb1d259de96449ff2c21ec9646c98ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c80b6054166d07e4879e65bee7c2f631

SHA1
98fc4cac96270116879ef69ecb00f7b48feb0e0c

SHA256
4101589d34986194e7cd5a9917a4ba9d7f228fc861b2fc30715ed5cff0179098

SHA512
24e337c643d0aad4d8947b59b93b1f281e81bf1cfec1d9208d583b52f6e7f00a61756194d822337849c541b4e61363d50bfe267aff2513004b2ce31a2aab5cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88f0cd4ae641634dcf50749fc0e56478

SHA1
d7c6677c5b8e335672ba3051a9e80de0304b3f78

SHA256
0fd3fdb5c7f3b28101e5b123579ac4d8c6cf243fd381dc5852406e699d307f38

SHA512
319f59a3b5666bc78c8ded34309b05de967b24f1d2f1539f7943ca4175935b6780cf4e1917021df46fcdbd71f5ca7715015c08cf56c666f66372d6bfceeaab2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
699cf707fee6b98d8548a1c466a321c7

SHA1
e40a4e56995fc978603e42093578effb1c51bdb8

SHA256
fb2dcabe188e7557902aa3a14f50ffa1945f15ac02421374fde560df0f606b42

SHA512
171fe16727e074bbb11f4eb70b6d10b199df592628164fe506a0abf39ed2b16858275738846d6f161d6b1e4f3241e107902ff28b716a69dcff8bdbbc220ceffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83a57aaf377fa8c8e10bdfcddbccc214

SHA1
3636d92c83d5c32ee282438c834fa52e10b70485

SHA256
6191794ee925127b9509ef303220788f47fca86c8dba0f2cc1d468af688b98c0

SHA512
7f948fd88a992852ea8791bbe302ec53ea2daeb69eb08ec325fb32b362b805d6a1a8cebae643ba1278e6cdc71b87ad4328637ca6f93abbf60b7df4c14891ee41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01fce9f021a457fd4dd468c923d99e96

SHA1
52b1b518c1868059b3a4caf2ecf6440937fa487f

SHA256
6531b82891760097ad94228b9a4e52c009cddd8837f0502c448e62ff4184f707

SHA512
7614c9d042a53104ae235e12e90960c8c6282c85eb575894e8a2df296b308b921b18ce136dd706aeec0cc6aede3cc15f5f1e2326c6868b3d1574efd803da0946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
747cedb122536c9892d8877b1bf32e4f

SHA1
ef903fef7a971e6207ac863ba1ac70d719f5cc19

SHA256
3d4b79948a181faafdb4c5409875c217200b4b57ef5498c907a67f6114cef0fb

SHA512
0de11b6a7968cc9a45265f6d3070898a5da351963e5248ae08c560c6a64a4a7fb74ab6c85ffee30af553b4dfff33fd5ec6b15ebaa47ae0821abe4ddbfe7b13a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
1dc07cd5dc6b4b289a1ba767572136b5

SHA1
e6a57b989d8911564913fed3d7d94dd48ddaeaeb

SHA256
1b2d2b117bbe6ea3c386d7b33cd5e750fdddf6cb0ae0a6b186de087444011ba3

SHA512
8df41722c97b2dac2363788d4ce469608bd939b3b1f8c014e867eebefd7214763a80d1705f3350225193070dc2d3ba825f16843ffee0e123b6c0f7a90bf6d06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
6afa990bf6f106a34c1619246a60365f

SHA1
d3e6e610ce6e54847c1d0c4106de933e3124a78f

SHA256
f0dead51fecf72dbe85214e7756ba9b085c9cd9b8809a78f71f238ad91f6c544

SHA512
4576493fd1aa7e9a3662ca5146821f63f81d802bc6904e8f26b760b49a6ab195f77b1813f119e74381ca6f931dbb2cb44d8db0e2aef9c1385026b553d2e265eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
f7ace035ba0c63f699145ca8b9a2d333

SHA1
250166b61456cd9ce029544945dadae6b0c2bf0e

SHA256
1ff34dbdd599dc218b76331f74b1b9c84d6383a863afd1127798870db245d324

SHA512
2e95b50cc43db7b52def60baeef88c39861aa704194106cb3962faacf667ab774280a8e74b06bd07f3495c5e3257b2d6c820b65b0f7d5fc85329191324759e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
e39923d0ae2149811e9a2206764d55e6

SHA1
45a4eb95372734e1d3f88edef3046bf5199c4a89

SHA256
3a539a80a6ba76e0f9503779e43f5729c10a9ea8dd7501fd6a6bbc362e0770f6

SHA512
a671018207af5681868ee051df9f6b0d94b7ca8461caf01effe12b0a7b3f10aa13a6288aa9a533e84c1cd8720e893f8d189da2f6138b1ef4d8792778d539ec9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
94f5ee02bc192bd1709bd270be200677

SHA1
8af1e452b4cd009dd34a6e6513f3499b19bef9cf

SHA256
0ebf725eeb94f193b106b1e11ff0424aaad0b413b5b71a23605b478f13436a75

SHA512
539516d76123898ff5ce7e70d00789bb27320071accf25582f6c34089d3f5cc5ab0a2561ef8a772cadf693086b781d9cafc423989821b6547a3812591dcb6eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
2845e85981ca9d02eb8de61584673641

SHA1
10d35214b6652bf0ead1cb7787418c5a8f1dc79a

SHA256
2078ef4e9eefb3cf440554d5136b94a852c72aeb428c30d8d1a946474cda1755

SHA512
c61bb18c642acc4a641983043a36802701ddab26b9d1f4b49d9fa88f2365505a17d46c5af441951b0d9a02cc5c1ec0b724b1ed1406199caf34f8ae29509cb412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e990.TMP

Filesize
204B

MD5
34c777ea5ec84d6d4ecc287fd085a440

SHA1
e324e794a84aadcef8a18d91b34159460894cf8e

SHA256
057581ce8d512c96d5a40d540d4bdfd473d1280f7e1df42dd7b343f9c6214c54

SHA512
3ad16c3b49154886d02f4f374b0c395645194057f7ceaced6de88b4e0149b7ffbae928e4e943f910402c6af16175beae0994db707fc3010c500656e780030e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e89a3c38788e472a5e47571c5f535d45

SHA1
c77c784faf17e96310ad12a22c343aca76c3e8c9

SHA256
55fbef1e7b24907cc210c2fdc1451d096fc83ce571523cda34c79bf20db98ae5

SHA512
8431e39be554bb0b72d14f052162c51aa6c98c19687d492d3cda664486bcd4be6abc11e66675890a81267ec7aa78c162118eca15bf5ff1b5688420e0f1c14b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ce4ba67ff8dbf814d4db31173c989a8

SHA1
6c4be4b493cc18817aec4b3a6d545f4a6036c135

SHA256
c751798c218ad8219420c7981b93dd6a5c70231162040ec2cb11fd909dd1d43b

SHA512
f2521a3975f15ade7ff3a9ae0849d27f751f80b3fdb59ab964af0f03ef32b5592fc5e8df9ff0016d2b2124c31f6f3afb090865bff958fb1b8344a24e5296b8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
448b235d22bb60d918db4c223a4037ca

SHA1
9558680cc32c035ee93cf40d8d9c6ce46ca417f7

SHA256
d705c3fb6a2fb3c352f5e09d6de001055178dfb1ac3e82c951d329472290f54b

SHA512
964641c37537ce61c9b238ede0259bb9bf741fb2a80296724988eb9ce3186f89b92163d8fb72e444b935f555d74dc6d141b4e0334b6d9537d3c20e4735b7292a

Download Submit