hxxps://selligenttier[.]naylorcampaigns[.]com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&hxxps://hotelviplamansion[.]com/love/yesjosh/dOtfv/Y291cnRuZXlzaGVsZG9uQHNpbXZlbnRpb25zLmNvbQ==

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://selligenttier.naylorcampaigns.com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&https://hotelviplamansion.com/love/yesjosh/dOtfv/Y291cnRuZXlzaGVsZG9uQHNpbXZlbnRpb25zLmNvbQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
3572	msedge.exe
3572	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4776	3572	msedge.exe	82
PID 3572 wrote to memory of 4776	3572	msedge.exe	82
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 1860	3572	msedge.exe	87
PID 3572 wrote to memory of 4680	3572	msedge.exe	89
PID 3572 wrote to memory of 4680	3572	msedge.exe	89
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88
PID 3572 wrote to memory of 5056	3572	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://selligenttier.naylorcampaigns.com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&https://hotelviplamansion.com/love/yesjosh/dOtfv/Y291cnRuZXlzaGVsZG9uQHNpbXZlbnRpb25zLmNvbQ==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cf3146f8,0x7ff9cf314708,0x7ff9cf314718
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8426788018870889082,3822370830471581168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
d56bfd5f083189fd42328460696efcaa

SHA1
54d8fd286ccb250ac728b50e4a5a8bf7458eb9f6

SHA256
a2d9c9954d3725104c795e2327afed2dc30421b60642cb748f3318629e695aa4

SHA512
1cf842e7cf8cf2a3e8b195233407d30590a85399bddc7b794ec8291b3f92cf2ee83116096c65d60cc3a647530dd0c5e730f4f80c1502a1a32b4646c879b80cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3ca3d6aa62e15442b21eaab05bb27404

SHA1
9f508554dd3069dec96db48ed035d1d839cfca94

SHA256
97f13c96deae021cc2467518e42a9c68dec41c9268fc5346f173f25cf9b42483

SHA512
8dd4a2d21155daeaa81d2fe7c84dc7e9c5ab93bb7b00ac58f2f462b9fad93ea4651001d53fb9746073a18499e7180cd85a70edd568363fc84260851c10822c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
742fbceaff91132bb1717c63559ab72e

SHA1
2be7ec1af23f81589f7a9dac1e88c2a9ef15ab3d

SHA256
c2dcebd73824148c9b794f8e646f3170ee3f0f62cdc3b79387f4e7f05efd92a7

SHA512
6d00014eaba0cee72dbb276359968a1db0cba15642f25061c9d0b2e97dda56bd9a675cfe82c168b788057a157ed2f3d11f5b6adc0487122a3ce616f1df5def55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58304316d101eaadc34ea60344767369

SHA1
9e8cdf85b55d2d9a480d7b82e925024c546d76ef

SHA256
8789deea1b1342610f18e45a4aff2a01719803ce92f7f0002759b3a49b894fb8

SHA512
9603d03912920c1a5142838bd9a358191281fdc7a19e4c512513cf357740cff4f5144c8edf08ceed1124222bff06707254fb79b14df759e8bf3a69fee0d1e182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
230951693af24ca61ee763db841a0b2b

SHA1
60262374efa60fb034674db713897e942f2ee71d

SHA256
99c6171e8919519e520744fcc8de2db5bd077316781c3c0dad5451220949e187

SHA512
867c4a16f540015d4ee6b29e05f02da9e784c0c4713b82d1924c2fc1e8fd45e9249e3ecf417c5a7e6be960076d31fec1124f2254e5923b8fd9711ea0553be890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcbfa6b66191425154934cc7e9f64a5a

SHA1
43bec480cb4dca4babeaa967003aa5ca81f3155d

SHA256
0433dbbdb809c6ccb000ecebdf4f0cd4222bbcda85d95d3ab212bf3e93e58a7e

SHA512
253d70986716726130872d38771b649ee9168fc962f4d08bf5c2cffd693f21f09b3d2a4efa3ddd552968e562f9b8145c594aedf1bcba818026c7bab30bab6c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f3c06169d3d4521114bdda9cee147c5

SHA1
50120980889cd6383fd54b43a0258b0e323f8e70

SHA256
af1ba9f14e011d377e7273a4aa63489337fe2f3641b19ec9dd2430d91b9fbfa6

SHA512
cb6819511ee2889dcd1e2f9fe6957c2c167592a9daaa520bc317cd873c23cef96d2e43f58d2d41502a150ccf3b788687f16ac951c7d3318203dbc61193e4612b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea7891025baa1b112c5a29c1826c0bcd

SHA1
66822e98e988ea6fc3dfffefb47e2abdb57aea65

SHA256
a5c53ca9dbce5fedbf90fd0cc45ade28c7013e1ef969688d677d7b9bb2b6d207

SHA512
9c09281306d78a5a509cac371f218819158305998c8ec08c084b2d3b1e8338021efad2247aac432de290ee6712e2006ced774170cf1561964b495e3c1d694c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5af7d7e6f4b4d5c683a76d803a840ca3

SHA1
85c388ef991bbc652bea05cdc200fd416e9f98ae

SHA256
adea5744475c447be71387d93e91c942ad9c4ca9b510e819bf569c9852fe974a

SHA512
4a12825a51abff66c281002c0563a525ce4bd1f61f32c740d7ce41ad177fcb4ac782789deba5e9168d0084561ae9273f348bf2cb5c505e9f817eeb94721147e2

Download Submit