hxxps://prezi[.]com/i/tgf4g8ajq5by/

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://prezi.com/i/tgf4g8ajq5by/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
4876	msedge.exe
4876	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3484	4876	msedge.exe	84
PID 4876 wrote to memory of 3484	4876	msedge.exe	84
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 4424	4876	msedge.exe	87
PID 4876 wrote to memory of 1528	4876	msedge.exe	88
PID 4876 wrote to memory of 1528	4876	msedge.exe	88
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89
PID 4876 wrote to memory of 4820	4876	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://prezi.com/i/tgf4g8ajq5by/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0e6a46f8,0x7ffb0e6a4708,0x7ffb0e6a4718
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1128 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2584927451073795287,7893358952215130846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56022ba0-d551-42c9-9f38-2fa73e31fdb3.tmp

Filesize
7KB

MD5
997105f4baaed96466c94614dde1e9a3

SHA1
dba1216f93a8e27b015ac752fccee820eee88dea

SHA256
7e72a8fa696cda819532fb6a7368d7e8071c9f2ceb4dc9ac504a3cb392d983fa

SHA512
55e51b81146aff45d1ba2e8fe4c63b71069991b389749490f780332754e86612061c5f9f2e4d3b23f40aa93467630b6d7a00d5bc9bf16a3cfeaa656d0cca0c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9660757b-faae-497c-9e96-9aa219a57978.tmp

Filesize
5KB

MD5
20320cfe9641ca2210734e6c8327e7ab

SHA1
9d283e387ceaea894e2f8c665f69b64c175ee686

SHA256
0eeeb03513059ebed0c25e61ddd841eaabe5b8e53454f93ab96e51eeed9065c4

SHA512
f17fc7ca56b5bef29cae76ba6180c17c240653d315793e4ac324d4b98367163352197c66e080f1c8b056f0015c8642139f909f30c9c5b232b144e2099cb4200b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
24KB

MD5
9c700e17e974d4ab2dfde82f6451dbbb

SHA1
d5b85e82e10c2d96b36316670c76b8a0112bf246

SHA256
3ec0462dbcae8561ca0465558845da248d434dc6205cbde99c47ae3be2ac99c0

SHA512
1428b7401d281ad3d635eb007e45b6e5798be6b029f270874af2312627c496407ec7440df4a3028f3cd6c1ec587b0805425ae5de4bcb04b90d942145e26966fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
e99f8f4c06111dd487a8b74ba5f66e2b

SHA1
e23a051c4fad616662e42890ad56b1f187f39d9d

SHA256
fde1eadd1df598014b3e53e5864281c559248f4dc759c2503ec39c549aa72915

SHA512
26b4e4fc14e178046d28ecb74331088f517db2bca4f07f4c8931ed66ce2760d4af75ee05075955f923aafc2526d48519809b78f978191a8ee81538739544042b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2958847ed2717aa9f622238636cd889f

SHA1
6b52504336b89ae62cbd9019e63774fdacf5d0ad

SHA256
b8238aed8db832e1205494ae8c3d78fa02162938d68b7b27b5af4b8d72cb10a8

SHA512
1806948ff94b319c242d3dcb935630df5fe8cbca5095dc97621e1abb408ecde897665704cac405d376d62870c3d5156934b930b70eebf9852cc416d739c52bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7f62da529ffff158b4ff24064f779319

SHA1
9220dd69d0db55bd3bafe96ff8024dbadb98852e

SHA256
a8ceb2c6e68872574955cb222cef534162724a530bbe8b4611ba7fe4eea2bb17

SHA512
042c576aa560edae0703f612216bb337054fc40d77555e15fc37e8b169b375ae572a7b6492f14e2a9e5f8ac7ec6c59fde99202e4540ca96c4c5693fb67e6f90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
579b4cac5532042cbf9488010f3d985a

SHA1
b11091bb1f0ffebfedc818b792d427cedd3fcc34

SHA256
789ad2ce9deb4c15ef67968f455f39e1ba46e9436f2f9b572b65b42fe5664006

SHA512
2020afc601b2204962446bec762be3f133b3937286b645f22f98c0923e4a8698188594d6f906b5a1ff31bac957c23f4c0df0c987a24a3b5991ed22f979d8c31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c61f7cd16e7f96e0680c5a10fcc2f88c

SHA1
503b64cdbe868ed16439088fcf8759497b83fd35

SHA256
9c49bb004ec78dec94d7efd9d252be79b26296a996b7bc5f709619f41f5f2c6a

SHA512
5accb0117f19bac98b71d7fc2b2d11cdb760470b539f0fc33e71ad6ec0c7c252ed462daf54ee745ce54184ba7cd8df2a8a0073c88285043f31b3d83ad6f78d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
98b8d68cf907a916dab4369fb20308c6

SHA1
801eb052f76e0d6c039e7ee9e6452efa58d48f6a

SHA256
830697f65e827f71c923eccda19d8e233f8c0716aec0b0db6448a56afcf3df5d

SHA512
ffa87a49d7cd7561f14008b00d58a3318abc2556a4b7893603f58ae3534261637fdead2d4623689ee774c31700ad00e51d076c49bfa07457d08bda843ebd2173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
16acac24e53b0f5390f236ae3f192b29

SHA1
340d3a6c17887da9efc666fc05184fe4610416c9

SHA256
2810e15f06361b9dcf2ac6aa866ff3b0c7400a91091203d03503fc2ce24273b1

SHA512
288b11be7352e085f30f29249ef25a1573df22731328e22b89e858a986799f08a23d18190498d66095e928936422280e80a0cca05b8032ad504248ac4741858e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f1d4646b0db9ecb8053d15857fd598be

SHA1
6c3f55ee61e716d9aad419965d37d966f42970ea

SHA256
26cf7cbf2b90d40782bd09ca7d2caf56d902378e602cfd2137f497e8fed1f99e

SHA512
5a092ab539a5044fb7f214da0718a48f249064c0f876ad30cd21ac4afab0aea17c843940a63df29e45d83e084e8152db0c249c108de168981e00fc2abd7db8e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58583d.TMP

Filesize
1KB

MD5
59477259cead40de75100f966c066830

SHA1
6de5138ece063f941e2ba7b2a84b5c64f895dbc5

SHA256
9e484654cc672fb463afdb68713829dd38329aecc5006d781c734f4687ea3f3d

SHA512
de2ae120030f68bd70d918a6a2a41d156eaf3abf6c26f2528812d64b10bcf0c92cd99923b7cae82831af388f221de1df16c1f9509f4f32aa377e1b1fc41ce03a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87b9f4a293e6efc33b0e79b8d02e8f2e

SHA1
9057719fa999ce27f523327d7e46bad81f8abf84

SHA256
ea43d1d25ce2f465b323d4ca5a4c4fb0f83752b51be10989e1d68d1774562b98

SHA512
7ecf83295f98f5fbaa85a2e3d1f054b3504042eaf25164ed30049e0c02cbec6110868279f65e353ede63af43c205247397308e898f5ee051594d795e4a75825e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74299e2318420d29f5e8cd301d66541d

SHA1
e62bfc2ddc978379acf0833c0e8b04af3735235b

SHA256
e9e89819de04eac6d92d266d80e2c3098c01065f4e9d6115218fcd6810719e14

SHA512
c632ab21767225e5045e6c74d8cb9fbdce149a092419b1935c10ae9f7ffca253f7b7d41a57f6cae8e0fd4c87018dbe0176a132b0a2a0b774124b45335b3455b0

Download Submit