c9ae7d325d8f08613bb8dff54d14591f4fbdd4f289509092b4fbb16c6b855d71

Resubmissions

07-02-2025 18:21

250207-wzas1a1rbs 10

07-02-2025 18:14

250207-wvew6asrbr 10

14-02-2024 18:20

240214-wyrecshf8w 10

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Redline-Botnet-_ed--drcrypter.ru-/Redline Botnet Cracked [drcrypter.ru]/Panel/RedLine_20_2/Tools/WinRar.exe
Size

3.2MB
MD5

b66dec691784f00061bc43e62030c343
SHA1

779d947d41efafc2995878e56e213411de8fb4cf
SHA256

26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
SHA512

6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
SSDEEP

98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
62	pastebin.com
65	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
4496	msedge.exe
4496	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1364	WinRar.exe
1364	WinRar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1008	4496	msedge.exe	98
PID 4496 wrote to memory of 1008	4496	msedge.exe	98
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 2376	4496	msedge.exe	99
PID 4496 wrote to memory of 3384	4496	msedge.exe	100
PID 4496 wrote to memory of 3384	4496	msedge.exe	100
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101
PID 4496 wrote to memory of 1952	4496	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\Redline-Botnet-_ed--drcrypter.ru-\Redline Botnet Cracked [drcrypter.ru]\Panel\RedLine_20_2\Tools\WinRar.exe
"C:\Users\Admin\AppData\Local\Temp\Redline-Botnet-_ed--drcrypter.ru-\Redline Botnet Cracked [drcrypter.ru]\Panel\RedLine_20_2\Tools\WinRar.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1364

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4bab458d14ae40e883091d143550a708 /t 4136 /p 1364
1⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbae7e46f8,0x7ffbae7e4708,0x7ffbae7e4718
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10959510721184156427,3449325160654484807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
130KB

MD5
1d8f13f051f5f049c9c90f70f6ea8023

SHA1
d327c7a37c80f91540318b34a1ea9951d77fca99

SHA256
c42539de147a6aa804aabb0b98188382360a3a89f2a6b8afd43ea4a6830e7e5c

SHA512
092b0529e52c070c60d4d52e4b93a1df35b02950e411e36314eabf4f438162247fdaabff83b343a846aa19faa18b304c246859ecbd2596ca1e3e327983877d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
263KB

MD5
3e4a0ce60ef774a371322c5c67243ae1

SHA1
072cafc1b7d5bdf3f27751d3abb6e868271476bb

SHA256
2b5ab4aa62e03347e8b37460ccf322a4d08f697d04a191a7812d9c7ad59c53b0

SHA512
45cd6396c661fa380327236f07fe3ffe62d692ff5d1eb33c450375f1693c7467b01c983ae41763dc7558d0f142726df08d1b2d1a19bb960dd89864b2233d77ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
241KB

MD5
75054b407c7af5f2b63bd21f741a7908

SHA1
b2b88d7c9d8279cfff07add86452060912c6f3f5

SHA256
f478bc88f81d2ff11868080e875ce5e2b7a9d7cb271ca67a118c8730312b3a9a

SHA512
7da9be7806d314cdb1c0eec3c71b73176ae54c650be94f9ef0580c0d0389c3bafae44e8fb55456640a93a3bfc75868cc40d9d0b637ae5e0e8e4f9e97c1d162a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
16KB

MD5
49295de6ccd23cf80b6418a2d209868f

SHA1
42a955b4560bb22cb9b5b39577f7a691ea345018

SHA256
d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa

SHA512
2954ab185fd84a08933bb6e79d91e301021fce4e632b477e765c172cacf72913561e101ed2f7e66bfbdc5946b35f2b63eb2b6f878e0afc9d26ffe71ee112a1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
20KB

MD5
8dc2756f85fccea2e456061d06bdea5e

SHA1
cdb7f846722ae88cfcca334697b1c61e7945d8ea

SHA256
ff17f0a5c2b621ce0625cfd2d947bf0eabf322c95a8e75a27f42d0722329ae9e

SHA512
585b17e9f72a35299cf49d23567dd29d1fbc70caef0c8374f20ed43c16bcfbbe0cb95107a88e3666b88c1d09263e2180771effeb9fdfdd8423cc08840dcf0d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0aa4382cb75b571c_0

Filesize
257B

MD5
8501623e696011c52eb5063d5fc91b8d

SHA1
64fb0ea66abf5fbe3f5f1f4643e920ac72877f70

SHA256
3352982ecab70541aa8279dff3eaa150622a1b78a6869abd6608f47d89d93c57

SHA512
2ba99192b6f579c1f981f47d78d5f54c05cf70b767d43623323956efa9e6349f6ad65998387df632917110b74c947ff99471a13727775c4760507af3852615cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ea4e7c69bff8417_0

Filesize
45KB

MD5
984704869ab0b9af3c788d52bbdbea97

SHA1
7a35bdb7eaae1bfb480660dfb1c9ffaaa76a0bd9

SHA256
94afb36740157d10fe5febff03b4b5401e6c1c542d4f21f59e2da3a4826c9a06

SHA512
da1345f2825ea8d9c311f54534e3954681340d3cabddba9b17fa6e5fe8ff42d1275d8b6be054d35f210736140d68865efd77554e051a3cbdbf26efd1b5fb5432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b6ceb6732b6e60e_0

Filesize
517KB

MD5
be1092f44d28bd45cfa6a8fa060e6fa1

SHA1
409cdde0bae298ddf94fb387c8d672576a2a722b

SHA256
7734dc7b4536afc67e455d59e833c851a546ef49f327e9bab58c29c791774753

SHA512
f978cfdd868baaea148a32b18fffdc18c6ef814523a2baa3f69492e4d22c10bb70f578ecd278fe32f2617c763006fa3dcb69f1f0fd13f9f5a8cd636dab9b64ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f722ff8866894e0c_0

Filesize
42KB

MD5
ee551b8cba4c547a7b064152b42efeb9

SHA1
382f55a0a9b3702127685d4493e1d11950fbf861

SHA256
213aab65192176b028c88b22afe96252b9137d255f36cac45962fa97e525b1ae

SHA512
3bb2d106f6cfc4687f45e49cfd8f62afa8e910e0e6b5c72bd3543d8b9d7afd720f77586b100e1d05ea90f6e86704592e61d788ed55e04f915b9242a54c9d05f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
d6622e9e4ed1f5429aad93cccd1ae1aa

SHA1
3614c2731ebee1837d74163193c47b80dfa81593

SHA256
439c1c15ba9d06b9b93c161a155200c9d32a8fbd697f2869914652126c4d6ad2

SHA512
882d7c022ed6a6b3e3a2b2d619e87ba414cb2ea8549d73e7616b74f415219379d6ce7f94160ecdbf4c4af219479c46f77cc969bfa0f42448299a07746bee387e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
1d85fd03dcf6563b1370b10be5d3d08d

SHA1
8845f0d44bb6bbf20995cf9b0b0b5d55e6abcd06

SHA256
8fc73a6f84763c95b96dda0abead3e27d1dde960e54b523012350fd46fe00eec

SHA512
7a3f913c9d7a5e6fbbaaa7acf7bbc0459cbccce5d9db2421659f36a1dd4f0f0561ddaabbf4a59c9c69d8ccf1cd759b29b10c347e2822b00049773799c23a367f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
d460fb8f80e2e5a6e244048a7f0d74b5

SHA1
41053311407cba9c704654c4a260580b3a3ef70a

SHA256
ce87b4e9c0a58050f30cd2cc3fc59382edffbbd81768274432edb430a12aa55c

SHA512
5904284f4e4bacdf544e9bd9778e003564b81850228a62f53cf3cb7d0f636680713b349a67f05759b1e053e87e9169cd92b38a61e3aa2cf36ddc6a030e0a8db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97121ae44adaa8c4f319391a8b44a0c2

SHA1
5ff3e21560675ef5df2108b24acb603d7b84ebe2

SHA256
64d02a46f048da17c96a6a3736b0ace37e1c1a65060e4ed70d038a712b944f7c

SHA512
664801b8b62d0161999144f00a20e70155c36f1c3541bd9fdb1aa1f9662cac86babb9b5f5ce85ec9b6219f943307c4762bb50ecc0f528354ed074e09df3cd2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2552d510bd2784c2769432f8229f021c

SHA1
f5149a21d0b7c3f02b2389826cc5104a4020f2bc

SHA256
5a82cb6e4a1263c87fe6af7ffddcb24b67fc0844e5dc6ef570c2a866b2c0b965

SHA512
596f724f77d5e2cfc68d82c78d1c37653d6b32daafba9008311cf8b66249e8de351b70282814fcb5885704bf92c55fb87024d423de735404be894d16d272524a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f27d25ae1fca0c9c1b4e7a86c575cca

SHA1
31dbb1abfd6abde7b616689b689e9ee4d6406588

SHA256
883c9e6df8ab99a0458b26d6bac5757eba96ac3b79b451e153c6dd982accd2a1

SHA512
d9f4ff372dd820bdb5f9fbafe8e3cb6058eb9722eb2f64ae6142a9a6592b2d2a2e1bfc7bc015bfbd5da9be2eee9a66d3294f8c9c620550201e1427bc5c4e8328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7c4fd2c0c5bfa95fb2bfe9a7213add73

SHA1
df2ebdb6e04d6addd8ae701937c022b79986be69

SHA256
4e02f9b06d5902a2453bf8582502529053a4e21dc9fac78e5c56308dfe837272

SHA512
ea9f0ef73f2d4888c33e6e0fb402cda482a50fe7ffc9aa51b21f171d197d641275458b46b2b5997a8d7a39f547cd0e655f142aa2006517f0ba98472058ec9ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a4027e0423b969dd1850745ecd7904b6

SHA1
57ccbf229c966412fe9a7f2c14ee29e359055542

SHA256
bac564d32691cbfb295293fb82bf20a658d9075c25915f78aef941b477636df9

SHA512
fbcb35583e49f447c3d12d343e300d4a9d6f9b988e56e91f942ca57f1976fa180e3839e6d539ebdb1c68971f0a09789583558a1290b86db09757524a75b61b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
60f97b8a495720608ca3bd2755174235

SHA1
29b623e18e260d22b67227bfa8e32cfcf3e03958

SHA256
baf9bc08698c697833862c30b11f86d5406aa68f7e4c96d78e88dfaedc772e94

SHA512
f2bf9d3b4863f4b7290ae768aab54512d2f9a8d28c52d8110a424af7bb5c0344dddeadeceb9e4ac56809792e52adb9f38f34b1f7dc6f630eb329f4f25f6fd706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
628ddca450f9d0e50815b953be778f77

SHA1
074b194567a676d2a6c4d6ebd697b26b654916ac

SHA256
cfcab24472fc0b279710860b82f7fa6256aab2064fd2184f774e3038d60716e5

SHA512
345db22473af56f83c23633f42b2d6e4e4168a5ed337aa6a5789a03394e912f695dd692b90cbb61238401d606e6c320fd93e18c3a9c0d3842f92c0429b110119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592dfc.TMP

Filesize
2KB

MD5
f5ff8dd65cc2e20969a56fc60bb205ab

SHA1
0a493afc45aee2d04839bb10d2a5421686bad6e8

SHA256
95a6f8a740d4027702b177459e4f6badce0af298a892b202b8de2fdd11a1ec66

SHA512
3c38d6796e8109e1e4b6c59528eb92457680ab67a5d9044bfa8647d08a7ed6f3a4a0a74180f35245168f09572d258bd44fab89c3e3ae88063ab4a5c7af46e3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d22d9873a1e1860f59fe9402f2bdc038

SHA1
0a6ad81e804dc2fb352d66c54deff4ef0811c437

SHA256
52d4e6ebb7673e79f753b8ce2b0e26ef960ade1e2e968fd555ef421fcb1a5007

SHA512
1bcf95a79440cb2fb15517673c86e41ca1bc558e2dbf18a7d336d1ae801076e994ae47ad0d1ac4f8f6aef826ffac2173ae6fff6f66b229068cca4911e2207b47

Download Submit