hxxps://google[.]com

max time kernel
261s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 10:26 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
1748	msedge.exe
1748	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4508	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	taskmgr.exe
Token: SeSystemProfilePrivilege	4508	taskmgr.exe
Token: SeCreateGlobalPrivilege	4508	taskmgr.exe
Token: SeBackupPrivilege	2408	svchost.exe
Token: SeRestorePrivilege	2408	svchost.exe
Token: SeSecurityPrivilege	2408	svchost.exe
Token: SeTakeOwnershipPrivilege	2408	svchost.exe
Token: 35	2408	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4176	1748	msedge.exe	45
PID 1748 wrote to memory of 4176	1748	msedge.exe	45
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 4292	1748	msedge.exe	87
PID 1748 wrote to memory of 2232	1748	msedge.exe	86
PID 1748 wrote to memory of 2232	1748	msedge.exe	86
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88
PID 1748 wrote to memory of 2608	1748	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf6ad46f8,0x7ffbf6ad4708,0x7ffbf6ad4718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

Network

DNS

google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

172.217.23.206
GET

https://google.com/

msedge.exe

Remote address:

172.217.23.206:443

Request

GET / HTTP/2.0
host: google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

19.53.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.53.126.40.in-addr.arpa

IN PTR

Response
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.179.196
GET

https://www.google.com/sorry/index?continue=https://google.com/&q=EgRZlRc7GMbC3K4GIjACUlffPUmuaMDql8Qpiqo_yyu95D1nVHFqhUaJmengMQaBbCIOAaoFoJaEprsRTI4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

msedge.exe

Remote address:

142.250.179.196:443

Request

GET /sorry/index?continue=https://google.com/&q=EgRZlRc7GMbC3K4GIjACUlffPUmuaMDql8Qpiqo_yyu95D1nVHFqhUaJmengMQaBbCIOAaoFoJaEprsRTI4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/2.0
host: www.google.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: AEC=Ae3NU9PesJCWwKNLmUe54bRykcnRTykiUtHe05DWc_kZe_j7SlB-3L2nZt8
cookie: __Secure-ENID=17.SE=AGGyBsMRQj1d3-KiiwHlhe_u91LyHEXCJMiYXlT5uLSsZCkambzwTFqrxd1tdb0NphSFX29-BRHl5906fMis8VvTm8bIPuhkyckzGlf6gDXEOLb4bSPBaQ26mmT0B6VeCb0cqrCjf2N_i8Bstp5ss4u-aK_6qK52DNyTPC94zjY
GET

https://www.google.com/recaptcha/api.js

msedge.exe

Remote address:

142.250.179.196:443

Request

GET /recaptcha/api.js HTTP/2.0
host: www.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRZlRc7GMbC3K4GIjACUlffPUmuaMDql8Qpiqo_yyu95D1nVHFqhUaJmengMQaBbCIOAaoFoJaEprsRTI4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: AEC=Ae3NU9PesJCWwKNLmUe54bRykcnRTykiUtHe05DWc_kZe_j7SlB-3L2nZt8
cookie: __Secure-ENID=17.SE=AGGyBsMRQj1d3-KiiwHlhe_u91LyHEXCJMiYXlT5uLSsZCkambzwTFqrxd1tdb0NphSFX29-BRHl5906fMis8VvTm8bIPuhkyckzGlf6gDXEOLb4bSPBaQ26mmT0B6VeCb0cqrCjf2N_i8Bstp5ss4u-aK_6qK52DNyTPC94zjY
DNS

206.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.217.172.in-addr.arpa

IN PTR

Response

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f2061e100net

206.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f14�J

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f14�J
DNS

41.110.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.16.96.in-addr.arpa

IN PTR

Response

41.110.16.96.in-addr.arpa

IN PTR

a96-16-110-41deploystaticakamaitechnologiescom
DNS

3.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.214.58.216.in-addr.arpa

IN PTR

Response

3.214.58.216.in-addr.arpa

IN PTR

lhr26s05-in-f31e100net

3.214.58.216.in-addr.arpa

IN PTR

ams17s09-in-f3�F

3.214.58.216.in-addr.arpa

IN PTR

�7
DNS

196.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.179.250.142.in-addr.arpa

IN PTR

Response

196.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f41e100net
DNS

35.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.36.251.142.in-addr.arpa

IN PTR

Response

35.36.251.142.in-addr.arpa

IN PTR

ams17s12-in-f31e100net
DNS

9.228.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.228.82.20.in-addr.arpa

IN PTR

Response
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.a-0001.a-msedge.net

g-bing-com.a-0001.a-msedge.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=18BBA5B4F2A367D6202FB199F38466E2; domain=.bing.com; expires=Tue, 18-Mar-2025 10:26:18 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1A224E793D1A4E638F6E6E00A6476FCA Ref B: LON04EDGE0707 Ref C: 2024-02-22T10:26:18Z
date: Thu, 22 Feb 2024 10:26:18 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=18BBA5B4F2A367D6202FB199F38466E2

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=dJ88JftKCdyH7E-JKgMwXnOohn00SYDoRJOlpW13VDM; domain=.bing.com; expires=Tue, 18-Mar-2025 10:26:18 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BFF0F6D0773F4D4D9175A67A9C104746 Ref B: LON04EDGE0707 Ref C: 2024-02-22T10:26:18Z
date: Thu, 22 Feb 2024 10:26:18 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=18BBA5B4F2A367D6202FB199F38466E2; MSPTC=dJ88JftKCdyH7E-JKgMwXnOohn00SYDoRJOlpW13VDM

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 918B9252FE734354893A89B958F0AB5F Ref B: LON04EDGE0707 Ref C: 2024-02-22T10:26:19Z
date: Thu, 22 Feb 2024 10:26:18 GMT
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

180.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.178.17.96.in-addr.arpa

IN PTR

Response

180.178.17.96.in-addr.arpa

IN PTR

a96-17-178-180deploystaticakamaitechnologiescom
DNS

29.243.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

29.243.111.52.in-addr.arpa

IN PTR

Response
DNS

152.78.101.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

152.78.101.95.in-addr.arpa

IN PTR

Response

152.78.101.95.in-addr.arpa

IN PTR

a95-101-78-152deploystaticakamaitechnologiescom
DNS

12.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

12.173.189.20.in-addr.arpa

IN PTR

Response

172.217.23.206:443

https://google.com/

tls, http2

msedge.exe

1.9kB
10.7kB
16
18

HTTP Request

GET https://google.com/
172.217.23.206:443

google.com

tls, http2

msedge.exe

1.0kB
8.3kB
10
10
142.250.179.196:443

https://www.google.com/recaptcha/api.js

tls, http2

msedge.exe

2.7kB
11.1kB
20
24

HTTP Request

GET https://www.google.com/sorry/index?continue=https://google.com/&q=EgRZlRc7GMbC3K4GIjACUlffPUmuaMDql8Qpiqo_yyu95D1nVHFqhUaJmengMQaBbCIOAaoFoJaEprsRTI4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

HTTP Request

GET https://www.google.com/recaptcha/api.js
204.79.197.200:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

tls, http2

2.0kB
9.2kB
21
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=02eac3a1c0174ec2aad40322fabb36d6&localId=w:D06FDD21-0688-C1AD-9F80-005D3EDFF72F&deviceId=6825825698385754&anid=

HTTP Response

204
52.111.236.23:443

322 B
7

8.8.8.8:53

google.com

dns

msedge.exe

56 B
72 B
1
1

DNS Request

google.com

DNS Response

172.217.23.206
8.8.8.8:53

19.53.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

19.53.126.40.in-addr.arpa
8.8.8.8:53

www.google.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.179.196
142.250.179.196:443

www.google.com

https

msedge.exe

7.0kB
51.1kB
39
58
8.8.8.8:53

206.23.217.172.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

206.23.217.172.in-addr.arpa
8.8.8.8:53

41.110.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.110.16.96.in-addr.arpa
8.8.8.8:53

3.214.58.216.in-addr.arpa

dns

71 B
152 B
1
1

DNS Request

3.214.58.216.in-addr.arpa
8.8.8.8:53

196.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

196.179.250.142.in-addr.arpa
8.8.8.8:53

35.36.251.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

35.36.251.142.in-addr.arpa
8.8.8.8:53

9.228.82.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

9.228.82.20.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
158 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
224.0.0.251:5353

msedge.exe

136 B
2
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

0.205.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.205.248.87.in-addr.arpa
8.8.8.8:53

180.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

180.178.17.96.in-addr.arpa
8.8.8.8:53

29.243.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

29.243.111.52.in-addr.arpa
8.8.8.8:53

152.78.101.95.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

152.78.101.95.in-addr.arpa
8.8.8.8:53

12.173.189.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

12.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ee8cf9571058a313043800dc955d4868

SHA1
43d707f49bce0afcff53b406bc5eb79e94ed51d6

SHA256
af8d451b828b894e2c359d06e89937154c3e7502155b85ce28858f4599b3a4f3

SHA512
b262eeefdff4e67eb51cff3a7ac6e8aaf7da2a389a975afcbb62ec437cf3f1b05733cf134c7ca8cf5b30d99b195c728b12b2ff0c7d2f1f0a0a5a272301483ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1003B

MD5
d5910ac16ee2e4d8519473392a66bb60

SHA1
2ae08814b15cf6bab00b17b5349261300e1c9f7c

SHA256
0e5c3f0bdf33d513ea812cfc80d6a43e95fd405fd3a888c68363c6991309009e

SHA512
9cd9fbfc1dd5357d288b9eaca3e299b113695883496ddcf5ff9c7fb710e03284108065a674bfba87d958bb6edc135238949b6137f85f4d9dea5e1d5e95a241c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c6950f4bc822c827973530c15c32d86

SHA1
55eff71a1f46f3ea8eb24acd3ab854187f6fd30f

SHA256
6e22fa4f76bd02f0a57741e0d10b10bf5feaebf42d6282c03b392af4c34ddb25

SHA512
5071a84931d3556cca80cf82d77320004369fb8d5fdc887934057d1215d07a287251f9676cbc58d2004dc121a89931b41e80715ce724b3f187f6dfb61d4aa3a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ea8675b4f0618d0ac9d27e47b19aacb2

SHA1
942cff425519ce686845e467d53ac7da47df7393

SHA256
8f4395f9fd9b4411a947750ea98f04e5167f289905e9faac352a177a695dcea0

SHA512
985afb04a2a3bd74bfab433f86b62ddab74049e6c23c62d61abb72401f09d272bd228065e705257fbf4210731b5434337744e5fcffc8ff49782da574745b08b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a719cbba5e8149458ad14aff4826799

SHA1
7f44eee9a1f859e5788d9ad331132b888036f394

SHA256
45e5e0ad59d99f9ea24fac450eca3a57da65a8bca862ad9861ca65ad965b3cb2

SHA512
03ca9c45d3afe5682fef1533da87d0329e5e33c241f40f5edb5f8e692377bbbc85471a3b910b5570bd7fe1cbe91a3fe0b00fd4d715f3837d398a10f82cfc935e

Download Submit
memory/4508-145-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-146-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-147-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-151-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-152-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-153-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-154-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-155-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-156-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download
memory/4508-157-0x0000024C65210000-0x0000024C65211000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.