hxxps://surveyspin[.]page[.]link?link=hxxps://lancelot-fa22c[.]firebaseapp[.]com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhxxps://www[.]surveyspin[.]com/?magicLinkEmail%253Djessica[.]hoffer@snhu[.]edu%26lang%3Den&ibi=com[.]socialloop[.]spin[.]SurveySpin&ifl=hxxps://lancelot-fa22c[.]firebaseapp[.]com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhxxps://www[.]surveyspin[.]com/?magicLinkEmail%253Djessica[.]hoffer@snhu[.]edu%26lang%3Den

Analysis

max time kernel
68s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://surveyspin.page.link?link=https://lancelot-fa22c.firebaseapp.com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhttps://www.surveyspin.com/?magicLinkEmail%[email protected]%26lang%3Den&ibi=com.socialloop.spin.SurveySpin&ifl=https://lancelot-fa22c.firebaseapp.com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhttps://www.surveyspin.com/?magicLinkEmail%[email protected]%26lang%3Den

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2727153400-192325109-1870347593-1000\{E49D819F-0A56-4CC4-A173-B430A8682C0F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4580	msedge.exe
4580	msedge.exe
2820	msedge.exe
2080	msedge.exe
2080	msedge.exe
5552	identity_helper.exe
5552	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4420	4580	msedge.exe	90
PID 4580 wrote to memory of 4420	4580	msedge.exe	90
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4872	4580	msedge.exe	91
PID 4580 wrote to memory of 4268	4580	msedge.exe	92
PID 4580 wrote to memory of 4268	4580	msedge.exe	92
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93
PID 4580 wrote to memory of 2800	4580	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://surveyspin.page.link?link=https://lancelot-fa22c.firebaseapp.com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhttps://www.surveyspin.com/?magicLinkEmail%[email protected]%26lang%3Den&ibi=com.socialloop.spin.SurveySpin&ifl=https://lancelot-fa22c.firebaseapp.com/__/auth/action?apiKey%3DAIzaSyBWMKFpeIh5jAXhXiVNqCgNyFIjbbwV6aI%26mode%3DsignIn%26oobCode%3DP_tJuC1Cgl1NMb-luq0V31MObJmjvXtGLlfeFkbft0sAAAGOKOez_g%26continueUrl%3Dhttps://www.surveyspin.com/?magicLinkEmail%[email protected]%26lang%3Den
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbccc46f8,0x7ffbbccc4708,0x7ffbbccc4718
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,358482879800554036,1137502447773037983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73c8d54f775a1b870efd00cb75baf547

SHA1
33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

SHA256
1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

SHA512
191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ca8e38dd590d745db6a1aa451d56f7af

SHA1
7f6b66ef8c6438d259680adc436894b0b58d35dd

SHA256
69018e1267100674b9933ddfcb043946d0a77a6458625c17658d62043496e81e

SHA512
c6101855ab5a80cdb3f02031006b81e2c0a2724b6403dd13f3f0fa4691e1bffd5c5df4e7bff749b22a617124a03094e1ef671a39931ef6dc106981a0f12f2f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lancelot-fa22c.firebaseapp.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_surveyspin.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fa92f5d17fea1bf32cfc677b54cc83e

SHA1
a3e1d6ed73e6eb679769134ae5dff8cc98ccc081

SHA256
5d83ee3891491c929a18e09eabcbd78a95b5d2b32d83a3b84ef13f6beefd6955

SHA512
56417c951a1075dc9618b9eb6c61b9739381134d8e2d79c8fca60130d14e46354a2b89c765511c4aa4879ee6c6703aef06470721f45f4ee024817282ba198086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
327614c92d9cdb10bc41d25de5b7de1c

SHA1
adfaf19c73f97d17c2b98fbfd4e32bc2c5a6a63b

SHA256
8e23398366a0ad334166e99e17704a94e68c99cfc278bd2440068922ff919cd6

SHA512
cb84cf19ed3beb7e66babd0874ff830f9b0c2fd271d12356478ff1d585e2592536967e371935716b0cb129790d75a019105dbb8dc539dd668a30a2deebb4120c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6e3cc5bb588d8f23c670ed239a2370a2

SHA1
23dfd485cda31660116363fcd62033704134050d

SHA256
7c7e8b8e121e926be3f0ed04093819b17f21f804a4d55eeb6951c5efee87807d

SHA512
091609c17491f30072427aa99bb702fc4562d75e248c2b14f0416cdeb5bbe373f0a6a1f6c3b2a0ad10ca93859f3a87bde1342d202b8d05a1bf4919f8448e1452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
790bdda4d6d47df8fcf92e67ccb62822

SHA1
2e0d5425d4153a8d859ebf343663ec8518f53cf2

SHA256
2b5a0d8352922c638c1e9137dda325dbfe39ae5bd0c67a623672a8d0dbe1ee62

SHA512
6cb03863c186ff1bf0a28825df4a19be7146abdcf7c5a087b6edb0b603b1bd488035adb8b3bae85b10cead9f9177164d600019b2a3039fa06ba12d0d11a51505

Download Submit