hxxps://dumps[.]lol/

Analysis

max time kernel
112s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dumps.lol/

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
140	api.ipify.org
141	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2972	msedge.exe
2972	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 636	2972	msedge.exe	84
PID 2972 wrote to memory of 636	2972	msedge.exe	84
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 5080	2972	msedge.exe	85
PID 2972 wrote to memory of 2352	2972	msedge.exe	86
PID 2972 wrote to memory of 2352	2972	msedge.exe	86
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87
PID 2972 wrote to memory of 3152	2972	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dumps.lol/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffb7c3846f8,0x7ffb7c384708,0x7ffb7c384718
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1360 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7620 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2367614110478406032,4337555500636839232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x4c0
1⤵
PID:5248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
58fc85091467d46210a2228778205fb3

SHA1
657e193c6d64dc5cb4d1e147e1c6ddd2e075dfa9

SHA256
3a7924a13320cd3e461250df029a0f9962ac5100f87688c5631eb47470c6def6

SHA512
3540cd1fa2205dd5380499d9c2a3557254e2f5d755f0aeea61e20de530e45ca1070c73abed715f23b03a58bc90880e342a5c4e9785b7a9a90b66c1b360772f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10795f71ef35e592ec65b2385f49eb38

SHA1
645225a5735627db67945187cf73aa9a4ca4001d

SHA256
d3fae3286b569d5200db2dec7483ee6d686f690a8966916ba3d719f551608b40

SHA512
1410999cd62e6e557f338ed503823bff5bf07f3313a55fcaf5ad65ac2dc28a6babb3898e150e833c1f983e3d4b8c0379bc81b548baf29d079d32a0bf17b27724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
19af982f21319ef5fe8fb67b79011205

SHA1
314ad8a7ef8b071067b57a3aa947b59e5267912a

SHA256
3ebbfb77d8f989a1d832fd02f24153d141373570a0595798a63b60fcf06d12e8

SHA512
b692f00d60b8899f3cfa17b23fa4699c0d748c96c0a6e8163a606d8527eaf9f78cadd7780c484ba3c51681a8d2cab2320b3595441b1ed0548ab273efe296d994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cff13e3f9b2ba0680098a4f360e14afe

SHA1
a728a071675af16ff327ee5decf24c7e7f88ab3f

SHA256
5c0f330fdee85bd9fc02547c96b7bccba4c547cd3cde65dea6bb40d1dfb98d22

SHA512
d853dc13d1ebad9d9b745d9df819d31088c2f3efcbe01e0173caf9a98b5b852260d1cfd76d847a53bcf7c922ad4bc95675929c6722bfcfb2d7c9a2a3c40e0ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e27b21565dbf01323167456b1b66d418

SHA1
5ee2bced3308da2dbb43f1b1fe27d9483bd1f83e

SHA256
d9960f3574600b63d91eaa042482f45ea4ac4ea65bfb0c021350df0c00aa9c72

SHA512
1dbdfc3cbe4bb266c272d62b530cdb510957232e6391415dd64921cefba6485ef03075d8ad7dd1e5c8a4eeb22b82c7c64760ad369839ba546078463bd8444a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51a98af0a982180d00713c9443bc524e

SHA1
a6f4804a3b78c0b8508ab4a0a35ddae90b647a5e

SHA256
fb6bf4e9b70c2334f5012ea2dc768aa6ac6835ab3875e9c01c18a892e98ecc59

SHA512
abf728007b1fecb5cb8f94f4e10713ba13e4f79d5c295642ba138068d25f9f02aa71772d46b6f42535e8258e0eac3719722b1e3c5e4382bb72dea298e9c64b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1ec77a15ba6b6648f8bb9e5da81cea38

SHA1
472bf6297b398e32760012165f055079bd1a5619

SHA256
7203b1ba72e0b49f9497b98c28a0675a9164445895053e09cfe04f0a8231c7cf

SHA512
8ee7632528d6d1c33ba66516268757dab7f474c7756bd755d0a2ddad9cf8f4fd250c2c091e55fa52b983c2be38c239319c62aa7ed3b5b4cef7cfa54505156603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d9ad2f01912b9ad85677e485ce3d238

SHA1
b1c853d163cc87be878e5e529e913a10226b0eea

SHA256
bb1a6ea3a53076a6a8c2eb055d5d9baba49c54eb6ac960eeea1ef0cca485a521

SHA512
ad5dde242ccefca353afefbed22ef2e5f9fab9f4803b12b718dc3ff0ed80ce96d42c8a1a22813352c830d6e20b28a4980cb9f43afd8a825cae920230c09c0e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\44fbfe1f-f26d-49c2-bd89-e68ef4fb6ebc\index-dir\the-real-index

Filesize
72B

MD5
6f9584532d90ad3f47f2261968804fc1

SHA1
5ff8b3d642703b3ec77dce09c3b896e9ffa01931

SHA256
0bae25d3923cfbfdf508510fec52fda13f50a75def6ae77cb2b0540562e41357

SHA512
18bea527f71a39060ef1ec14bbc89c19301f3214e25ec0c51c2041e5b988e0f995a3f5852fe8264ddd345d2b8fff8274a8675f48c2fe15a473692013889a608e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\44fbfe1f-f26d-49c2-bd89-e68ef4fb6ebc\index-dir\the-real-index~RFe588076.TMP

Filesize
48B

MD5
b7318bb7cf81384d3a645c6708083148

SHA1
25480911d1478e4581820803b4016cfa95b733d7

SHA256
8156e4611fb59297606e67ae2c52076cedbfc67435037eae21a5b51f2293039b

SHA512
dea913bbe2cfe39e2a45f92ef791b03653b6540138c5d21508cbdc69848efd224669611f094671960fd778bc9abccb19d9f6d3b4db3282652319f0176fc208fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
86B

MD5
2ddad590ad9c881385a442e96fc1d90f

SHA1
a32d536380ad00d18183fb9714f4eae74e0f4977

SHA256
a96f254447b6d73813b1f636b717a74f6d192e13adf8ec0912cc3bfff267d96f

SHA512
c3473f97c61ab220ddac07f4ad7a7da1b23f671f568edc85c19d96b4166336c3ff1ca72f714872a33c79c9563fab33782545e6fd4134df82fb7a03ae8e0c46f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\016523c449929e1ba4b2689b8bfce5aae7410194\index.txt

Filesize
176B

MD5
945598b53b6c670991ec6b893c676532

SHA1
e386f3332e3e51311c233156843a3a64c210c975

SHA256
ec7a758e8024b36ee3172c506288fc7beeb58bedae684dc5f72bd50857ea85df

SHA512
00d53d20eb183ba698fd42d5c4742e3ea24b7c4b695a249c8d3793e255d26f898539ebb1291e0825b91f4da89e6d21e474c6cc5bef9c8ba34375b12009625613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
b109742e060f6008d07aaa53762a64a4

SHA1
bea92328e5b2c43d725f3d87cfb761d745542cc7

SHA256
3b378fd9084bf492801493f332f2e1506c89bc0cd528f807194bdc09761d2738

SHA512
1c3990f197980af8b25ffcaae10b80a6dd2bff46a11db27c8acc9e4391f62b0eb4480844f24aed69402906d3de9c44424dd15392c0c1f55803dc04ed04359e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a65d.TMP

Filesize
48B

MD5
d130b77505dc222de911e7cc0f92f070

SHA1
db5d14fe4fab4b4ff5df58d6b4071d933e40cfe0

SHA256
73c1a53373c6f6ae1f926460390e25c584c19d6f18f059453c50dde3c51c7c36

SHA512
e1a08eda84ba27b90d70af09704402cf0837a6a54c2cd0313b50198b123cbaea27560f3d4b0d40f4407517591ae15f685c8e6a1a797f8d19eacd24b290b1fe8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
adcce697947b969310d3988bbc7dffc9

SHA1
6f5dc24b70ba646bab28a6e9235a50f080d6097b

SHA256
00cf6f4101c01fbcb6f05b62248100db419ac9164168f5e1b23cb172d4daab57

SHA512
574675eaf46389aba6ff7ba541f9e83ccea7ad3d2af2f4191fdf41b1376d7f41a3c967a55197d348d2207d6c1d6fac4ef189cc54f1bff47b1f1f17569aaa6557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d36bbaffe18c3ef132a238a2cc715922

SHA1
8144e5ba5302a5dec2db0a98f9235494ade62e14

SHA256
a386c046f46f5dc8bdf7a8a07bbeda3ece965262534f171fe8e9afdd2b0d8ffe

SHA512
336ee497a7f70189ce82d2ca586b5626fbdeabd13c47108f1b53ce22525a0e934a69c01d619945536648af77b7c4121bfa9154d548a27a6daa26f9f190f1e0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
35b3018f007eb6963dec8622e5f86105

SHA1
84b2559b03858a87ffada3694868fe41bd0fddc9

SHA256
4cdf0043758c0c564baba42e3fe616436f7a52dfc3632fca4d680a508e8eff17

SHA512
875dd1c96c43825477c026c78d256e19d99f4f12db6c6e2cf3a23d98db23d7cc4fc841ed2e19b9ed05be1a766fddb2e88bd45ff16f9169f045c71b458e6ffa53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2e660f067e04095ec390aecd20f019ff

SHA1
c981ec1819ed4f7535dbc73ff9b398b485750d0f

SHA256
a8bb70285fc52b82be1b7d32b713d15878ece94885111c1b29ea47f964c1a9d5

SHA512
788682a1dde2b607ba33f382954e6e62d3b53ecec7fa04e00f8da922f8bdcc28b1d7b8dc45dfab0238645b61e5f6ac056288ed66c1351f88352533ce56459a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d91.TMP

Filesize
1KB

MD5
1006ba31f3b3c2f094caf136d2846ee7

SHA1
f30214f6cc63340e605a976ea5cba4cf85b783d6

SHA256
2f1f7d7d814dc6f3c71dd99c59043446e17efa8f61dc995b079008f0223e0176

SHA512
a786f0229f0084874b54f1ec908b66f923b194c79c754f807163a89e4d08d1a1eb2aa513fbb5b24abc8edbe534082313920cce515fa62650a577d80fd5dd4b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24fbe2ed6450c305b9b2575964e31b79

SHA1
e05c08d99f3882ffa977f0904db0f0cee4cdbf0b

SHA256
4eacbc3b3d7c6ea959adeea7a4c7f8b2e84ce89010326b791f7d8d21e85c1060

SHA512
de2ff9e6331cbc432d72c9bc587cd66912d32265807591fc256440ed89e9210a967488f20fc8f56afa7af10c598259861956a00e49d13d3d6d765d5009428314

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
179ba7f026a05a919bc692d85f01030b

SHA1
89103c286e9485fe69927af8f8c9a68cfd324b19

SHA256
740edc929577e2a59247feb3b65d89b8f6ffa8907b6191f5d10f624c1017bcdc

SHA512
ee052b90dea3ec7eee3a5991316dde36cfbb015ddd4068a9920f7781af8986d87df7d513d8e243ed68ff54dac7a1e11afd553673e2bf7fa68384c5ead1486ca7

Download Submit