hxxps://nitrohunt[.]com/clbYbTOsyooV/login

Resubmissions

28-04-2024 09:51

240428-lvp21sdc3s 10

28-04-2024 09:50

240428-ltzj3ach92 10

Analysis

max time kernel
232s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nitrohunt.com/clbYbTOsyooV/login

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1156	msedge.exe
1156	msedge.exe
1728	msedge.exe
1728	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1728 wrote to memory of 2292	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 2292	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4264	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 1156	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 1156	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe
PID 1728 wrote to memory of 4796	1728	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nitrohunt.com/clbYbTOsyooV/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96de446f8,0x7ff96de44708,0x7ff96de44718
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
2⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1384 /prefetch:1
2⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
2⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
2⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
2⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6564 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10540583013739621650,7010024036530091274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
2⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
106KB

MD5
c32068cc5af65c3041ba5d1169c21877

SHA1
4916b1ecb06fc8dae881723edce23c15f992c425

SHA256
d2236b94ac1e28588be6609b6320fd429146a70e97f37e2a4d70410cb15990ff

SHA512
f6ee1f788ea0ab74538c9661df557b9f1f81465f098a9021d73703a7fb5fa81e849b89ce6a4af8377972b3a39179860483eed32cf7277c414aa96b48344ce3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
223KB

MD5
bae0c275ebc3ab4e7a50be41487fd57e

SHA1
40cac53fb72f4db902974035d8743b8a59488d6b

SHA256
2134ee281a3c0585e5827d193d6a054ec81240e272d6eba7b3b6af43cddc298f

SHA512
bc44abb0d86dd3dc1bfcb2cc39b13eae068181ef7e7727b1c7573a25df8c2db377a799bc311d27b272046387d93d7c6e3fd548e5cba9473f32cabe71e621f5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
13767f526503e209c9a1458604781c01

SHA1
69f46d74078f62cf162748de057382357df05600

SHA256
8394b0458a90bdb1d95e9b7966cafcd7ae08abb7aa4f81497fe33ad2af918670

SHA512
0203a3b808d65849edd32f0eb212beb71d9da7afce8029493f5950755754180ad9325236a083643167bc98d10caa63118a91ec559fb763fb8de19db8409e30a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
9f684c0a711b6a46d4812bdd4dcb1386

SHA1
8d818662f6291e28d1d4c63fbeea5c7929d476d4

SHA256
b8f0eb20013781694888d653ab23b36186b2a6abf3cc73408f5404b1b61022f7

SHA512
3df8875222157093e8b8a239c360a9b4a66b3f9c82b443d2fe77f543ec1e10a68495c3bcecf164d3392f6160a1bf835de33b3791b23aaf4b08142c41a4f8023b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
ac2e8a4908ee649ded8ef4f1722a14e0

SHA1
dcdb7eb4162de98cc57980a8dd7c3a7b30740f5a

SHA256
510a41774c0266028419a28b1bda2f043d284582492b26de4d28a4895dfb0090

SHA512
685914dce8e4a3282518277de107157e9dcbe24b09ee7fc1867965db5db7f798e7fe314f3f74b14c90056fc4b58e43ab5bc05a8d8298380816cf00ee6ec27c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
331B

MD5
62ccf40f3d4dd1d3257b291b981db1e5

SHA1
4f940574f6617e497ef2057d5f157a04543a3f31

SHA256
9fedee53ba61022be51f554b1cd74d8efba3d0896bf849eb34e8e5d12f677ea1

SHA512
57dca35a31774e957dd1a92e94a93d94e409137980ecde8baabb27f3e404d36430229ca3fc2ab04c208e970ba8599b33de6d8f37be93d0e69ae1cd724fa42cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
694B

MD5
f7e05515f788ae76686a21523c9c3bd0

SHA1
0dfbefcbc94ffb33ee4da23a0be546a8a54351b7

SHA256
d3738224196fc6530ce3080562fc5ab894827f30b0635a784e635ce6c76a7ce2

SHA512
8d3e1fbb31410918d232caa2d883a3d2d3c01819060584bd40de729fc0606ee5d0680bb1f280b192519cb82e78d33331c26d732e9478c3837b4b4047d06c3a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
694B

MD5
9ca9dcc8f15048b65b6cfa237e692951

SHA1
c4354a08c00b944fdca988fcf4d88f84fe89270b

SHA256
520686eae0c3f35bfb2b7252f88f47b3de1beb797d846c3959eb116734374af6

SHA512
d3a21807184c49ea404e58dcac4997ffdd88ed118a353e575861e3f8477050f337c33a856f015c8be90905fcda9be15acf1611ae700ce33f19d5f41ab6e3e6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
cb424071d55ae4316c7f7c0b79f78840

SHA1
bf49df1a9177ddab697b70650309474c58aae09f

SHA256
cac88b484403d0c42c3f90036daedb8c31e4af7be0241c3511f0565740d388db

SHA512
1723debcb67b33d204caaee69b1e0975949a7a3febd8ed3e271a7a6d6708c43c60e86280ec89a88a0a78ee7eb4f1b1d051545742e15942c2a14902f9524350dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2ca3d702201ee4fcae94b1eff8f3b226

SHA1
dc96c59cc579f72dd01ec0925dffa77dc2621bd2

SHA256
8be8b4238aff47798f3fc794cb4354df2195190d3e591da3d7e46d7b31f8e7c9

SHA512
420cab510077004345b58340a58f273ecf0633dda147eed0aa3a819e7e0c8b831ddd2da4d675ccea423acbbefbb365bd4458ebeb999ee7a2b61885cab584cff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
3441ca0f631d0a377f41d039e03daa46

SHA1
3539089013118f9ff53088ace646a76e23b40896

SHA256
b2c030a379e24f28f24e8eb65e8b9a1182b28debd1aa7f9e9ec07f7177052e20

SHA512
fb7033c66df93b9f601fb79be859da0eb510d291ef608ec4c2bc8bc926b32e785a300309620b227fb6b315d639fc18278255442a810399f55c78982739ee6124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
79c0fc942618a236c82950a484bf9792

SHA1
79dcb341e2a0de72ff316c9861a40089118d93fc

SHA256
673393a16cab83e92fcdfd404389829873bea192c32c72544cd30c9f9f0f98ac

SHA512
c4a52c10a1e7fcd1c094c58faae641c000709385871d2aeed0ba4ec5d0725fa4f9a19a4fa8d0a7861540bf28bbce8f30e604d5565c6941a0a9ad5cabccd35be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
1d492cc70d7ab7f506655ad6a67a42f6

SHA1
e52f7255bf93aaab909052d4063cf516d45a2d18

SHA256
62d692fa527d76aef217365272776ddc823e435fa011b9c315d87c0d7cc7f563

SHA512
d1fb8a09c2d2dff6e766a0e14b4c48424d078207def455bbf8a782c3cf5ad99259b0b5b968aa4942dade5ddb2f489ee2748d263d34a86de81e33374301d0e91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
ae3ba82404f8190984100659f48468be

SHA1
43bed39c993d56c196a5da1572a7525d6f97a010

SHA256
710436a2dace35a49ac1de69ad717027b00365e8b84016b863bbf74fb9eb4fa7

SHA512
3db45268c59e9494494cc18bf76aa9948cd6723988669c1870a1e56bae6ed7b4581f3320e16235ee86bea0ad4dd929b4881e88c33a51a9077d24e757ff429812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
00ad33887d9c7fe8b9ea556edaca4f16

SHA1
b998048e8ae1db81c45020582bf7378979f858b6

SHA256
441b031b489bf911e727085cd20c52bbf2df70d54353931eb86ec20ab87a536e

SHA512
36240eeb08515ceca56dff29f08ba7a044840db9d7ce2effe4ed77714a2b738a72682b67ad278af52e8fdcdc6e41d1a60432ed52f69956e7283bd50b0d08964a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
bfeeb9939ce2c5f9865b7464682d5849

SHA1
acc3301afa2ffc9678c16cdaaa4a772be0c6ccf4

SHA256
3f728c57ad4ede922f5881d0b0a3a4124440be6db2f7de6ce13448401a8d3164

SHA512
e3e102628e1706d191f297a4915745a439cf21a4cd7f663b7226f9074a789ebc3cc4f679682c34d46dc2203f4c1dbbff57b49e62a5ca53551292378aed3e3c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
3c5d95a4e8b38d33840bc4ebef2385c4

SHA1
9b955ab73bdce521286ad7fbbfa0424fd5f8b0a7

SHA256
113e7deb3ab41ae33dfe7d4428623afa653d970b1596a9545314683d4397f698

SHA512
d2889db2a56abddf191e08ba1542e07f1f643491c1f7ebd6d2355331e556f5a906cefdaa5d957bb9c5b56e305dfe9fcef59b85685c31ae780c313406d07597c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
a22866908d0e7dd3f8505b1225a850be

SHA1
3e95d83da1194654dc88bfb7d539d161a33cbf63

SHA256
b9676b51a6466ed0d8aa29a90039d272e07eaa65c04ba0e375b759c51a6e12e0

SHA512
0a3b27d0775d5e3347d7369112aa0c24f89e4bae53c7ab1a5049bf581aa594e77459520fa24cbfb3ba50e1e164ec3d5697679b2f23e6d5d0c387205e78f67ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
731052e0e352708599cd2c36dda12003

SHA1
eb869b25c4803f37f11586498c38d6ee8b19f492

SHA256
69e28252eb508c8234c415e0656298257094c656e7e1ae11461d91f384f75a7e

SHA512
1f5a3ad4f4297a56b608cec50755f73e76fab75fa323c4c72c884c46a900a9e6f4d07a380fe3b93dc2775f2f29a7bc305ce516c32f16fa784240bdfd4b35017a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ae3.TMP
Filesize
704B

MD5
becec0975d6abae84b7025671c6a7944

SHA1
3854f9f1625919e4821be7bebaf58a7600643b74

SHA256
12fbc04f4c28daf6394c72ca860a9eec3cfdd8b3b588164268e42858ca58d5ef

SHA512
c534741949306d8c8569946addcf21e1e38409f21fd9265c08a919e0fe89fd4f9263c2b10f61ba1f0140fc1cd1222a2ac9ce02f5aad9b5975dca3c86ea1bfd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
37dbaf3ed9388980f27f5713f258a459

SHA1
e40aa514f06788c86c6255b13214052a48b4cb6e

SHA256
2bfa2517e9b25e4cb9fb54daea0a198883df676f1daebfd03aecc712c5d43fb8

SHA512
d1df7f07867525eb10f2886e6311a38b7d758f0789ec7dcb4fd9eead01ce577915b03656c5d22e482bbcd4833c8b514e1f9a28bdaa6e211b454e42b67cf821f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_1728_GXLGBBVCBQIPLTYF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit