hxxps://roblox[.]com[.]py

Resubmissions

14/06/2024, 00:55

240614-a93e4sscpj 1

14/06/2024, 00:51

240614-a71hqsybrb 1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://roblox.com.py

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
880	msedge.exe
880	msedge.exe
1960	identity_helper.exe
1960	identity_helper.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1156	880	msedge.exe	82
PID 880 wrote to memory of 1156	880	msedge.exe	82
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 1756	880	msedge.exe	83
PID 880 wrote to memory of 672	880	msedge.exe	84
PID 880 wrote to memory of 672	880	msedge.exe	84
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85
PID 880 wrote to memory of 2740	880	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://roblox.com.py
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd90b646f8,0x7ffd90b64708,0x7ffd90b64718
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12779522784535009392,9249920623997288785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
28KB

MD5
4c255731cbf559fe8bbf5e153ffc215f

SHA1
837262c5d71e54d1c834a01d489fe9181bbaca12

SHA256
287d47abb4af3a340290b18ff132be5522beb5a5b5cb259f035c891ee223493a

SHA512
3c3f45935e1d6b145cbf9ea48a809e45d5828c8c20c51d733d3386e3aca592a98f85f5ec6f53655e1b930a8423a0752268e52f47af4bd4c89fa131b423e2883c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
bc4dfef90840f715996c2612e3a9b549

SHA1
c66994ea6bfc6c638854c2bd9f177d9f7e3cd795

SHA256
332636b0a79f59789b497138dd3d18ce9848934a7b9c5549e84d4bbc8f8f000f

SHA512
6eb022140968a657cc50f3b9819b3540f35bb30979e2b68a9fd8e3971cbf582c2d27e5be0550e6d7eaa5d65d01db1eb5eec9cfcb2245146338240dad391375f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7ce3b90bd3257e2cff1627b633fed06c

SHA1
6d916c5d88cc383315db7a3a003d93446bf8accc

SHA256
4d9db7f9779d933b4f93f379c89b9f926ed2f071676dfcd175cbc47fddf3b620

SHA512
16db58ffbf807664e6c69d909f0be2398a2213985d82fee57a0fb918f7f2810b18e8efe0a40ecedf66e7711ad2cac7f2f82611413a51cc9d39b4bf895deeca39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b1fd8ca7c582e7f73396ace9e950096c

SHA1
c4f29bee30159dc6cc2bef4402eb36adeff6c5a9

SHA256
e0f2eb194093caae65a574fe61a6a724cca6f9a84b9cc8d38c93bb5a4498f31e

SHA512
c2c1345b5a444358bebe35e371b6f4e3018d1056854e698ea961c89d8d533c0b224b660ffd629016852d34869d240da4b1f3239386f3d040c2e0a807214e207d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6a236473f9d71cf39b33c2f47389872d

SHA1
9a14adc9fb62d6f48bc371e53168e9fd82c9b58b

SHA256
8dbe4b196120d8ee9f62419098239a6ba092ad5157a2655a1ca01d43643b8668

SHA512
2211d8b04b20e3c85c9f0a69e256ae1398c3bf48e0c3140ba5c3531e5dc128116e15587c80a9987715d576b2246877d4cc09bb3be121dd0dc0361e1c3c125d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
512B

MD5
88bb4d29a8e1a19829ea82ad7ed1ea2c

SHA1
6e799a3bedd909a2dbd9f4be69fe19ea7d76b00b

SHA256
03de75c20254d0e3fac430ea0ac718269753c45be131e18e9ceedc986c60c2a6

SHA512
f34f7a75a5a22c214de5c68ab44bc6227ef5abc87ca858c322a422ffa09072bfe5fe4bb4bfa8f1b6b439658e11e3012082105497179bbaa5b1ad757c48ab9454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e68a47c70a6f546b8b33612ba4a3a9f

SHA1
f428055fd5aa6d7a8ab5ec049c54ee9cba070fd8

SHA256
ac08b5c884b2e33872ff2bf7125cc701b0e8d0ff6edf18dfeb247f55277dc420

SHA512
5dfe76de4afe686b5e507868a08c0d43dc4795f95b90d945e43be26852075755821b9e2a0881ed054643789e849162a19e48d2c213f05f27bce4eb3720bcf5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf07ca676b4cb3eb6e4c148b70975a49

SHA1
fcb2d708bca6df5b17980355ed0a4f254300b524

SHA256
b984c909b5ca6131df0b683c1b2ee755aff36a26b2539bf711d9474879ecd72f

SHA512
0d2560ad04504348ec603c5901406f8cd8d32b016f5903f31dc528bda00ee1359ac4df8fae36974119d146e83afe82e90c5f8f46f60564881aae4d947043bce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd6baf5f2ef7667893fc1ed5cdbf5cc6

SHA1
cd1135bed1ee260aed6c872cb8d6de71625aa0d0

SHA256
265fbe9f681dc38450efd368fec7543191af57fcc7860167adb232e458d94d5b

SHA512
dc59d9cfba0a8ffe8288213a15a688a4524f7132106bf7da369da43b8dfea156846af5bf69e41bd5abe91b5ceaf5f19b0490a52ec85ac86c87c004233521eaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67ff55e2996e07859d833b2d8c872477

SHA1
43abb505b9a64a15c612f930c8e6c3a001a10e41

SHA256
1e3833d68a86ab7ce080b13a45b2ab4e78a6422c4a8b0f5ef3d5be87a6b6abb2

SHA512
16c98d957ecbdd23c3df78619029b46a1abb7914919bb50b613c9c322aaa7bb3887bc172c51ecec74a1ebc13051f0947710d48589b73903e0082238ec000007d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d4c206c7ed96cd63043805c30438134f

SHA1
7bcc8a06d1bc83df2e805a2e4d56539d6d7a42b9

SHA256
c9cd66bfb7ac9ac47016cfb6c0bcda9c72c09b476a29dd52b7b22adcc925faeb

SHA512
30f2ef8f05db731a8cb154ff29a4529df1ca4222a6d84404256b8b5509d662b2f64ad2bfae55434b3ab0b65cdb4da1a0157a272c5ddfe6ea355c657076683f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee9bae57a615b08ac82758545a6399cc

SHA1
2799cd4c963527562d37a16a225d281b831d5dc0

SHA256
3a0acf35d12a177000db28d8737efb3da67557fd71ebc821c61055ca22a4347d

SHA512
4a1765f1784a572bca0f382032d048c823d8b862954b1bfb931b9009bb01ceca5c2c12a0803af643c4a383ed82767ed4f1de60c41ef9f91d2dfeb5786bd5268c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9841699342becad4fb88134af22366fb

SHA1
a4f0c02d75581e257605f583896a06b84168205e

SHA256
f4d2027a3568ed7a08f2206b86cd9f1581aa3049ae98c76e1cb124859d3bab4f

SHA512
3ab951902fcd71c314b5aa7662b47747d60d4164dcc14f3ad181d3324bcd78d1006640cfd65db859e01c26214a31e7addb2edf455ed88ea87216780f06808790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2f4a403d83900dc08079a20f4df505f

SHA1
46b398048c236f87b4e29a85943fa47b715a5f74

SHA256
51a21cd80c69378fdd4ceaa9de7e19fffb3dcde7c755475f411f07613896f8ef

SHA512
56b2ab675f07932c70890dc0871782fdafa2dd0e8e575ca6719b10c419eb32925d002021f767b34d8b2346a5793597fdcc6021ab9a024981a4b1fb8d80186e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
c404c1ea7442e3a33300c55b52003104

SHA1
c2a458267ce0924df186a0333d30fe9c6ed8db8e

SHA256
81789a594da8bba05f7eb0a6a1204b2e39456a77a061642a122b640cde76173e

SHA512
adebca8d92fd2c9f531d859a86e9f6cd15e7657560450605badde48173fb553e19fafac9716c0f581c969449539b44e3ad8a0d147e3947ef894843cd0ddd7ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d29e5e43f458197e2c25592e02a86a47

SHA1
87ba0dc2eb078a56bc0a0b1146609d1429d1a229

SHA256
0adeaa1139cbd2b2bd028f9770d26656183d0ee4d2768b5c6688a314b013cf8c

SHA512
6b27f2eb15c87952e142ab1dc6af922888296dfd9f8fbd5e267090c20098b52417420d98888f1e9c39cdab9a382d828a5b78b04e93370b34d0446cb21066f58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
babff0d12c4947f999b860f80e49e7cd

SHA1
07e1ec9073a319373b54394c9eafaf0d7c92d7f3

SHA256
95908277fe7a7ecb6d45d47ab59e73417bbff24689e67d229ffa38d90a8b15e1

SHA512
a8b7235a67b5530962dedba187aa24818f2ea0d2e1c1c14fbcafb836a0fc0bf51db5d52ecacaa15b89e62f22263f1f03a4210b6846e3b9dad2d88400102524fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e5dfe1b9d6d0d2e278aa0f1f3b4d29c5

SHA1
83b2ff01ef5e0e4079b7b4b4e8df15ec041c1351

SHA256
c32e1691d77e9d4a51362b9f0896d7fbac976137bbed25432113c1626a8f5e28

SHA512
9e05529ce2a693dd625d0ad09f7f77e0b33469a465fb6deaaad693e3d537fcd136e991de521a66744d78f9d3eb82450f8daaf82550480fdbb336bfacde6059cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ded7.TMP

Filesize
705B

MD5
f4b2ffcd70bfa13bd89a8dd6389d56cd

SHA1
967436f6d2a5fd2d0b8e5a42ff1a4246338e475e

SHA256
76ebdede1ab676e6e6d624a11f689950631273645b4b6e90e72c1d867407fd20

SHA512
7b93af33c75866bfdb4bd0eb75b5ca293f7fd5d7ab3c34ce0fdec9b9cbacd6c1f23ddc0679c6131ad8ea54a42294d094723b220b8f10bca796ae20ddd2a11ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44569d088c52d75e0474d7158e8ec420

SHA1
e1768a3b9ce28d50dfb7ae8eed1f204b89429fca

SHA256
2c08fb08c37e8a7d97f2360910b16682b24f753ab3e0dae2bad797edd864d515

SHA512
ce0bff6605ad60f9895b7b1867c54cc25a04eccd2b1fd71c27d8042601bab707c0b0a88d13a50f21e82e3a23349bfe793d3b881b14969329c8173c87d148b317

Download Submit