hxxp://ss | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ss

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{56BB0E4C-83F1-4274-AB76-DC8D4D8D823B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
1464	msedge.exe
1464	msedge.exe
1596	identity_helper.exe
1596	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3052	1464	msedge.exe	84
PID 1464 wrote to memory of 3052	1464	msedge.exe	84
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 5024	1464	msedge.exe	85
PID 1464 wrote to memory of 3584	1464	msedge.exe	86
PID 1464 wrote to memory of 3584	1464	msedge.exe	86
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87
PID 1464 wrote to memory of 4136	1464	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ss
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe16b446f8,0x7ffe16b44708,0x7ffe16b44718
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4083807066554159453,16460102271845589573,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
18KB

MD5
87fe2bc193128f01671c6bd1dbe61a5d

SHA1
64a8c898b8dd8c39bf4bb0231dafb2f5c5881566

SHA256
da82eb142ae08f5e8172fef67ce537b0b2a33e972c91e57adc92c815042fb0ac

SHA512
a6eddda04934dbb7d269ccf8c9ac7cf919defc376277788b8e5f29a23516b00521ba702fab423dec3065ce2b5c70785d6a606edcec56f8914293a1e33db694b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
47KB

MD5
81d3985e109ada281f38b14e3304de8d

SHA1
9671034583239f2471a29fc6aed930adae779b42

SHA256
84c67ee5e80e7555e8c5dd0ee33cb533158d718230b74cce8a69d924ac79a8df

SHA512
95c7ece83c30c83b69251723b3521cb0a31ce7d02c7466caf79cd748a33c19782704ebbe81a2831e73bd2adcbb156fb6000d0d385ec554c085be7194e9c7eba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
caeb65d0bcf32a3641d1d10180d856c8

SHA1
f08357e0bb11693175433b6b6a3a251aca9b5122

SHA256
e64473b8694f86e300108ad8206be12a9271e48bff635f51f4161e9febc1fef3

SHA512
51b8b5fc853bc0eaee026376cd770048a21af6f2ce8e4d27281c160f609eb5ada8ad79e100a5a2a9a3565fa0be73cc20da49e12803f10ad98f7c514c8649c44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
32KB

MD5
24859f22357cc044d01dd8f3b6f65094

SHA1
03237dd7675e53982c7d39d102756ccdc4d72a45

SHA256
666c7d300803075066993390e49c420b6eaf1e67a9180329e47ad84a4cf48590

SHA512
c4fe0fd4579356caadbc4cfc47e1b832b442a3349c07a3bd5fc336c223b331716ba383a56f7a5a69a97bce6533a6626868275529f114cf328767cfc3ff2ec5bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
20KB

MD5
9e474eef2728fb7b70af7a241d25a6c1

SHA1
ccaa50628a7706baee049bdcac12b1527eb2e080

SHA256
ebdb5dd424c1de9a327effdea92390682fc8d793e87f08c427a2498a5a384f5a

SHA512
2fe07b52889cedede8df7da7f41a1a2e3978a34ff05ce6cd918c59fcf43a3b864416e1593640bd3ac4e1e0e470487d4e3e5fe0d043201e9059d2332eeed765ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06200ec3844609c3_0

Filesize
281B

MD5
d5122205a98f928dc55478d0efe86e5e

SHA1
31b5d6c24c7e71cb1a3adedd0fe56337aa11bb9c

SHA256
a880c6bbfbb76068f6a958e79a2f1eeb5c8030adc7ac9506c0c1b766470843fa

SHA512
a1fad96371cacf0c03470d95e045b60a4f539c2cf87b250c8c3f02da5cdc998f030663a6d2a5f23e9a899aff796147694cd3b5be6e0667b16d758c1731347a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\335e69ddec2b9ac6_0

Filesize
7KB

MD5
d066eccbb0a1a9c315c767b826f3cadf

SHA1
f42234ff6e912a55dbec26d4216923e9cb89bd25

SHA256
5819519a9abd5c103b5c66e516877d9c4dccc740edd65bef2b3b3502034088ac

SHA512
e9908ec59c825bd0b1e6d6ef9e5b48d6449050014ccfecdf8387e2c5b0352cc0ab6fd4e5ae40f7ab1a43612d130da410ed5abbbe27c7f13856820b1df251d15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\372ee633424b6315_0

Filesize
23KB

MD5
0edefdaf5c2d994cfe1a3b2bba1eff7f

SHA1
91184f9ca281735ae38c78ba7b22a28cd44190eb

SHA256
5077647337d9a63b8b01225465ac7018664b15b1579034f4d2febedde94287ab

SHA512
cab584e170b612f4a304e223d88c07bcf055a1528de57a53dd904c837efaa44967a29f3d2b95b75d6264820dc18aef3fed86465aa0a442fe283acc740727f6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d1e4da53adf0a6b_0

Filesize
106KB

MD5
d978cd27b6d24e9e3b9216c432c69b5d

SHA1
29f9159e67e1cfac6b010b8f5da304310b8dbf3f

SHA256
56607b5a9a03d23271f6016c8b3b5e452666faf010761dea9e9d4bde0043b8f5

SHA512
b030261df3d508f6da3c1221d1f60f892d56cf51a5a32bff8903b07b2ca2efe7c8743cf7bc1b9cf2a1bb6fd1a017d0181e6e423e3b79c7a1fc7af6b71efce900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9e757346a84b0fb_0

Filesize
45KB

MD5
02451e888f0fb06cb689c15c6e59eddb

SHA1
97a61f44d86edd2dada572b49bd49b2eaafe26fa

SHA256
e6aa05bdd7fa5e627d9fad345430687455719907da63059d153b268614c803d7

SHA512
9934ab1acee78b1fe353b70916bfc826f9704599dffa7877bfb4c19447e31df1217fb356da561bd0119181351be3e7e7b6b39d51311eb5418a4539bb10c2cbbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d31612729db0d501_0

Filesize
54KB

MD5
b533495a71e42a200a5ef08c82329d4c

SHA1
050c522a3925ef31419f745377a8d85412bfe0d2

SHA256
2c9f3762912747e3923c57a622202e0bc64e0adf8e2ce74b5413d7e2df2effb7

SHA512
6a7c44ba964c2e7217001fbc04f0a6676fadd7eab316231c5081383ef6a3cc93ed9d40bfbcf7bf719db72467e994951b232ddf334c62666fec4fd049161804d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9545717e6d151d2_0

Filesize
62KB

MD5
63e9dcf2ffecf26589897feb8310b4d6

SHA1
c98c98677c8c59996e0aebd31dbd379d76409428

SHA256
6e41ed9c0c56b070b3f169a28c5b336ad0fe292d7e828b70b7a9540ac4103c24

SHA512
774d01095a3af27763bcc9112084c17b35b610932035626759310ec465bca0f95fbe357566af2100160d51422964427b3c5e0306f7601b766e5f9229a62d9f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fa134dc086264efe7f405b9dd0fb7270

SHA1
8c8591f5234f0712642069152c1ee5056b6eab3b

SHA256
8caf9b2b3bf07aacbdf7f08cc271d03161f09249c8048f813c437da235b30404

SHA512
e02b7752690973fe9fb0af99f82b3f0a8232a824b693e3bb9f1acb2385e16d27b2b281cf3362f2a2c7eaf68d9f51b6424ae837abea25c7df524d242a3d770f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fa88fabfd9767e7c6eb298fb979b5395

SHA1
f6e35de0a1a39be04d174f8849583d67426050d0

SHA256
ea81add88c4a82ba69f3cdd255a58d21b84240f644849c1f334ef72add3b0aa2

SHA512
731c544b8e393015d0cf58c93c5798e5a90a14a29181eeaf9794f8cddde31c32acb0ded47d658b8856fc0b07b7218c6378440e336f2d59f43dbf0bc0ea6b33bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b31ab44b764f7bd624e59cd1547bd8d

SHA1
fd4643acaf8600743f9e98ce93b8b4e9102c1030

SHA256
cd377865665a5b3ea060ce7d3cf8695bddeb63fdab466c2044c01a6a454aa17f

SHA512
aadb3a08d8f36483989f77a4e8c4a65b19ef43d5a190a50fedbadb802f6157eceab7f59a443d29731d1ac4322f1aecb93c50daddc713ba94b254023224df4ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9f6ef4d82cf0dbc81d0042ea04c2a65

SHA1
f8c5fbdd41372713d2797a154ead874b968b5bd7

SHA256
3e561193045ef18b009c4da758dc755d8ccc4c17097a60fba81b216bb0128d78

SHA512
5c88961ac70843c57180c20d1321f3dd8876214ebc8498fbda28a15d40c2ad447733cf523b0eed2cd12b501ae9d6c792a1bcea821d07e83db998c125fd1a6205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c154f1d08d6d648463e8333a6e11a27f

SHA1
dfe872eeed53fa97dd8cad62c77000e1b65c7455

SHA256
d8c977056741398691293cacc0d3919ee0b63e988c27ec1c211efc2feb9ab45e

SHA512
ba166f8bd58ff4346a24470857eefe24c03a7313031c3ec9883fc03234f1a3454cde45492cf2cb48cefd4b52c517f23afce258fd083be79cc468bc22281e9544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ffc9b4d6093c3c42092ca80472890ed6

SHA1
eae0da4730e668ca90efc7f9dd70977b0b0d13ca

SHA256
d7fcd0c5f518026c0ec3f3f71659c1d4c38a3bb27deb6f3370dbfc172bb37447

SHA512
36031dcefc5802c04880bf167044b2263d4836052a44ffddfc5b91951fead0c81bce7d971550275d10d3ffdb9f5df56dc5db92a2418c7e87a8dd25c039b8f848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dbf1b7888e29cda82b201a7f3a1ea5fb

SHA1
fc345d0f9271137db33f36cce40bcaed464e0ab2

SHA256
c32efe2ecf1a4c2b3705ecd4f893613701437bd2ddde58a91e2a02ad8b1e4efa

SHA512
de7041dd5c100efe526b200eceac77beb605ac1a926ac126c681d5c987188307b7f8779332e61a0ff9c21857bc5fe29be460d931089a1a512e3f98f6ce6b1817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
61a75de245eca302819161fa0177e905

SHA1
3ad41b5375c683ae7d8b3d228430599f9e6f94c3

SHA256
2218fbf2f826799dcbfaa9bfae6d9b55558ab0a962997fa126f05a4bbd084698

SHA512
93e1eb981878d9bc7a2a1c32116f5c7496763e47a8084725fac806c40e201383b075f2e22be2e263c4a66b848e6f86263901d518e66841d07837d1a9a318d2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
644eef984f49a7154dc8009e3770c280

SHA1
fde9b9bf60c06428caf6586270d992eb26c6bcf2

SHA256
90d02706675869632de40507993e025cfb59dd78b9f0be54340679f0dfd55479

SHA512
82c6b44e094da89808407bb6216d2e30d13df032254e8d21e045e94837ba725605aef0254f4eda91da4aff6fc48ba7414445275cf5128fb71326eac94219f9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
62e9d9a86930979c560c5e0fb6e71333

SHA1
d5b46085a57e667035a54f1b3648fec524702cb7

SHA256
9a7b7fffa6eb3cb714cacb60116767c07f91b3a89eba7b9b4a0fc7ce8420a0b1

SHA512
868c3044f3c06328bed80776fffc74ab780cf49339b69b3d51536f7605b56aaf6830ae53549b109415c615f12810e8c5eaa144e111c4a7a879a028212d0f5805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3bd50285a3356d85fbdeacef5470f4bf

SHA1
77900ac321783c75755a6c059b7c1f8e0ab6e976

SHA256
6257b8b40e37df4a41e903b7583c309ae001e58e4bffde9ff7a8e1c0c06067b7

SHA512
d10f55bbdee2fc819f46754c5a68b9248ae66972b1de8972d52b8b2490f479b8ef900eb5f095b6fd018332a94b8d28f3c9f1cd1ff93895f8a955272cdd14f0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
70d32bf8e44a5ffb3a4fd3a94b8b7599

SHA1
fb543171cb3446e4d364ebb723a113a15b36e4f0

SHA256
97f12f98fed80b0fa414c53259d5c1868041c7c8940215bfbc82a18dc259bb0b

SHA512
0bd0e24a5f0f45fd7766bbb8d8b39e239082c4c6dd5fd720202e42b5320daf5ea7cfd12d7ce2a53c81fcccc78b4fbe3f36c1660299eed65f312b8fa29de61285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
d8151c68bc7fafa298c29e8ad288285a

SHA1
1c6ce83777219bf98bb3d94f4659b47daccf6fa6

SHA256
485ed1f630819319f5c1632b1d4478fe69f7ff8d381eb1929912706cb4dfd7c2

SHA512
7518aa63c9abd85566eda4b5a56378b5f5567e745381066f4c0dd6bfea29c7c611df2814bb416888e456b19a17c686877dd4867e393ac256b150b626e841a9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
0e81aa4c5f40520f78d0bae15e8a7cfd

SHA1
4a56621d4f173cf5ad94ce5f32cfade4e3fb1ec6

SHA256
20b75b3031f97f24a82cabab59207cd3dbc7aec862f9a7d0d19b2738204fb56e

SHA512
1dce1eabc8b6506d63b6586f0e6dcd2972d6a1418cbd66bd04a9e4754cca7f37ea10088d6b81a8077c701fdb871a06369cf0074e973d5290cb04c543d4a86468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
91e7d904e576ee5e1ba63a9488a28e8c

SHA1
8dc1426f63434ea823947de162dc5560dbd2f9ce

SHA256
b2e731b9fc167237170a98cf46ccd58ef01b3e4c70d7c85c3dad3025b1d9163d

SHA512
fa82b6be8d178f345e2aba3998924f0020eb59de05e5161d68bd76503de694a727ff6962299326b80befc6295e9328eab769ef49c12419b374b7803d8767a1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58723d.TMP

Filesize
703B

MD5
b7074795c7fd98cb30cdd332bf19be32

SHA1
4ef879f91bed69464025ec484815e45b96076481

SHA256
1ba26aba8312e25dc4094775afb81c14373215b6c139561aef728614826e6aa0

SHA512
e57fd48c44accbf96da3198eaf9019148eafabb30ee03e714c00a80454840dbbb588b7e48d989019573dc589b97914d7217de57569e2ec352d1568c268854ddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6eb96a118dd96dd641b86981f7381b16

SHA1
135afe95d47be0b38a9ae00dacb8d5bdadf47dee

SHA256
c311fc03e383b3a7912e9d5aae105693f50737352722a92f671a206c9bac3902

SHA512
128d4eb6cecbe11cb15d7886fbc2d37a1c6ff2f7eb3d619b8afe6cef0375445a70a98a4a7ce918acef361b6d98da2a8cc5b15088c5c657e86c6a5be2a03641c7

Download Submit