hxxps://goo[.]su/OJUna

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://goo.su/OJUna

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{DCB6BE6A-C033-46E3-B8CD-F5CAF064A78A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
1652	msedge.exe
1652	msedge.exe
2872	msedge.exe
2872	msedge.exe
920	identity_helper.exe
920	identity_helper.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3760	1652	msedge.exe	80
PID 1652 wrote to memory of 3760	1652	msedge.exe	80
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 572	1652	msedge.exe	81
PID 1652 wrote to memory of 3768	1652	msedge.exe	82
PID 1652 wrote to memory of 3768	1652	msedge.exe	82
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83
PID 1652 wrote to memory of 4024	1652	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://goo.su/OJUna
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe565b3cb8,0x7ffe565b3cc8,0x7ffe565b3cd8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,11275767886060590247,16311071726063272981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
244B

MD5
7e725d0b1236bfc369927a1c9e3dcd11

SHA1
a5f5c3eb196b07c7e1434213f98b90771e7995f2

SHA256
c2c828246b43e9b94834df5b882f34f42c3c1112527606ac0c4e59862d83116b

SHA512
8d5a045531362b885e14e07392f5b472d180a0fd322312491986fc7b08394afdc34b71a8cf994ef2d9837ab69998077d178daf8050b4584c6b377e51566ad188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9e82902493522b6019d2b18151fb1e7

SHA1
3ce51097e84fcd40e0b884ff93707c737e06a3ea

SHA256
ebb7d49933ebb9f0e3aae69915d91cf6bcd10b02e3e1f2f6c527e2a1582eadfa

SHA512
5c625895d0cb90de81f6bf6466cfeb5569da928be489f85f389a4abd9291bdc616db0ea1cce5c890b90075f7f842e1d01e5bdb647a6fdd90b03cda8014bdf803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
937f7329ee1c13c98609c693007c12e7

SHA1
0737b86c5ae627c0326e8911384f19e4672025b8

SHA256
0cc62c2e3ff324108d05661ca8b6f2fbc215ab5532d08d5dfc07db55312c94c4

SHA512
c5e5d44984133f2926c4ad9212516c2211905566237f4f8ac0abcc83040cf9728efad67e8a83f0740a212948e07cb4d6597002709af46667e05924b5d6f808bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0984b8c9ae6cf1df920b39004433cf95

SHA1
12711206d114a807786d68a1bd6bea040a385828

SHA256
c2b9d7c295dcdd7b915cf786219f815a79b0777ef5aa7e52316ad8802bd814a3

SHA512
f509fc34fbb9a783bccbe0953818ed7e6d708f1849ea08676b94c12931a4790990b08681942edf528dfa07da662bc6c013f89266cc4aeba84e10d4ca0e07aa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96d99b7e8d4336346c305933c4771527

SHA1
9e9be9bc0ace243ba90974603817cfcd88c47830

SHA256
a40dc56a5dbe0e7a864849efbda43d5661ac2e40b3d5359869b6d3144c612a51

SHA512
e665781b9fc8ffa9f3f88978b8cc8abf40bea61a1931609184bb4d9839f88fe66170319bea462ecebe83a23c5c9af6c76ed7e92f481d0d2f715c8aaa05461600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a208c464aaa54f16874c15d427f2823c

SHA1
1b9e7e3fe3a7d53f1993df91a229681033c33afe

SHA256
28cce15a444ffb51f40797b05e4ac939c8f00fd1d314f3bdf74942f6293f61f7

SHA512
998bc52c40790c397a095a8c902d1f7864b4ba28ecc85a141f6e3df88b90d8c2ea47efc0a80793724498ea021bb21cdacace16a8e6c5461a7cf276ba83f73c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60c3055fc68e6254025294ae54a12d07

SHA1
380d26d077d05c865d2c05c1ce59492eaaa46571

SHA256
4733ec32cba0dd6150f66954a4c41f007242d80beb781f56c727a49635bfe8e4

SHA512
a4023940e75d5c26be571ac4b414d537268fdc75180955f98811155ff0e0550ddfbb7f27877acb1c8f4752c818df244372e305666d836edf682ffd7625a93897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9aa4e575134dcf6f9fa3439adba5dcbe

SHA1
c532c230be3efcfc8aac5696fc878deb73ded783

SHA256
0e048a53fbfe690f6b7b36bfe03e841275b1b1e18da517e695569d225d0ea8a9

SHA512
4d87c2c72cff3e035b9a3d07a3daf91f3c30738091712da1883cb06aa93b53f9beec3db5032cf19d27ac83bea7d6c9c3d62d0576e1355d6c9b01a09bfcc913e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c356.TMP

Filesize
869B

MD5
f2973f854a620da37123660a9f51df51

SHA1
71b929a43d04d68d2270b52acf046ca2db7dba2a

SHA256
fb47d7b8e51797df7639d7579fdb2eda7e6f7060624926e4d29233f217df6c15

SHA512
5a74ed35ccfbff1c551cf0ef28414ffc96c816af35261b50ee379d043d3d185c214a4df8533c32cb53d885c927d307f268f850fb9a568d1f5cc407da57434ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
832082b2435c50b50d35f1ba0024ac9a

SHA1
8ab85e4f72f832d63c0f464ed2c7fe60c3f6870d

SHA256
2a98049c236554e8fd4472dcee017f2bb34660f824ed39aee4c8a96fe2e8c1eb

SHA512
526ffda8a3af16a8b30448975d8d4f8663e4d7a5805eb6dccf3ab92aa80c06683ec1d4dbc701aef8158f80b1d8137691069b9cec7219fa6dbeb2de36a2f7b3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9107fc88d91ed99f19d2683be20d7bd

SHA1
b27583791920a78ecd3720472df1870391c91eba

SHA256
5a90ce7f3a7a35e9a5aebc1ae93f4a613cbf9cc4160c7fe772571beccb40ccd9

SHA512
1ae73a5f7b5fd430fb85b2aa7ddd03c0c0eb62bb7fd25a097075171eaca811bc0a2a4beac94b6406e677d2ed653c6cfcebed22f183ca9338dd871c340cbcdbe7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
3e1f5eeae74491d8850ef2c8b03a9a3b

SHA1
0c02c9c2550107de6dd0eb740ac5668f292883c0

SHA256
66756c0edf3925de7bcb685385e2a4f0b854cffd796a9e90eb1ed064b1fb0e30

SHA512
7637f0807d88dbceeb68823a044583e2248ac1ba73c000da6560f94075635a27d15970df7e52f8315bdc2f1c45cff6f1ab7690e916b58307a533f8df24329c2a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
26d98b946f17c556ed48590e1e6afa3a

SHA1
e8f42f8fc64a498a5549da2a7e687f65346ebf84

SHA256
b2b3884625d0b3bc36888649d7c3a9187a29aa782fa68a3dd5ddf82f19ed9f91

SHA512
f09c4a67232efa5cf2a66bae57a2222b89fb45700da028a37598fa6b3cb760a8a84609a4ac91d4b314bc5e32f5f5d198d048ffdb9804b38d93e741a87285884e

Download Submit