hxxps://drive[.]google[.]com/file/d/1f20tu2mNNFj0rNc9ctaWC1ZS497gYq7B/view

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1f20tu2mNNFj0rNc9ctaWC1ZS497gYq7B/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{61683BCD-E3C7-413C-871D-B70900DE50BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
2608	msedge.exe
2608	msedge.exe
3420	identity_helper.exe
3420	identity_helper.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2824	8	msedge.exe	83
PID 8 wrote to memory of 2824	8	msedge.exe	83
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2492	8	msedge.exe	84
PID 8 wrote to memory of 2608	8	msedge.exe	85
PID 8 wrote to memory of 2608	8	msedge.exe	85
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86
PID 8 wrote to memory of 1080	8	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1f20tu2mNNFj0rNc9ctaWC1ZS497gYq7B/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2356 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13288524668616506380,16562486170467042937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
112KB

MD5
f91354dee893e5b5f7eedf08fb503e05

SHA1
a291685de177c087466c10c920907d99b3472bf4

SHA256
50d56951f0baa312d62451574206a628c60e3a195361e373a36543eba12ae8e8

SHA512
f31b12d4735a4be4a4934cb816d210be9b461afd36b69d931cddb74cdd3b2ca1b04e955c801b7d8978db40b6b4d496b667cc73d54c61a3f5fd249204433ce42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
057847bff5fc3b7f4053491c1cce7833

SHA1
6b27ea203a5ff968c3b7042a6df7af4ff1f484c4

SHA256
3949b33dec1c0b14b90541306656763a6d0e4c3a01ecfb8ef97026a10d4fb4bf

SHA512
db6c700fb9b784b22586924df559e4784aef69e3b17d1719b59d5009c1575f2e3155742049e7dd7b83d2f4661c3d6504a801315686e3e16de229e048312e07a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0835630e8be072500babaaf21bdc20c3

SHA1
9e24b93494aed66c746e76e6542099af303dba11

SHA256
0f1fe2c8c8f03f5d0d45e60f0cfc23d928e9c69bcf8b0b7115e57f9fa496d7b1

SHA512
29ed9fea2885f2bfd27b17023529167ef3718719dae480898162d8f96e811261912805fefa5ec8bc1b1b6b3f70b29e31cd5ca53a7943aac1d4b44bb0a04e276e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f905825b526488ea505fc0475e8e8e87

SHA1
b33289eaaaefeb0e9352e52e25643d44fc6e549f

SHA256
05dc7b89dfa66901d04cf00291ba5834ae47407ac46af08f0215080a3a2b0d41

SHA512
e9d33c5426288347abce0bb92c2dc995d9d502a7238a2cd3f8102301b9446085b91c10562d926a70bacf26a7add6e5092f17f2bd0962aa8cb2122a9e265f00b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3a3408b871040eac4f9ab25a555121a5

SHA1
501092b6cd86cf0806d32ca01526f067b7e33322

SHA256
14a8d10d63332c34144dfb1e6d3ed254d6898b573af666ddeaf20fb7c9a923a9

SHA512
972e2d074de66ceb9bc439bb6d1373f9f8e431bbb29e0027e8d3e57253da91f267aa774abcc8683017147d19e64e61503db9accf14249b05a6b65514cedd4875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22c9c65f4edeb67cbffda6ab0e773eac

SHA1
46a1e2cabbdaef0c56a22b0e35b445a9e5376598

SHA256
4ec56b66f4f4acb94abd80bd3ae36b82163c6e138670e6c087a4f5c1c122b908

SHA512
fbdbca640e113c78f2bbf02cf95cc9d86b9498ad4496b34cd0766083647855ebe4603099f929373719f908de991fe18e666439632c35b961f9c5078e7544bad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c28ab9c575e94ecec2349b867d7e86c8

SHA1
db7461080c45ad116b2e4c614eee5362d809b5a9

SHA256
d095fe98f5ed7fe396173cfb131be98ce3cbbf7ac94efa839a7c188867d7dce0

SHA512
06eae13a9a60334f2c316462d3412778a3da995cba180c2503d6946f46c7e0371ad934d45fd27c8f1d25cd2eca4b3b4802a044846f2591b67a4b49b09d06025c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4adbbce4497dabab176c6eaa48b37e61

SHA1
4b56c2b7e7e1e07e91ef0ebd40e732e5eaad1242

SHA256
de279c79b726a741430d18501c03c3971536c78f84201c62d931406d5d9a1a16

SHA512
9a8c9af9b8e2aecc737307f826e2fc47a6c8d5edb95a417b2675c1bca255f3109429fa05eb2f9824cb7400094914522608e6e26d2f42e19fa5e71e4889a7d75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1783a09c54c6ec23583681f7aadadf9e

SHA1
0536d7d92d5130b9e5e18c341082ace9ed1a9aa2

SHA256
b5959003588e03a6f33817579c133cbafeff2ab4b6fee4b6e6d28ba0be2511f9

SHA512
12a702f77becd82029fe67cf1dbcc684c5cd5af00694334f388cdad99209a50c44974d8774f644939efbcdcb9c54ca1831d82b5d656604ccae886b4ea70b1796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97228e8449b93148f1f2e882f1a1aec6

SHA1
3860712b13cf7bfc201a6da38ae52e153f715b29

SHA256
5bdd75276694a2cc89dd1aa0f1de7b1e542c6f6c9288edbf0a065fed4aab08b0

SHA512
de89d407eb4f72e8a37befbeeb55f5bdbcca927a335329c5128db43b2eb863f5a36ef1b5cbf5a76d5539ba27c29a9661c7bdeb7da9361c4d8e17e4ebb0611687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e923a865d293d5b7827975748db48e11

SHA1
b5c25d285e437fc733c29d91522fadb5b17a24d2

SHA256
046794eb1d5537d0fb1bbc10067a1a92abfcde65f4fea162c9184db986d5386f

SHA512
4846a8b6db0ec4ddb793b74bfec0746ca07aceb2cbc30f922134fd0b80f07f9d64e2d616d42c8689165a32cacdeeffddeb96e56c0beb82f5f21931a5c0aa999d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9c1330185ca319d2a7924b1dd04060a0

SHA1
658623f84d784b16cfe206abb77f90f775d6de6d

SHA256
c993becf5cf5c15659df4cc1ccb279f80e6d07d9dc75ccfbd11264647306c7c3

SHA512
6be4afcc37f2657992191bc5329e7820cb265c01590ecf31cdf375950a94a13dac19b938804cab4cdc55a429092827041c69a9dbe770ce6ba2599ac1a6f7a05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4be3f97468f30eb761f1144f9bb29e5b

SHA1
1bae29fca83fd2e129f04e316870b525017ea806

SHA256
2db083cc3c9b103c706dffd2836e7fe0dd06d3677a28ad892f60dbe48256d1d6

SHA512
afbb0da52820db5517f0f54e3591ca32c02b4dff642d92d5d9d14017760953948adbbf61fcfc7c37950617d9b9a03ab24ed3ac860518318b9b145bcba56648a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2dac8dcef0418b5cf7243235b08029ce

SHA1
5161086af36d5b34cba6cf6c3cc0725e6b91e14d

SHA256
18367662152016e4fb85c52d3b8efa5365450a98fdb7e50d0021635b4027f380

SHA512
1fccff7a40c31724e0dfb4bbdcb609bd18b2f105431d74fb49f514cb3385a79a1ae662802e59ba7541531a98dc1bd1916abe00083aabb057244ed5ecba325b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584580.TMP

Filesize
1KB

MD5
ba13ce9a28591f94d7d219aab3fd8c58

SHA1
1a0f6a8a594b7ba2eda50e8723975c3fcc1353c9

SHA256
a24df2243129ae2867bd5d5aa13d9c1b5ee22d553b58324558f5216002eb3943

SHA512
a3ff863003c24efe7aaaea6d390d4054ec5024e15ae8c7e0044115b5f0ae20d70918fcb83fb318699779b64ffb748d567c8c6325fbc31c446ffa012907c995ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94b8c0951a7b0c3ce5e5c1ef08dc91dc

SHA1
ee143cb01b65b30cb0b8c44d5efb1ba782a6c7d4

SHA256
961f0c598d54d3d348927d596564f2f471e40405e706d4d33ebc626c9f719d43

SHA512
aac1f61fd13b43e0f183bec879b53563168a940cd8ff8e8a9e3f53a06582171fed8e9a24ff4d59ce6f385ecaa0e768d37b1dbf5ec0cef7075411cc418e12d0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fa79347b69ba802b97a3353e908a9f4c

SHA1
17fa43f9ed306a183d655d61cfba18934410b7c7

SHA256
702c9c7f82527506c860176fcd593533c5a96ddc768777204e514aba0d2cb473

SHA512
a084f785cfcc35644905248a869e0eb6bada4f02e0a9491407219ead8b8138272dd7311256901cec060aad8eef751ec220c4552aec4fb7967ea88e204a619d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
6783f8e6a2feaef588569e8c0a8090ef

SHA1
f3b6d1c3ccdb3cd8a0628a027d7eaf4f6900c88c

SHA256
cd02ce4430de441766da9b8454888c020a6459f278642f8a711ad5b14e1c0a8e

SHA512
11d6e001f47a52a5712d6eb98f7bd57349a9d1515c4c42b4bebfdf600868782d4366bf80fd9eeafde0ac016bfe2b3b594a5fe1bfecdc183d3e818e7bac2d2bdf

Download Submit