hxxps://drive[.]google[.]com/file/d/1UfVK6seO5inrUnQZfi6GT-WU4M5evJn2/view

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1UfVK6seO5inrUnQZfi6GT-WU4M5evJn2/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{0804E836-BF80-4367-AFB6-DAFA011819A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
1168	msedge.exe
1168	msedge.exe
3220	identity_helper.exe
3220	identity_helper.exe
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 624	1168	msedge.exe	83
PID 1168 wrote to memory of 624	1168	msedge.exe	83
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 2836	1168	msedge.exe	84
PID 1168 wrote to memory of 4800	1168	msedge.exe	85
PID 1168 wrote to memory of 4800	1168	msedge.exe	85
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86
PID 1168 wrote to memory of 2828	1168	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1UfVK6seO5inrUnQZfi6GT-WU4M5evJn2/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da794718
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,733131561450098135,6141328692205715916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
16KB

MD5
36e579528fadf051d765bd2bd639bc60

SHA1
9e15a39a1165ec69c48771845fbc0c2bb7695670

SHA256
239f22bc967c880b1a4f7144ea070fae586b94cce025ef18140d5d91d16be81e

SHA512
f9d4b328c18b7082f471385d3274e2bc37f2c6140e03ffe69824850bcd04388393056a9068a3a396bb2fbce567103b328181820f04e2335bd6284d7f78b38e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
058b0eda0d52b3cd8991def8d8b4268d

SHA1
dfdc9958671717cefa3e4f7091b32dce960f2532

SHA256
c00e420f8201252c4b2a540a30b05582666af8b9f211b3fc7aeaf13699e447ba

SHA512
196daba371fc361fbea6280edadeb5d204437f8c911d4901fa629e34c7c577febc315550f7f47f5b8128ca7b2ff49c054e576b47cefee28ee767bccea9936ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.g2a.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e55c6095823504e716431437159b223a

SHA1
c90a812aa33911fad7a385c114893bf5075b8128

SHA256
05391b130a29bb42d556e4e1e2cedbf7d0403abbed6a2d1aabdb092f80e0c8dc

SHA512
262afe36728cdca6c8cafb1a53f7ab2d730d4bb0080ce09ad9d3e3b92bd674b6ecb41dc186527291aef03b92f44156a50bc83db495c3f0a48738d7853aa4224f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
625533a86bb7a451451f1b30c37fd607

SHA1
00148a09f3dac789055203731500f504dd604247

SHA256
ebbf8bf7aaa821a1223b307bb28a81632db2237256abf4569a6903ddb3ff927c

SHA512
ff1c5287b2e26c7d511b3d151150b75b69dc93465610a57baa7c7fd89b1243be6dec9c237402d7d69ab0400c485fe235a3d5d69343c117c85b458a64623f1ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4296dcfb563bc7ac1283b008aecdd89

SHA1
fd9ad0209c21fb09f02ba2c82b3829a56ef7bb5a

SHA256
16f450ef3e3bbf50713594f7bf6cad5151cf351bd9b8a637bcd464e1207173f7

SHA512
4865e58dd3dc72e5dd7ac759bd95d5df46ace11b3fe1e937fa206528638132920369795755eee1cd4f9251322cb350da568399c018eec22760e71b463ddaf696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7c47ef09875459c1bc237e26d3100e7c

SHA1
9d82011ba681c6cdc9c74cec07197c804cc5538b

SHA256
5af9c8df7a15557247952f5379a818fb3de082d9a968883aea772d48893fb68c

SHA512
b35bf9dc17ccdbe774231006a1c66ff18665548d5a14ed9d00cff7682c56783225781b293dfc37263e3750bc4c954b378e235ad085746be757720cdb5d477b08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4aa01d18e983a6eb56b19c44739b725d

SHA1
e81110f1caf4cc613751aad2f3a16c9214ca915b

SHA256
712fad4f8ac04059e3f1e3413b56f9703c0d1c2c55bb34ba9c8cb314b3d47a31

SHA512
144a7e66bf70ede5a70fbc7f38730e0ede173f0cd19a9866524d395d2b015b247337606d0d924aa206b937ebd7b7c1f4097ae92fd32e7ac55546b9438ea099f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
3ae7b6247aa8fbb3012c91c512af2fcc

SHA1
e7e15003578434474c68b08687777e0a0b1bec77

SHA256
e536d801a2d86d083da2aeb25ff56293948e84c215adfaf12af9b36b986ea07e

SHA512
becd53586ff76bcf1bdc502e0ed92f6ae460d41872b1d8ec1474ab429c872bf19e42dfce7e5052e7b640c8b0196d63a387dfc8251bb994758212a8a61cb6c539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59096c.TMP

Filesize
48B

MD5
37f8cfd29be5cf13b86cc643ec5d2051

SHA1
4f3d77a6ce38f8def9989690010a35ed8eafbcb3

SHA256
51bbde41825c8be960ded8584a6caccff2abee3c79147fb4f26d628d015077c1

SHA512
2f9704066f8a4e194abc529dab5a13edac7463507b0ac0ee484a6b4892e2d15e60130ea445ac7c7c558bee64fe1c87f553b3cb62b61e2edb9444cfda9fae96fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c864e85a8455934068cc4f96433c13b

SHA1
23652986418f3ac4d32915bdb0e971d7611e5128

SHA256
059fb77fcf387098754fb7e163383771dcef1b6fb869daf3e1713332a1aaea29

SHA512
558d6fa87bb50da4468d14bc3dea52460a60c5fed5affa76f92321fe6b2f739f06405c6d2ecfa0a064993602ccef29381d7e88247c9f4370e346a78b24ff78b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
404571dce1c515b6355117b8832b9914

SHA1
e88c6ddbabd240f65f14e49fa6e0a7587d182e1f

SHA256
aff1dd16bbba25d427259fd52e9c2e4417ae792480e48b93a103598bf3db8a1b

SHA512
8bdf9429441fb125cc914bdc8a13d1ec5e80abed279900f7b05db0ff3642d1fe45f6c116a4456f399a0bc43fcbade154f9a5722163bb65028e5d830429e2c9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9818e051d32dd8b464eebc88e7641aa0

SHA1
b650dba533bd52738518b1d8f6d2aaf707b27a47

SHA256
07a52264d8e0c3a01af24499f9ca07e663a57d246caab47bae1e21b1ca5d98ae

SHA512
7632e2e13db51b38e003ae83bb8e499a848af550316ad987045c62cb1fa49948c013e7b1e1b2e9f7ed9ef57aab6d756474155e294c84800eba485782f3078071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58312d.TMP

Filesize
1KB

MD5
05a43f834e8da9d05f54f42afbf9e442

SHA1
fca8db7fbefe987c514956a3eee90d19749f4419

SHA256
1530cc426907dbedc8fee17a113d72eb3699f9696aff0b302d5b2fab078e4bd5

SHA512
9c4681605e8364d96ba8ffab08e739e4515697a88d389769710ac132cd4eed3f93f13fac19f6cc52d471e72f7e7edb3f56579e76f47634f37f669531ccb336f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e92ce4680f7766b516224225082b344e

SHA1
213ec4743d366e097e0867d8835bd496499098fc

SHA256
b942623a25a9994138477b881b0efef99ae3d4ead1c6f39e23705ec476835301

SHA512
a04aaa223815d62a91e5e68948fb7194987e037561d3f76876ff4234ae132db4a31f1bccc1319706c2e16769296d1fc20142c59ae4f130daf4cdd57efb5d7b02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit