hxxps://drive[.]google[.]com/file/d/1uu8sCLhW7O3XlIOqOqgbwM90x4vAGu_i/view?usp=sharing

Analysis

max time kernel
54s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1uu8sCLhW7O3XlIOqOqgbwM90x4vAGu_i/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{220D33D6-DAAC-4879-916F-E10E05D56284}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4508	msedge.exe
4508	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5408	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3544	4508	msedge.exe	84
PID 4508 wrote to memory of 3544	4508	msedge.exe	84
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 1572	4508	msedge.exe	85
PID 4508 wrote to memory of 4936	4508	msedge.exe	86
PID 4508 wrote to memory of 4936	4508	msedge.exe	86
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87
PID 4508 wrote to memory of 984	4508	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1uu8sCLhW7O3XlIOqOqgbwM90x4vAGu_i/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff449b46f8,0x7fff449b4708,0x7fff449b4718
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1772 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17928883370354888288,5061327747098728958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
386ea5628d8d9b92712c91a4d551f13f

SHA1
072ddd973b4fe80dc5b7bc3fd858d58e7cdaea58

SHA256
1bbafc977dbbd9c174d7bca2a11db945ab52d1fa4240d13a508c990e57ca4323

SHA512
5ac13282ff3e7e8e0a3bf02b1b2e614ef33708cc4c7dcc4c5c3ed86d6bedb738c2ceb92ad35c2609330a34056a6034c3b9785ab20a54e8a4fd6d0a23d4c2a9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65c2c850c256817a2aa198cfc61af6e2

SHA1
e863590675fd90709746871fa1819c633de695bc

SHA256
0a05658f640bb4d470059a549232e996e5e71569c4b5290a5ac8981e216669b2

SHA512
b7651c8f2ef21a4558eefde7355473272e512ff1eb07a75fab26f9e8a71803aac0780e00bfbfe0c3dd066ae1f6c16c72524b5840e32fa5ae8c221af082d8c860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b0ef211772dad6de59acb83e6e0df63

SHA1
6e42ec430987831f8cde3925b142b2699c572bf9

SHA256
690cd5773d8c54b6d7733f902ad63da8b864629f6acfedaf821a3aff45e1ebbd

SHA512
a589448f83e768fa498a2852dd0d0c8c39d362b6a7a3f185206254b0576829feec0e791a2c7501c34ffc9667f0b0023fa344e802843bf6408f53f7ef57c029e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
92c82587c89882fe118a693fb612f013

SHA1
7fca5f6c0f40d5c3bdefb7601443badfcb436148

SHA256
24fcc00d98861c7663080a692d9214e91cbf67193c2efaadf50b6fbe4e68da5f

SHA512
d9fe83bfad8042d891eff703fee553177678bbf28f0f430a77bf8f98773cd0f642912d2bf7927e3ad2bbe2c67b49be2d0a3f40b15658af694762824d31d1b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d2e8361b4202946fe9036b2acd3bd266

SHA1
fa9f9e3cf7f7d6ad54b202ee5396e75967beacc4

SHA256
41c9d20272a407ba4fa8b524b5cfb52c392a5b20f79bc24e0db22e153631abd3

SHA512
7ec9caa70a315745556eb01d7e19d90cd987d8e1d1def73d45976481441b78a425815a863b18cc2152dfb25886add815d7cf53e7599c28c9ecbb68256caa5204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21ef47db9b705e09f7a6732c8d593c78

SHA1
f9c00be3202c87ff7693f69d12eb5713ecd8d72d

SHA256
cbbc0ea40b17a2cd550990a982a64a6790cbf5c1b55b847a5d2cff9b7eb4b898

SHA512
972786534495c2db46e5159bfeb43b1a8ef96ebc799f3a11ed26aefbef9d0a90940312745175681b2f0a9a6fe02e7743aa8750a2fa736cafbba523cf2b3696ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
332ee683daa830bd55784931d90f8404

SHA1
1ccfcc4639d9b9a6400518555ae4bb641ec4a917

SHA256
f8afdfc4a137cb5a3d18bc3a1aabf4096a150e3a9608a7364af7fbb229174fe5

SHA512
f468847a02627c5853a9c127e74998669143750bcb0cabe5e65a701fbf7fb068a9b64838757aba1faa8b93c842fbd20e20e989c6217a6e36aaea1a97b18a9301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
6765394bcae067349031df7b2acc8d30

SHA1
ad8f6d933cb370e1cb402235a9a7adfbe391ac40

SHA256
6715cb6517b045c10c9393239eab198cc450a6889d1bc9c5028bd606d9911b8b

SHA512
4d936c5808cea27e914564a5a8be37c19ac39169950e94039f7d813d14f29123fba02e3171930e8b00efc46384ffd4f00e3b03e0d468df469c68913315414dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
85ee2af141f58b7f1d9d2affb3c1b0d0

SHA1
f970020bbdef79240993f908b9eda19b13d6f74a

SHA256
3e29e0f23ad6ce4af71fe2ac96df9e4e9db966b9f7df16e053cfcf21b42959de

SHA512
8e8a106926dba19ba18645b73a76e3ec21f44c4a638f87386e3ffd6c4db8f67d95c22b800ee08a90741e91a34afd9dbc32cbc0a25e18f7ee22ba0735af3906e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
7ba878c43ce375765cc96ff37d57de47

SHA1
69b7942bf238902705bd384af648b732bd94c94e

SHA256
4fa4a0c3ad1651a4162abec862a16fdb0cc5b7598f62b513322af9ca018839ae

SHA512
01450c035db576d489c065d9c0850cd5adc247364ba723b63b8a525537e8f123c428e8e034362c2a12487be4c1dab01479e6dcf7b222d045cb7c072918b82793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58623f.TMP

Filesize
1KB

MD5
54d28347e721229cd43c93390f606bf3

SHA1
e853acb38b8a42a05fc67fcfff8aca4c0dcdc96c

SHA256
ac3ea92a05cdcd0d3e4e97d2b94d8feb4b612453eb709c10dc4b3ea1fc597f20

SHA512
b1abbb59914e5afca195b14383daf4919c73b826e7ed95387815ecbfc5278d5cc984262a7b3f13c4e0f25751e7c597380c252d982046226d852fd7edb97e9409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6817d42-228e-477c-b205-807aa1309d5f.tmp

Filesize
1KB

MD5
9826754c21a51f403d781eaf256444ab

SHA1
10402e93c2afd911011779190231feab50ca6edf

SHA256
c21088b645c2f9556c5668bd962a0ffb8f54a6e52736bb6d3eda09853dd7f6cc

SHA512
a2a9144ee206d2d761adb004d2e80ea26f28f524b75709174b93ec39417e94eb819941e2574533b051c361ddf1e43d2101267647a712776ea5c80eaa677b59e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a97f2bca-ec2d-43e9-8eaa-5dc17ff51d1f.tmp

Filesize
11KB

MD5
d5b146f0e9651b24013b29fbd1918be5

SHA1
712da60ec03c0244c8d07930d7f42c5a948cca3c

SHA256
11135a1973b0626ad10a78a8fae123ff25dbc8440725f850430bd184d4ff30f3

SHA512
636bbe2fc4888dc100950687a6e97bc927df53ca1f29e9500a4d54e36944430fe04cc8bee368f5233591d980fdcd2ba7c485c8e070e3d4035628a6d5d8b9ef46

Download Submit