hxxps://google[.]onsimple[.]workers[.]dev

Resubmissions

24/08/2024, 10:34

240824-ml72xawbph 5

24/08/2024, 10:30

240824-mj478swarf 5

24/08/2024, 10:28

240824-mhzalaxejr 1

24/08/2024, 10:24

240824-mfgyjavhmb 5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.onsimple.workers.dev

Score

5^/10

google discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand google.
phishing google
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1416	msedge.exe
1416	msedge.exe
3292	identity_helper.exe
3292	identity_helper.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1404	1416	msedge.exe	84
PID 1416 wrote to memory of 1404	1416	msedge.exe	84
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1468	1416	msedge.exe	85
PID 1416 wrote to memory of 1340	1416	msedge.exe	86
PID 1416 wrote to memory of 1340	1416	msedge.exe	86
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87
PID 1416 wrote to memory of 3092	1416	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.onsimple.workers.dev
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fff227e46f8,0x7fff227e4708,0x7fff227e4718
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,13708852305368338817,6403056523583538944,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
80KB

MD5
8e771701f47282f79a77ce1cc2157d17

SHA1
4a2b6686f3c6c0b5940e8ed47ae650c132d64888

SHA256
da0b693b7e373996df8952502e1c0a0939ddf3937a3f3cb36faba887b7622359

SHA512
caa053225a3b08fe6cc28aefc16f694be98f7824d14c6593b900e4f74a11a8a2dc713a0cb9fc93e1f4b7132b9fd97e76bf14f62e33a3e54a58332ff1ed843fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
134KB

MD5
29eb0b8327c93a16774567b4da140b3e

SHA1
0787d025ea0d57e38b3e3eb7c71bf5a01e5154e1

SHA256
88f0482f11e57c261bf6319ea26b241b1692c52feee1a9b79b7adc69c3b46c03

SHA512
1fb6d2b83f2b6596cfa93e148cdc48d1e85662984206d86a8f07d07f517fc32a97cf16c7ea3b58f063c3ac243b703cc2561ae349eab41b8508443491f0302c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
69KB

MD5
1a0fbcbbf3181ffb739b70d15464ee4e

SHA1
6ef477d66bbed35eb2d02cc3b9c66a155c39d6ab

SHA256
8de893f0b6277dadf76bebe3ddd3f730b34cd7e27d1019412fb720383a7ea18e

SHA512
3adf38c393940fb9d99e769743d375d77f6975590ddca296ba64176bd5b5f26c65d6e9eea5a8282aac9335903ceda8c756315149e27804cf9ce94973c806aba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
2958144e7fc5b3475387ec0cbbb88bd3

SHA1
69a3f98f22858f81ebc337d4234bdeed41ac7345

SHA256
9b52055d4f267d35fea1aa5030602007bad7a6d1f8f2ace37cbe3b8f83298142

SHA512
fad7bfd91ce67580cf80a1e3f9423108835e2800f17f75c278bae26a91f4727b928a3daab596a52ca9cb20da00530373095b93f2d0518e5d430b7441adb6ba5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
4c118aef9f533a27e6b14d37e051c18d

SHA1
9f5346495e92f7bc6ee03d1b9e668cdc7d4fc08a

SHA256
9c0e38f1ec2ba0003c4be58dffb682f5fbae65912697a0d1f3235a9d480bb218

SHA512
c372aa1d690cc48d6fb46e97ec9cb67ee6ce67bd6dca36d1d6e60278add95caaacd708b61964044e6b78e44f80d06a71b24f810f841415491f6dcfddd1d93f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
66e27383b8ce8c5abf18501c3f706a75

SHA1
be8b09f2b50fdd7076e540ed479c7d4b775fa21b

SHA256
eaee96abb4c949eadca4ccfb3996cb7f9d66192f1ff5054bfa5c2e0be2d256ee

SHA512
500cb28b49d381ded0a72a72bf00806af0c673015338587f6d4ca7d89c9d43ae7409cc5c98697f3299b8d54ccfb38252bb31eed4acb7e4c9d28937d749d2b4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dbd325bbc8215812b99fb0ac345f367a

SHA1
864da210f55ad9d02c81627644afddbf96c78bc4

SHA256
600fce72d9ea064b22d35c7ecdd371e219b219d9356d7fb487fa7043a963f8ae

SHA512
54d6ca0f8f88e50cb5b7ef7ad5fab6d7d4462b2522860dd0c05413c0d5e450f4e390e8c945f1646ca77901b0ae3257ba35276b85db60b6d9ee57e17fd5b52d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c8f9a9ec551591174bd7d117e607878b

SHA1
e4b6b3f5bfae00ac49c10892f1567302f57343e6

SHA256
d9a8175c1b27832c8d1fc414d7d309c22d31776aef4996742d41159e1e257118

SHA512
0609fc7372cbffede589ed083711e2049067b8f926265b434ba1a71b08d44002f3bcf443f4de63990fff479c340b3e28ad69290d98513d464bde812c8b729c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1476098d4815b3a30595ed2459c29734

SHA1
55b2b0b23230d613d93a77e0297ae105edc5d49e

SHA256
322ba2fedde96a220799551bc286704af7b315fbea27e29c977cdfac481739f7

SHA512
84767c9ca7b5ffc0a929208de85cf41054b3a46c4ff4fa3a3be34d05e072c7bb589ed50937d0816574115fb343ff648a41c7a211ee7c6859d9e31469a2522388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2ad85fa8757df8a1355bc914c68a36e3

SHA1
d5044ed174b54ea632495e72221aed9fd0ea54a9

SHA256
e727a66df9d8c9227a6e891945045f6e1576d9f8cbf14f2169756ac49fc1d4d8

SHA512
3ab3a5cbaa935cbec81ff16e2f48fe73debdf3945c9b8fc47bb29bc974664fd10ec9fdfeda2d5920604582f3fe25ff1b17149a3868505b5c3586a7e347c67e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bd5807c9f8161833c6c7f98bf62073d4

SHA1
20036b70563e4e6dd26fe4bd463bc0065b8af3c4

SHA256
10007ddde722305b02063fd598e348d39bc65779f08e7e7f6d6b38e0eae7b8d8

SHA512
b079fa06584b585eca0e3a852e6d5d38a6474eba7eb87cea5832b006bab89fc21737c8c293ee780d4fbda6fc7aef5413feaac3e0dddea656f4a38f521f7d4e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f65be2c27852702f055b3af7d503760

SHA1
02e8143ae9bc12ed0d13f923860ac67d11955a48

SHA256
d0dcb9e27dea41c44754bbaf2b60b4f754d4b8e584afc086c2eadc2eedba7f56

SHA512
d7283ebde9e6ca5d1bcd85f30aa71133824fa45f3f5fadd9d4a4a99351928533441ae0d94de5fd16cbacb45f5e18bcc605799436ed1d81284daad372a6c7d8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d467828fd57ad579c206ea55456cc4a3

SHA1
a700409250319b768c03ac96754a100b454fa01d

SHA256
3eddc7b63f3e39d383a9ccb37baa307d43b5e18722395d5d1f15371ab32f9c14

SHA512
c7c2a9a8d1c41d87855ec2c39d0fcf024f327ef788dd00257feb1f97019e7e20c27f2c9efcab6f38c61ab89da3371611a393df6bb81428ebd60e5fe1f018475d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
079400d9a57d50a468c5e33101895edf

SHA1
31ac8622843cc77a6e8d9263d2ba31ae0f287af1

SHA256
b360d6937ccef07f93ef6d382293b21237943da48f9b05be14f74ab14adc3d87

SHA512
27fe0e86bbed6dabc7a7115c0827f388c2e8aab4ff489e63b115ff2d881288612900bcbee41b3d9085e126fd519ab4293020aa4d8c3399f8152fe872e23dedcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4d9162f010b5dd5384178a89023b1644

SHA1
f917d35ee344a2d24717a8de5032705df1e9794f

SHA256
8a4c230747f0dc2e332299f62c43021e534a9c8c529c1363df41165423de23bb

SHA512
b219cf19cd53856a8e42432470e6fc8c9df4db1dacd9bfa36a13ccd162e22482698ccf087a5f498a909895de294ce9f224c8c5b9ed961da8461c15affc871622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
90a729d8ac25e0a5ad00607861e1f97c

SHA1
2f73a0e2f6b3d05babaca3272a126e88d6c8ccc1

SHA256
19e4023187879aba25b2fe1d89b665acfa4113deae3e0954f13f1449305fd21a

SHA512
5ba698753790d9ac175e8128d7703d9aaef41628713822b89046e967d14c0da95f51ca1336548429e1748ec8aac3ad3071bfcff964abd9640af04ab317123918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587412.TMP

Filesize
203B

MD5
266f7887c746b3e4c76c9576847b4ca7

SHA1
b9bb4f4249d9dfdfb0d21522142a309f8c0a2f8a

SHA256
8f899c47082b5e147d6fd7059d70703b686314acedaee0abd0877ae7b4b3f54f

SHA512
91a2e7f347ba8a8c32d2a4654df50514284e0c4bcd40995d2148f72a2253c75cc0e8a97b022aada3b7dcfd22184c0e65f7d3a0cd475937c7b03c5cf3d61897c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10541998585cda21e68b621bbb676098

SHA1
502df816ca469e1902677dac0f2fb72258ad538b

SHA256
f8408912962c18b7d29caa36acf585c7530a5b0cd4c8493c2f45a3a18fccb40b

SHA512
e52d18f495cb4e2e39055dfb5be37202df3606b014d8e80633b7bf6a3fccd691801b8844a4bbc73baf757aca6f744b4c82f65328da6089d5a6eb1611b265b1f3

Download Submit