hxxps://www[.]dropbox[.]com/l/AADMK4RjkFkE3ogpbJ7mz387ZGjPxwunoQ4

Resubmissions

06/09/2024, 22:52

240906-2thvbasbnb 3

06/09/2024, 22:51

240906-2ss9nasbkg 3

Analysis

max time kernel
76s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/AADMK4RjkFkE3ogpbJ7mz387ZGjPxwunoQ4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
2816	msedge.exe
2816	msedge.exe
2388	msedge.exe
212	msedge.exe
212	msedge.exe
2028	identity_helper.exe
2028	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4172	2816	msedge.exe	83
PID 2816 wrote to memory of 4172	2816	msedge.exe	83
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 468	2816	msedge.exe	84
PID 2816 wrote to memory of 3164	2816	msedge.exe	85
PID 2816 wrote to memory of 3164	2816	msedge.exe	85
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86
PID 2816 wrote to memory of 4320	2816	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/AADMK4RjkFkE3ogpbJ7mz387ZGjPxwunoQ4
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda94d46f8,0x7ffda94d4708,0x7ffda94d4718
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=6100 /prefetch:6
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7826683574034831575,1042591503114911040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
45KB

MD5
dfc5e24cbc1b134e0c00c61e84ec999a

SHA1
d3b1a8ef1d0f6f9162986479252570525719f203

SHA256
b5db3e633ec765fc01a19c06b0955d56c2503285e59d8d348d08ec34abbfeaf3

SHA512
48726cb83bdd0eb6822a73734ae272286483e8aeb6e18f57e635ed9269ca3c6c62e2d900224138dafe32a79a94c3c7694307ff413505d695a77fe602681df27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
28KB

MD5
8b6a23605542aa5ed08ecf170cc061f2

SHA1
be7a5b58e9aee7eb2d36927b4dc2f0610c3c2cd0

SHA256
138d0a55989a81aede9a115cbbf485a3d91140cb1cb98480358d17c644d2c8d6

SHA512
27d0a5687b2e3c49337d6bf7a46aa46e48d72a4c3e6f5ef810771217bda4a2feb60b002344e26cad2f1700eaddd92f41439a04858822617ecf77b176fc27fd13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
20KB

MD5
fdd68bf3ede75f4a4bfe1389a0c059fc

SHA1
3d0f6315b1ba87b112f10a191722a629be165fd4

SHA256
dd7c22b3f25d3c331abc00a714b9672396f01a14648bd3ed99f45ceeb64a2642

SHA512
baf753652194b79963d0e25c16f3c5f0880a2094c1541d71438d876a09d54a11c3740398439089e32ea88f27a1694068d879f8dc664b004ee4c5ecd9f900e547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0c3ab233f51b9a07772956729b562342

SHA1
fc38743069b3cb4ac99f40d367bdf58bb210ea09

SHA256
937e22f06a43c85215524c31b7a55ee1734f0ba6347bd0a7e143e24aedda5b84

SHA512
2d0703154aa9bbc96f0a171d58367cc41a62d000198b92156dd16fccbc1a440720c6035b8d8dc3b73ea17a4836bc381512c606b61d9a3adb515fa55b17b8f095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e0f52157420b25820daafcc963d688df

SHA1
3bee4af12e8ca8656c2c8d7cde916de0bfed84f0

SHA256
a69e462a39ae3983880421297353137cb69376bc7929a2ded3a88ce5a9d0f46a

SHA512
1e3d3995f2be1f497680d2aaff346a8030b8d353c2824e246daa426ddec01458b4a8b02e310ac107520b7fa81a372feb5a30088da37ea3e2e2e30b2d3635fdb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
456491d684cd3fa54852a40be89ccd5a

SHA1
b1fab025db665f19134e06992e57c9f37f9f5dc2

SHA256
48a836e8169ecc9cd99c962a12a4309ac985fe79b90e6f479cb07d55e942b9cd

SHA512
a46bfebaa37f65dc7e6c4765fc0fa09e532f894c40febe75e3749527f0053e73a42148124f1b1548f3589a2ec59d9f34724a95e733b601b0cad0be40c686770e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ed61e248d6f9fc326cd7b3ad59bbfce8

SHA1
c99435b78719d4e42630bb56648bb30ea379dc5b

SHA256
6eed03ecfe75c41b45b26aa0c4622a99a07a1b1ff6288a1ce9f5575f4086551f

SHA512
31330a3c7f9a510ffb1793e44bdfba8574e88f895b495c72a9c436bcc96c8b08b63721293fac4a8c2f389c7aaf6a268307f27059899d701609dffb5585c0b801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12715a9a84a5b5ae2a987c45d125150f

SHA1
435484b8454b415612c7caffd4976a782c2b9d19

SHA256
86f24e589ff78e15f1a08d14b116141fae04072dd2081f68c165ec87a1d5c72f

SHA512
d0c9cb84c2b54ce6800371b8a86211b74699809d53ac3d8422d9eedc1d7fc3c44b1a3b5e42037d25fd2b5163dd49e53eba3242bce737a37a0cdb1e4ddc0ca2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81493db578186956f73fcdbb98efaeb2

SHA1
1171d9a4a2b7320342b766139918d98e4121f36b

SHA256
330ebf3dd882c0271ecdc1e024489c7668e1ecbeeed2869fb40de638f0da9029

SHA512
f4246e402800823681fb160d7e09d6ce217e3ca53710fce92bdcb94ee27bdc4ad5ad69938e0d8dfaa8eeb6d8c5082ba19f37c2e2156ba54c2dd532cfefb1870e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02dca74388cb09a107594969e0a261f4

SHA1
a6fd1dc639e713aaf5cb793216ba7f11f76ed9f3

SHA256
d6f0620ccb24301511dad7ace308f30f87aaeecb10423cf78032655aa93e7518

SHA512
a5934aa9a47ce183d225468fa6701b9443c93836964d359f3bc2cf283e82815fc7102fd85b5849ee2fd9d7fec7e9b2d74f4cc7c31b98ce2a06771c19da756e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
552f63602fe6003a877ce46cbdf9ebcb

SHA1
73bc271a56dace3b1c3da96ef44d2a0f5bd1215b

SHA256
aa12e9e95a4c478f662fcdca72e990dd0ef1efa25b17dded00c49400503b69f1

SHA512
c259ae07f22930a98ab9408c542be55ce69cca9e49f2ba90c44d86bd4744d7b38150135a4f0a995f85635afb6f86e283c80a9e65df96cf8134a4b1712289baca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9e9f78ec18d0034fa913444eab84a113

SHA1
9bf0c90dc1ba66c7fb11632c192a9dfe339546d6

SHA256
eb3c8ac9446107e7a5d1bb62218389a99aef3d326497754c9f881a196fe4191b

SHA512
f65f74ca614352f1c7d7593fd332967afe4d586bb7e531c562f8699f85557d62e0e86c40a57bb1bf90dd47dcf47453af798b5d1aeb650a0449df07bc22399d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4de3d852f4ecfb48410543c3da9ba65a

SHA1
73477c6aff17c01b42fd9bcd5511da16e592aa5e

SHA256
d8b7adce66840b84f26bdc0e71c02d3bbf1c27e6cfede9a6b9339ef686e7b8de

SHA512
231b13fd51ab4429aa1fcaee14581239cd258ca66c2492b1fdac5efef9a82129d423ca2ae5f13211526f83e21509f7730c038ca74165a68f7d6e4f7f30c55794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92a0a3e2fa8fd039ef34454629f48089

SHA1
13832cab2050399c71f52847dbb1109a0600f7aa

SHA256
630e812d8ef09d52d3ad8977994bbf962104f72005459b401ae5b698fdf974e5

SHA512
a9a3ac1e3687c1bf3c821b71c9efe676f2e51d3c8b36cd2137707dbce822fa46066489daf42a46e5cbb2f92ced63a76ee614bac9a65a23a62de13dcb773da98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ca4c432d46de5baec878a9c806a8e782

SHA1
5d2c74b494d543b3219ecc83c09c320b071f05f0

SHA256
a04036e26074eda18ab92973ff9e1117b3d866f6dbe3f64c7f00ad8fe76730a3

SHA512
681e9fa9080183491346e27e226bb6aa01e81490ac75e83f4e2777b08f4b99ce6ce55fcbecefc0cbf4fb3fe9be35783dc12cb4208441f72dcbe85c8e03cae7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71d869d854b27e55241e9441ecc086e7

SHA1
baa24ebb7f2b765d2c31b7e1006083f4fd81f9e3

SHA256
919304a7418238a3361baee74d6a77472f12c75ac5a078c446afc268a92f7585

SHA512
8fe751818d989e062975a74d04276ee8461eefc820b114a098d0775208806acc1b6ad01b7bf055d5de0d407a7f9382745675454c282682a052c7905de1689085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
699102e8aac14e8a9acb51b98594dd72

SHA1
f2b0e1af8979770c1d997999f8a73316fd552ad7

SHA256
59ec614f73ee77560cce643a1fc5b62654bbe567be67bc81d144e310960bc5d1

SHA512
b4b0fd2cff2ec0ff08f1d8c8c42dd76ccc61be1f0f8eb4b6d4f4adf25e849eb6d5c350a48707b4580400fa5f96af83b3c932425c4e38a2db8a113ff1fa4559ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e88b.TMP

Filesize
1KB

MD5
0d3f0a59ab0203e915944e94404f6413

SHA1
0a47574871b243279f68d6f10611661c15360545

SHA256
d97ec1cc661d494dbb5cd5e0d5b9f654a0815f697065e2c518a089db96948b95

SHA512
4ad320d02c6412f35aa1805c0d3f72286e0866e744d927bd26e3c73b2d673d418c2e65c6aa921eab8524cb3e5baa3e4823bf9847ac98438c8332933c0560cd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f8855a837a9b3e722541077be0c839e

SHA1
5cf408bb05ac81239be55b326e49fdf60b55bb3d

SHA256
edf9fc7eb3f4f81b62a102f1e19fc2e0cf4c1d4cc52d0ce0fbc0b7c8d5d621fd

SHA512
f638c8ca25e522c05391ebd56b0eed46c96c9251483b1f509182fe20033ca9c608aba8aa9a8591eb5d07aab388e8e9b34c89a63538a6121c22def4c9dc65b2c9

Download Submit
C:\Users\Admin\Downloads\Scarlet Fraser Associates-27_08.pdf

Filesize
108KB

MD5
e15d6fa92882689031b66ae0ad0101f2

SHA1
feebb3202aed3a5d62aa1c934ed44f9fc2628a6e

SHA256
e1b9662bafe3d937b8bf74420a17652b7e0c2192c5b97e201d0f725085a0e201

SHA512
f25f7619f62018483627cbce33c44ed4af97d5f59f157611a015c6dd192b4fca73ed9313cfbb1b60a657a6c4d3b6565473d42c13c4fca08ac980e12f8eb48844

Download Submit