hxxps://www[.]youtube[.]com/redirect?event=comments&redir_token=QUFFLUhqbTdqeXhRQUJfVVE2WWxIUnAyRmlXT25vTkFvZ3xBQ3Jtc0tua3dZeWl2UDRxMWdKZUxiRlZNRHhscUZIeWE1RUw1NDhRaGFXN3FZTEJNUTNkX0s4cGNWdE44eWdiRDh2NFZKRXF2VmJGSTRJVEd5a3E1RkJMTElYMktKUnNUOGdsNEMtalcxVlFCRVBtb2IxWHpWdw&q=https%3A%2F%2Fwww[.]mediafire[.]com%2Ffolder%2F3wn6d92zh2xhh%2FROBLOXEXECUTOR

Analysis

max time kernel
45s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbTdqeXhRQUJfVVE2WWxIUnAyRmlXT25vTkFvZ3xBQ3Jtc0tua3dZeWl2UDRxMWdKZUxiRlZNRHhscUZIeWE1RUw1NDhRaGFXN3FZTEJNUTNkX0s4cGNWdE44eWdiRDh2NFZKRXF2VmJGSTRJVEd5a3E1RkJMTElYMktKUnNUOGdsNEMtalcxVlFCRVBtb2IxWHpWdw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3wn6d92zh2xhh%2FROBLOXEXECUTOR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
4700	identity_helper.exe
4700	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3716	3160	msedge.exe	83
PID 3160 wrote to memory of 3716	3160	msedge.exe	83
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 3620	3160	msedge.exe	84
PID 3160 wrote to memory of 2788	3160	msedge.exe	85
PID 3160 wrote to memory of 2788	3160	msedge.exe	85
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86
PID 3160 wrote to memory of 2436	3160	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbTdqeXhRQUJfVVE2WWxIUnAyRmlXT25vTkFvZ3xBQ3Jtc0tua3dZeWl2UDRxMWdKZUxiRlZNRHhscUZIeWE1RUw1NDhRaGFXN3FZTEJNUTNkX0s4cGNWdE44eWdiRDh2NFZKRXF2VmJGSTRJVEd5a3E1RkJMTElYMktKUnNUOGdsNEMtalcxVlFCRVBtb2IxWHpWdw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2F3wn6d92zh2xhh%2FROBLOXEXECUTOR
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff07c146f8,0x7fff07c14708,0x7fff07c14718
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10561877413978126645,10991650071615690778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:5388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
31c4887e87371ab7cd0bfb2a92ee78c2

SHA1
c5041e52c89d73e49346969af211c2e68957d498

SHA256
4eb804139e8ca20b1c4f6873f59f6371c988d56f56f74a0ff6d66ca4be800302

SHA512
75e6721b6fc591bf8d1f427037bf50eb32ffd613243cd44b55748400b86589bc5b0f70f62e76fd394294e91278b08eabc945970becbbed1cee53269b6a3a1f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac77faba7e9b9b706b9575a21e464e91

SHA1
d582a5404d5a43a4df4841141c3669a0f0fed18f

SHA256
eb1f90d8d51878165bfeb67c038dbb0551cfdaf19c7846e00bd61308659a9a33

SHA512
b4c804eb6db56da682c29995d04a561abe5490557d67afdaa7287b72f415b35f7193c3b838fc0be158cf5370a372fa84bf3cb32c085d4cdce1f92c43b3ddee68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
2adc7de5f53a371227a879852ea22189

SHA1
56e62c66a0ac358d964c5b9206449c05522a7f3a

SHA256
56037d3512a2847a847dd91919217e55c89c941b6ff1dbdff9b849d63d2e67a0

SHA512
52f0e55e6e9ada47cb65fb773c11e7753bf3f6383b8d7662d0f420515fdf2ccda1afb801512a88cac20f6c2e234dfd6cc4a26f07f9fbd4f01acabaab65937820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
de6571bddc1c6f9832f4196eae852a06

SHA1
87ada84a3622b58e99b4795ece50b17ae0e66cd4

SHA256
87591271bd2bdc6dde6b86775fabc901caede1be2fe8077e59beca17a21eccaf

SHA512
6781e2db4bdec43a74968a93ef0ba8c51e1c0e6d4186b59bc20afa9560bf4e00672a5e6423deecba55ca8c1f4bf3a28b3eaf8f03e777c4d46b66b8502cf1ec80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
858e7094533360e74f543b36cc882dff

SHA1
fb69d6bbde7fcf5e830bab18d553594379bbf62b

SHA256
858d83b362fe4df49f8fdbc502049377a5a3db88761f7a8d033c57b1aae0c91b

SHA512
746a4da396a1b0ba71ce959c0d6078db062b38cb17e187cda3401d369f251eceadf1d1496ed9393cdfa37c1fa23b756bdae1cd317f8d8cf3d8c9aff9f2300d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5d6c20b770ced278fa674101f90e77d1

SHA1
e686f40fc55966159d05f751f1c518738db1599c

SHA256
a76c4c59ef98fcd9ee4110839e3dc087e92ba551d75890facfb43541238d6b60

SHA512
ad83495b97bd7ce3379f2728f130c4ee1e51b38c57ea6198d0f7d6766dbc08fc561cd09f72f63a38a3bac14e463c9e7c083cdfb3466f27a03c8844e842721546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b80.TMP

Filesize
1KB

MD5
7cd8c20b5b9f085b226b6ef1499a3acc

SHA1
d27687790bfe5006f3ca3130c01384d96b0b8394

SHA256
7ca9fc10ab3cac0512e5c98b06bb3a84b3129a584be1a53fa8fa572132e6a58b

SHA512
4ebf63c2486555dc5eb3a6f651f3ed304c43e4d4779cea4627441aca2f0a762ba0e353ed0fd4dd1387d6addbf8b0b64c6361762b62c2eb1db8d3d2ce11d2ae01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
106f82961e777abf05813623e29bf665

SHA1
490411e5da3ae205210114f8e822d4745aa09810

SHA256
d3b655df15b1c952e78ecfcab6121edac4c6922e4027f639980ea5a87cdd6172

SHA512
e68941952f4045d78ae86bc4e71fcd2fa163436abffb18de77e76efdff18c460e8c4fc0219a63f6673b71da415004afcad991d266141238355ea3c11c4ff2d46

Download Submit