ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Resubmissions

29/10/2024, 11:51

241029-n1k2cswmhk10

29/10/2024, 10:57

241029-m2ltlsvcql6

Analysis

max time kernel
1680s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 1KB
Sample241029-m2ltlsvcql
SHA256 ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
MD5 84238dfc8092e5d9c0dac8ef93371a07
SHA1 4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
SHA512 d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a
MD5 SHA1 SHA512

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
81	pastebin.com
84	pastebin.com
343	raw.githubusercontent.com
344	raw.githubusercontent.com
345	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
4212	msedge.exe
4212	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1336	4212	msedge.exe	84
PID 4212 wrote to memory of 1336	4212	msedge.exe	84
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 220	4212	msedge.exe	85
PID 4212 wrote to memory of 828	4212	msedge.exe	86
PID 4212 wrote to memory of 828	4212	msedge.exe	86
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87
PID 4212 wrote to memory of 3444	4212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce88746f8,0x7ffce8874708,0x7ffce8874718
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7659149311267860183,16114219564006046782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 2760d48ae9bc8eb1b6e3691ee72eba4eaed44d7a54cb35d13f1410960badc662
MD5 d1429c9bcfeab06fdfe097f08e628ea0
SHA1 de7b16231b66913ebd4754be46109aadbff088bc
SHA512 901e9df40fb79db86fcf8cca5069d722dd6c79a0b3548954ed1d5a1e930450236d9b92313190ceae17f781a8fb0199b70f6ab84876adac881d899f8464cf9a87
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 6127bd4e4b07e4e756ccc819f51b59da4ab13a4cdbc32c439d7ad3d66820c1f4
MD5 6a7d535cc26a772a8ead814852ef086d
SHA1 845384e1b5d8b3426a80dc20253c648093cf83a2
SHA512 2e6172f9bae3ed2d85bd102fcf43d2e4435994885df4628d68e1af88dd678f278523923b5c8233a2825bb0fa6b24d5f5df833bddf54f466b919f980c07e00d0c
SSDEEP 192:JOe2k5wv6j6ifWerNbGkwxBV46oU4p6WG0yWhEQeZXr9PJ6nTliT/46K/nSwrbrH:JOe2k5wv6j6ifWerNbVwxBV46oU4p6Wd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 99426c33458e0cfca03aad184ca7549fb881a134dcfd80cd8e3935dcc0aa3c49
MD5 d34ac444eafa1a1f1f817ccd092e564b
SHA1 2211ab553eca50834022dae8fe84eef63648f357
SHA512 e69f6b0bc0109f1197e8ce6ed6befed228139063a48069099d34c953042f1b12becd6d2ff1afd1a803e947a6bebde959b8509143f6d58459fa4d576cb5d7d2d4
SSDEEP 96:ngkc91FJwpvWMoiVmdeH5ecXUWQyV+VD7AiEwb:ngkQLJGWMXPXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 247c196acd86c5a921dd05a8ab989d06c8a3212768c9f0ec81a387a49fa69333
MD5 a5af2dd69cb79e4454c9a515e0d851e0
SHA1 a0ef2d7579f05e971e68df40be322434e4f3ac45
SHA512 b034f1ebbf9f885e8edb16f7ac7e63bb6464d8ee3b3b9636fa90757e68e3ebaa2a5321f5baf6f4a254531f8d4db875dea0415a1d5076af0d7d6de6b6a0b62ad5
SSDEEP 96:ngkS91FxwpvWMoiVmdeH5ecXUWQyV+VDCziEwb:ngkyLxGWMXPXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb9c37bd767855fe5aa0b261df91de1af4ae480916161a90dfa54aa3bc682b05
MD5 4f09c61fcbe8a45a49398e260cc7caab
SHA1 680af9b3195b0957f6b53cc26d51561c44f8529f
SHA512 21f051affca4df14c6f011c34aa860288a3bb0317a9ae4269d8d69414e11aca6a32bdc0961c7325f5ac3cfecd967eb5329fd7482c4fdcb5d7f6364f90e0cf9b1
SSDEEP 192:ngk639GWM9ubzZdgigzCTpP/Kk9kDTxBzDyR6sex9HtAaSAhk9be+Jxea4yLkEAf:ngj3wWDHn7WZB96j8m6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7547fc76891b19d6a22cf94a1de59c3d92f4f45ec3747b07158bc1462d7c92fa
MD5 5d53ef85727d144d562173b4e3c75de8
SHA1 d837c878955ab7df982f8bc2c82052932d5aba3d
SHA512 e152981948337094ba5e7ab7450da7e8e107b8dd300a833a00662e86f566cf58ebacb3529fc88ceae056f149a4cec7907c54ec749a10ea2215a5a56ed54670ed
SSDEEP 192:ngk63UGWM9ubzZdgigzCTpP/Kk9kDTxBzDyR6sex9HtAaSAhk9be+Jxea4yLkEAP:ngj3BWDHn7WZB96j8mk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dcb1c8bd95a989b710ecdef4da2944f4aabc60067195f29889a2c90dd36d8f99
MD5 9da69886d70802a9db08d652f92f0475
SHA1 9b3b4968dc3d26e3308695ad76a66f589089e885
SHA512 aeaf7a48d44b6a5ccb3556ffd99eb524ce7f7f2907e9bcf349b76b829e63af1e575261abfd7793ac1381339f499aaffb07250f7b2badfa842658c60c663f9618
SSDEEP 192:ngk63wGWM9ubkwirZdgigzCTpP/Kk9kDTxBzDyR6sex9HtAaSAhk9be+Jxea4yL3:ngj3NWDC/n7WZB96j8u3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 ec14dc00c5ea4cd29ab0f38fc1a9e3a8d744c28f53b78b95b15a2c80f3b234ab
MD5 819e77802d8b1e662e8bd2a7ed37dfdd
SHA1 7de67f5259f33d33714c38e89bfe73673ef0e640
SHA512 b5d3da9dfeaca767e338679ee5383da1e188c12d13a6239cd748c420050a19993bf6985758117fd638e9d5902d907054b4737c8b507aa8351e330b60fefa57d4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 a425720dc1e937aee905127f9897b67370979b6bc4b60c5d0261ac607b869c9e
MD5 7670826e4de0dcf96eb4fc15ab3b5934
SHA1 2c11215f7dd910dd10414c56d0fb7d6758c05bce
SHA512 3c520e724ad058f99a80a5946405d54d9d66819ecfef382f69aa1140446743a49f6c5c8b3086086d35ec4aee52a4eb4e4d85d3c70f9f3a20c6767c33c26707c1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5e025f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e025f.TMP
Size 2KB
SHA256 745fdb8c35fe5eb5c14d3e0e0d6e367c242c85ac9034b894af70f89346b97b7f
MD5 931c2c02ee83e7bea9a1d3b280515c2e
SHA1 b66fa07b55a48f6df35553134cbe2dfa52879fd3
SHA512 f44520ab8b9dab18aad350ce1e8f99fe40b4be0f7118e8fbde32ec76ae06bd155fdc6519463fef09d1d120aac6db9f399b917385e97f909f8793e072cca53f31
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dfb07ce5602dd494db6f64fc081c4f3f121f310c653c9c970069c30b7ab04c19
MD5 4cf973e52bd06b235d87fa2b239699cc
SHA1 275c19e89338d178828107629152ed52e892be36
SHA512 d19431a5a89d0da9bcbb39d662c8ceee547fae818f37008f6d4f72d02c3d821fcfd25e6e4056038ea160af36a303e6ec493f475eac7f6c491cb624783052b3ba
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUZLkyozHqRUx3GPOxT:A9iIxuERzA83h09RZxYsW6eSFGmx8occ
MD5 SHA1 SHA512 SSDEEP

Submit Download