hxxp://google[.]com

Resubmissions

03-12-2024 23:11

241203-26qqpavlhm 8

03-12-2024 23:06

03-12-2024 23:04

03-12-2024 23:01

03-12-2024 22:58

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
4736	msedge.exe
4736	msedge.exe
4124	identity_helper.exe
4124	identity_helper.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5068	4736	msedge.exe	82
PID 4736 wrote to memory of 5068	4736	msedge.exe	82
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 4596	4736	msedge.exe	83
PID 4736 wrote to memory of 2604	4736	msedge.exe	84
PID 4736 wrote to memory of 2604	4736	msedge.exe	84
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85
PID 4736 wrote to memory of 1612	4736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a2d746f8,0x7ff9a2d74708,0x7ff9a2d74718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14553635952242083084,9938477436908363981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x49c
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
829KB

MD5
a19ceccb552addf7ab17eeb1e79a616b

SHA1
aa918aca17c9eec089804c7573d8ac9901e18bcf

SHA256
57d32f147e551e2d4b115da7c1fb5932d0f52dbc27ec563dba710fe93dbfb33d

SHA512
a6296aad95b94c160b3dcb8576ddca5a437d59aa8ee1f884dafa0d806bdf57c0657efb151667add9f738934f71cb1f5206e1d23819c3cc52ce5fb460734dfb1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
915KB

MD5
21f7eea3815e1f4bbb3ea7bb224462e1

SHA1
fc2ca0d42f21a4b47568ff0ed79715da2e246020

SHA256
f4ec1c8436c306e8b7e630fa5776ad83be59714434d710496457d686cf888f55

SHA512
45cc0ae15442ec2e42ca83ca5f364b79d817f6f31f64b24894b2ce7626573376d339171e1ba82d7ae16253589f6ea26dff0f7a565f8b1942c90ccaffaa7edaf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
22KB

MD5
486d48185fe633fdbddcd0e97f02cb3c

SHA1
6b1bab8c9949d7fd975c00d3b3befdb64c5517e9

SHA256
5a47d0f10f3d44f41a2da3b96bad95cb3db186466a6b7dcbcea65e84d5864a12

SHA512
387d168a52cf2ea9093097ca2e974f022a2adf61e84b6032d030d38e9de6735d449cd98950629353c6d5dffde7ac679bf72ec8a5ebaf12f3e5a814d1f3ec0c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2c97bb93253fcdd4f3f9b1f47bf104d2

SHA1
3248441d424d4fced3129a86a0c5bc9528d817c6

SHA256
cbe85e78a7e7f77e8ca02fe638bcd39cf834b51d25a69434fbbd202963f585f1

SHA512
81495ad6c9c14fa5ca16848c4621c53a28277d50fc1407b561b31f9345821eb04fd036f762bf5adb697284ae0cb61dc3601cb90fb6e4d49a2c14fe9e855c2e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4faa24bd4273e0c13c9cc4efdd2f5ff3

SHA1
1e92b9c966cb25fce3b44495ec51f4b8c2023933

SHA256
0e8a742c80cfac900b13e70c5ae344f94fb916538b993caab2182b05917834bf

SHA512
e6a3d200b50039bf3d35ceef76b67d30b0432c19c9e9bf7e6404881170798e0e2df2aaf1c5f3c367d93e8d9f188df33fcb7594ca584c8a4f13880a1770f2c544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a92cf4c08accc91338a87bbc59ac6936

SHA1
98898a35b53b243b73e4ae38d1d1d59f2e98f4c0

SHA256
f267e2ed6b7a10e0b082b5ebec84335b82413009932056f5c7217dc630e4507d

SHA512
33d4e163072d4db7db5c020de5487de4528a9626acad0beab509c0f996d616ba0cc696777bc605cd9f9012cbe1180d65dc451525836121ff7e8c22f326c26256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
815B

MD5
d1afaf6428cbb49b8f85ddbe07b3dd3f

SHA1
86e9e2aa26e93f479f966fef64c935207e38eab3

SHA256
31f0d2609ecef2867c79d2525b848085434524c1502f1ffd4b39cbe8d4173d67

SHA512
c126708bdd85cf0787f868eb631aacf0be7d651e7b61d70305a6a6d48a047ea5447a36182fb6b9b21949f1191cdea9cbcbd0e654513f0f3a3463aad7ccdde04b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
58e5b864d67894964da2f154e8f578d5

SHA1
2be52a29a68db95e90063a9184db28528b651038

SHA256
a69e731ece7d0a6a6312e4ee7c6c2dc4a91808ee641685fb6b2c86a0ee15c814

SHA512
e04093022d70e17de75867b2af1fd842aecd5d1499aa8ace2c3c2e5cac0eb27745a63f4ca3c9f29ea690b9f6bdfa0dc64735c0b036d2964aab09ad0662f9942d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da6efd598bda483051de0f07c6169cce

SHA1
b4ed000d0da0a9e99faf99065b131e56a601b7d1

SHA256
e84b82c69b7d905b5fdc6cf64e42746d75e49108d31e609753be91f26208843c

SHA512
7b4bb3cf06027d3f030c14c1ed8d2e5b81271e3ac3c4a03a87760184df1ce1feb4e4624c017c36e9b7a563da7326a43b053f538163f14a02a081cd8c5e37af16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e8794eabdfbaf2fce4924cd2dec89657

SHA1
cd3024b4d4d634eb3058c29325dafd6b45fdc8cd

SHA256
6b05bb9fde69bf28bd156cb04d9646c066b90893e67c07af29e191c12f1f3ed3

SHA512
e6963e7d3263e575330d49b55553a4efae872038b4f4da1075a021b118df11b5c0a5e0d215e878aeafc798f94bb006ef8afc76f3a35625dafc24ef2ad3e1521b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a86384a43c7316f097c74a044b69287

SHA1
98e68a2aeadce1222a70ea41255723504aa10cc3

SHA256
d2268f52082c4398eb95dc2936484382bc826e7114f21e78b460da0ff76b7a74

SHA512
0222340df851f643246061c95ab782497adea68e77e7ae7a9251c3b32f245bfd4c7fbfcba7e9c81134d620eae396ac365416e27e7b714ca5d0c728e8c0ec24cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00a65f5f98f11c336e154648a699e31f

SHA1
bbc32754d37e8bc50eeb41e6e2ddcb555e103706

SHA256
397e18852c8958bdc1696d9875e156f07a1a38b85f458418e5da2e07e0093c4c

SHA512
7be3fbc6a00947a6d3a8b34454f6ccd5cdc6daec8d3476c5bd6a19cd5c6efd871fd263a216ba92ba475adaced8a0e50cc9b177c097d5a0fbcc0583eff32cb019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e18006d7d1fd3b207179716eef7fc106

SHA1
acdf7507b18b28fa98822e8b9afcbd770b4dc606

SHA256
f9b8bdfac0c4181d752011bc840d4046d5d51ad7a1e4a594b5b8c20b9a9bf227

SHA512
0caa1071f848c13a54e2d16f857f2ccc3b7c122650635357f4cbd1c153e704458591865a8284a0965a57b1cd60162a7b83b58d981dac05cb1a5fc9a43681917a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
2cc8b980836997a228c195430cb0243a

SHA1
a4e60eadc6a7c15bec26642df1a713ff79b2d8da

SHA256
6497df26aa26166b25570707599d9d51c36cfd1bd4e9a04909763b6f5ef1477c

SHA512
a802fb6a16d745caf50f7448bc9baf93f43ad68c6af82bd2d5940e7cd24c7cb192ba8fa8b9e1597a62d32e3f2376c5d2187b85630e4e3fd122155fe6c38fa230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597ff4.TMP

Filesize
48B

MD5
c7bc477ffaa3887a24acec944cde38f7

SHA1
8a89bd6e976c63d06f7b8fe6c044ba8e15cb6580

SHA256
62bfbb6cfa7a777e5f3d0e40161bc4d31416d8cbb42ef77be7fcae0870e533b1

SHA512
302f94d4a8e2475b3ce1795b990e762c725faedb376da661f0880019821ab9ecad6691c8fe6c3757f8bac72b06b82cfa9525ab4dafd6e85fc15ab16b8ce62b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
3e7e363ab396a5afbbf8c03e5c2e5f10

SHA1
3c956fe54562e11a390ee78d177d108702fec1e9

SHA256
6981d7ec20e309edf2e72857bcf0304419c29ff3c41d94325201f2bcd6952db9

SHA512
4185c7f1730380c76dfbd8568b19a034bb6030ab97a63e415d033993e636d3be298dd02a995a40dd303c436240b6cb1801c91515b1fdb669d7e55033e2969916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23e9033bc5afd9e1995c95ed125d3bf0

SHA1
27e188a2aa22ea6874a1ff52f7e7f93bcbc559fb

SHA256
60d2037f91e65a50f71fe8853e6a5806bb8b49c1d83eb174844496939e718b01

SHA512
cdc2974024e4ebd6802bdfd21af59bf47447f9313896bf695815570349a8200637edd279b4377772835b3967a36d91f487673f1353cd7bd403947347cb90a40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5945c9.TMP

Filesize
536B

MD5
4694ea25b53ebd1a047018e8105ef99d

SHA1
6f0d159a0c9766a8d6325e4e0726319391d2a498

SHA256
c19dea557cdb34e43bcee9828fcb4f2ae6ccc207211dd14de7f13b951535ad0d

SHA512
a2881566ce78a0d7c8392b4c898f48f6eb8e64da2e4717af3b8fea78b15a106dee2454e454eefadabce3fea53cd6830b814d192b8f37ae4481bb90e700b77c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ee87dfc0489c4e843c5723e5f4fa72b

SHA1
6ebd6af483f67f00a097b20ea64a5c818abdcd27

SHA256
fccd6e9d332db13f7842bad393629c47c658e835bf94352925d79be47d0df2b1

SHA512
e9223a5aab72f551d6e1c48fca44f540917994a1bb392c99519f6aa46aa2bde3351c6393d0be28c394d2534ce50c7e631e852f38238045b9bb5d3caa29aa7452

Download Submit