hxxps://protect-us[.]mimecast[.]com/s/gKI3CNk2BRT0BAqqi8HHEW

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://protect-us.mimecast.com/s/gKI3CNk2BRT0BAqqi8HHEW

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4832	msedge.exe
4832	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4728	4832	msedge.exe	82
PID 4832 wrote to memory of 4728	4832	msedge.exe	82
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 3216	4832	msedge.exe	83
PID 4832 wrote to memory of 4460	4832	msedge.exe	84
PID 4832 wrote to memory of 4460	4832	msedge.exe	84
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85
PID 4832 wrote to memory of 980	4832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://protect-us.mimecast.com/s/gKI3CNk2BRT0BAqqi8HHEW
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffef75646f8,0x7ffef7564708,0x7ffef7564718
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4704448182310990968,15782636455652332939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
34d46b0ee32d20c8b79b7010b822b8d3

SHA1
84ea0153fc7059aecaa2dd4ab5525502a6330d83

SHA256
7f9c996c00b1b074ed79c065808b96bb774da1a05be08ea0edf4e99ff2fd7e86

SHA512
701d06b09af4d091f85ea239f1abe081707afed80eaf5e305d54048dd466f680ed5258cd240f5db8aa38034da018738810a286acace4081c21c4b1eb7e5c78f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
fc8aefedbc190fb06528e2a979c0f396

SHA1
41799caf0f7a77f9e4baa29a1274a063a1f78ddd

SHA256
2f9b153488560925c95d6f5743ca02c93df11cfeaaae639042911e809cbc4ced

SHA512
ce59dd7acc6840d14bed740cdc2c9242a5cb30dbc978491950897315ae35c2e80d14763ded55c50e96e5e5c2f6e478183bad7bc17ebd283bb483331caf13eb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
36e47e50dfa25503544aca0f03492e1c

SHA1
4f22cecdc9f1c77e0b12ab6d2e5734df0d072a9c

SHA256
0bfba885cbe488c7351ff114204eb7fb9a5f7f3b46bdb5eb8f2aa76f776794f3

SHA512
8b3bac25960a72d133077121822c89fe7292f161d40ed14350c1c78e1ba450d6435fa037f1069f08555fe3ff9116b29172fdb2d70e3282ad4e0f4d2feafc59fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b35fe2a75015ab8edb88ad6bc05305b4

SHA1
ad562eeb1619f9daca396a9fc41083b1b6ef164d

SHA256
f7169b9824935f6337ed2e16231d081cb2214fe92cd130dbb96e3a1d791b3183

SHA512
70f51d202d75e3698db7bbd537458a57ca30c1c3fa93fd2812397db528dd51039c6754cb668b2dc880e7df8cd7aa873c5204892532f7dc78f96c14d3473103da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65cf134026560f6cbc0e3cf9ba92fb62

SHA1
042f5667425c08ef61e2ec0396be5182644d1d09

SHA256
9cecaeefc71c97a930c701e2e8a527c5a79e2f2d8bd89227c5343fbf4831abb4

SHA512
7d3acad96e36161d716c8495c3abc53dfcd671e1032877df39dc34151df885cfef8e6f411f869cc192beab1d8951d0b5ac8e4261febf962f975cd584a62c51d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8c91893a95cef4d32d3d7a112b4d0699

SHA1
f8b9da2782b1e1d8580320565174da460259b0a9

SHA256
3b2c5086638d2b91373aba9eeaf846b8a84f4a6b3d16e3defcb0fb72b11f028c

SHA512
9baf601235d36d1346559ff00f69ad0bb88c4e262b23783ea2e0f62c9d9b0272b07a32c7b2f1ed4dabfb089d11d842182d8fd04a4278064a52f985ef1f7194fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0c119e7b00f73198b648dfd8621cb962

SHA1
3e9ae224822d6e78761a48f309d0770cf54410c3

SHA256
b7558f0fed335bd877bfab1ea99f1eea28a3d051f2063edc238e41f694a05a29

SHA512
e3bc867496641b2525104b8d9a1dba56fd2d1ac2e2b52402d617d10e7c2a64f554e86ec229616824dca22fdd3ed01a90dbf0f4b8f92476e2d2929c2b78e2e2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6618df2badfcd4c5dbc658f80de1201e

SHA1
28c31876b5ef3d575458c883dc03cf850dc47289

SHA256
482130d2d8751dd713a50988e421b82b5409b499ce814f118ef8ba048853dd8f

SHA512
3b4af2f25029a0c0115840b61a639deada67de1746efed4d29ed706d75f24308e861bd5d30ca2ac961b343d73f34e4a885d2bdb9c56c4c060f64de636356cfdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
891805e2275d0c5fb036f4dbda8bc619

SHA1
32cb68c0aaad65b063b034b165008e2ad1821d08

SHA256
dd9c5f65e149f631b0856d84ed83c37036dc2a9b5e73ce380191dd9301afcf69

SHA512
fc011f41fc97fa8096848a68700cc7924f6723a96b474113324c83572275cb1abff4f4483047d8876e397671ea352bcc76ec785112d5edd7ff2737259f6f02b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b4b8013b138f97a2b18dca9ffd2ac56f

SHA1
05d8191c5ddc9828e20508e78e6dc42db5edf7ed

SHA256
91359daece8dcbcceee748e756a32c7e00042ca270eea46a51ec5c557713b605

SHA512
9705053c71aa3f003ba5e4c3b9fcf95fa02c21bada9a94d21a9d5dce9c91c8412e74dbdaae08ff82dd6ef8bba96cae812496824fa00d05aa779d4c32855b4871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b89d.TMP

Filesize
48B

MD5
86e45513329f7b700d3ef9eefa906230

SHA1
92b0f9addbc60f78d165b919b821344c428c2d5c

SHA256
804aac82a2f83ac186b381375ca828a59cdc6d4e7ad6119dce1076f9a8a23787

SHA512
001a433c2d55b8cc91e4e1324086562584dbddf991ea2223fcea354f95a382aa3c3fc23b4019a28aa8a4ccff2e9fc6b40435e7aaef38bb6602282adcb3d07365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
87d2bc90c944643ef450ad844812ad36

SHA1
42672a37a249a5e76d6e62db72c4c8f39f9c4cc5

SHA256
7a50a5eb57fb0bc17d534a4bbea4799c189edd9e2206d8cce43d7e58bb21c0a7

SHA512
7722789e821108b83977ace7a15e50fceb8ebd81be5f885ec989e4803b179e96a84c8c82e4854e9276d6d591e85c633e610273627305c98f639ced6f1517ac7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5e58fa032b0ce801ee1d543bd9d5b6f6

SHA1
cb8c6f6c7bfc32a410347a781b5e45e7f54f21d6

SHA256
a25c46c5f34aa17ebd83613b6550597baae03c3c829fb8e403399e780432ea51

SHA512
227c5de6bf44b28c7458bb7c154c8dfd865750d8af9c2e0f5a5ce03c66a74265d24d1c106cbebc42f009db2efedd31c40597e06856ac0078aa1a45f22c30fcce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9eac82a8998826df896e5f4b2e4a621d

SHA1
eb0189674767cec4103f4e7f6322d1eb0b10cd2e

SHA256
d846c3298988ed4220c2e12ddece94e5ef52b4525892c66be16a8a91e1a8d2b9

SHA512
3f229e13324d3fd89303737fafddaffb228cf0fe0e7d758a4f4e44771f4615f54b6f53c7ec288c6c4b4672547cd4c0b4210bc3332c05b5da1a8db054c84778f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
affcc8c286915afbaee0b4994987060b

SHA1
58bf9108ea0eb6eedd2b2e81ed685555af199df6

SHA256
145bd3b320ea60543a6ace5e784aa36529a9c4674c1c40d04807fa5df70470eb

SHA512
a8553d7d52d3f36a9dddc01cefc5255d5c87e4bf1e25d6c65ee1e350b3b9f793a9de204b307273a5718ef0c55c29b5b0469892d8c345b6aec36bc25ecbb96ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587450.TMP

Filesize
1KB

MD5
c4b26c8f1d9b50859141e1ec79d1393a

SHA1
973a558db8c1c7767bc5db5bca10d5f27f359283

SHA256
0e3ec0fce933402420cfc6d364901283f8bc02b5d5cf47aebe66b700b4ca63e6

SHA512
3bc82cc5841f121b6f5a5462612461917ba2a749e4fd83ab0fc7cef0668237a767cb5bfd4334dcfaec60bea2acd6533d1ea2776450c8a6e6e713386b1fc327c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b08b68c3-3834-412f-a3cf-3c4d6f31284f.tmp

Filesize
9KB

MD5
006752a2578fbb44d877d02fd31bd12a

SHA1
d355acfe4a3c6e8f46d70a9bb274d83419bbc801

SHA256
f87b763e17b199aed173ab725a7296e4513873478618a2a9b011d4fb2ab4c5df

SHA512
f37989b097a6f6c68f1b97948d4199278d875cef1fb7a6bb27ecdebcfe07e69a791e753b03a1b3c65eab2e88b7186df421c14cd86f4cc96d125635c91bcb9df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a411bc60f24cb75958ff23d419228ad6

SHA1
c8b0fd0f45add8faf8937798de66f58c995e067d

SHA256
e67bd874ea264ab7e7bdf87e0d99baa4cff86b04927e35ed9b1a10edefe7bd5b

SHA512
eb1064b6d2d0e66c8de3e55d23f5c63a7520c95bb2139c317eb00ba63a82e03c1849dd5f9cfea9da4c92c8cdb706d654fcd7298f8bcb6f3a2b98a03f5eab6902

Download Submit