hxxps://wetransfer[.]com/downloads/01c6d5ffb3c8db489ec1a54557b8dc6e20241210171030/aff11ecb72bd5c11867b80a1fa48bc6720241210171030/431033?t_exp=1734109830&t_lsid=52853e8a-98cd-42bb-962f-f6ebce0ca298&t_network=email&t_rid=YXV0aDB8Njc1NzM5MTdkNmU3MWQxMWY5Y2E2M2Fj&t_s=download_link&t_ts=1733850630&utm_campaign=TRN_TDL_01&utm

Analysis

max time kernel
100s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wetransfer.com/downloads/01c6d5ffb3c8db489ec1a54557b8dc6e20241210171030/aff11ecb72bd5c11867b80a1fa48bc6720241210171030/431033?t_exp=1734109830&t_lsid=52853e8a-98cd-42bb-962f-f6ebce0ca298&t_network=email&t_rid=YXV0aDB8Njc1NzM5MTdkNmU3MWQxMWY5Y2E2M2Fj&t_s=download_link&t_ts=1733850630&utm_campaign=TRN_TDL_01&utm

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
1156	msedge.exe
1156	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
5440	msedge.exe
5440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2652	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1376	1156	msedge.exe	83
PID 1156 wrote to memory of 1376	1156	msedge.exe	83
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3620	1156	msedge.exe	84
PID 1156 wrote to memory of 3696	1156	msedge.exe	85
PID 1156 wrote to memory of 3696	1156	msedge.exe	85
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86
PID 1156 wrote to memory of 4924	1156	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://wetransfer.com/downloads/01c6d5ffb3c8db489ec1a54557b8dc6e20241210171030/aff11ecb72bd5c11867b80a1fa48bc6720241210171030/431033?t_exp=1734109830&t_lsid=52853e8a-98cd-42bb-962f-f6ebce0ca298&t_network=email&t_rid=YXV0aDB8Njc1NzM5MTdkNmU3MWQxMWY5Y2E2M2Fj&t_s=download_link&t_ts=1733850630&utm_campaign=TRN_TDL_01&utm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5ee046f8,0x7ffb5ee04708,0x7ffb5ee04718
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:1
  2⤵
  PID:8720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:8832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8952 /prefetch:1
  2⤵
  PID:8936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:9048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:9056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6159265142030076352,14663428426830337511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:8452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x404
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03104ffa-e5c1-40c9-821d-6477a479d806.tmp

Filesize
8KB

MD5
196d038ec870f117f6756972492a46db

SHA1
eaed6c170920e2ac18336fabf6aff6f367263401

SHA256
a5c203d61cbecdf618ef97ec41e29e26771f1ec89f1207f5a2886d374935298a

SHA512
ef363ad7a6db188b829731ece5caf413c2db34edce0d81f9f7c24d510e9849dd46451f95c2e0313a7f4babb26faac26e89d195967e7c70cf1266aabab6f242ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0d0d8c8c38018ba657d434760042f44f

SHA1
73a23348cbd1c38a16f6144a5e33e30cf373c779

SHA256
91bdefd3dbd0176b2c6c043b4d560ba6a35ebcf099bc5dd5eb1ce8ae3ba0b1e5

SHA512
bd486e213fbda74e38fbd22709a4334096ca1f50768cfc816267dd6859cb9cd6ee125b59be5e39370063eccf7176de40355839a134e5a942483d2292c257be4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_backgrounds.wetransfer.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_backgrounds.wetransfer.net_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old

Filesize
351B

MD5
8b255ade3d2335fc8f67896978db5d06

SHA1
1dcf25cf0d71980e46eecc3561a6c1691eb685a3

SHA256
7c7d57d22bf14757770d8f0bc593d248a0f5dd65751decc6b8d9729e62cc6f25

SHA512
78212bd0e95f13426511b97669f067512e8a5c91c72b61105957846b1d2c3953648ade8c1c9d357767dab3db6990316f34313aef6dd206534b1f748700dce36d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7130f69c97b1a514268e9a84ea2d7f82

SHA1
b3e87a607d102ecc887cc1c4033f96c43db4eb6c

SHA256
5df36e0c5be0c44002afe029176ede61f2bf41e6905e704b8f279b26f972d837

SHA512
027805b58d7342faef1d2c0c06501a700a165d6229b161c6e2196b179dc63977df69809f0b57ca67bafa5d0c90715d267ab5cb4c1be12bb5b8d483bf3e0b5da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
25d5976b49df5f13b63eeb019b54256e

SHA1
f427d0810192eaccaea7362a2fa033f6c9f48a42

SHA256
e51fbd828fece93ee4f46263893aeef0e25401df1f8897bb538ee68d5b971402

SHA512
953c64de1c48b072ad3bd959b29103e2e5926f26b6728ee30080beec2124e5155bd051701f161a49ab60faffef037a5fb5afbc00c7c56ea36984c40d991b0a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f620f6801979bf9e5d857de98da02197

SHA1
0786240afc09c5b7ac15a88a48e31b1eb249310a

SHA256
eda3307d7b43369791a634d39e25ea431587cd90f753b5036d3bcb591e9ec2a7

SHA512
f903a231920cf8a2d87d7c1ec988f6b8971e5f79853b09b56e008093fe75a6a582a605d88da5eb07f39908f922645c7f3b8c962f057de2acb7f83bc446ef6364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c5c1bcb0348af107303cccea77f81719

SHA1
84d1a3230accf06952c6c7a8f0cefaa34370e063

SHA256
c4efa985dcafc66894c05e6a21bd3a5fb06b0c83336829528e1756d15f0435b2

SHA512
192ef616215973f07b5cca51bf3c981df9d22e65f00f739448edc6e9ab9cade12893a1bd7f92333f6201e30e64f99b127cabf0995ff09d2362accd8ecd1c0ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9763a5243f4f20f1156679c691c797a1

SHA1
492508f777d8eb2a4ec2453c3920dd7aef94f480

SHA256
27ee33feab9084a8ad702bb25fc8a92d2b3507c146992e916982455872de187c

SHA512
6b67170a5047ede62b27c3bec8938d9c8ec6ff85fd5a79a477f31772de61fed51fed1d03668e4539e3e85ccc8727be552da6d44c04d9cc813040ef909a60cea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8b70ae7ce77ab9786f238ec1f5ec13b

SHA1
5947a9f448706729a8da26381b6e7b14d6d6f6db

SHA256
88358a2e8a4b84f911efbe5c182fee414f1774384729d1bfb9c7dd1fcc84a8de

SHA512
160404cd12ae63956d3cc45ac6145791e30c965de57a99ac382e648a803709de745cc7625b4fca433c5069bc1673dd3bbc612e388380a11f38e8c05dea7cef04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\bc651cf7-5765-47e9-bf98-534097d7c8d3\index-dir\the-real-index

Filesize
18KB

MD5
b4f7e1d3a37125f679906cefc27b15bc

SHA1
02d9b9285fddec9e5c584109574a4bb88ffd695d

SHA256
9f64ff64d799a15b5da5841fd1cdfeba45f8ea468c0d36b61b3865df19c9168e

SHA512
5f38b1dc83279594d68896111bcdfd379b1b3298131e3d49e13747e4ec5206495bf26d34b8b8841aea2c12107b4aea9b182630497522d064d3ce7159cb3a22ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\bc651cf7-5765-47e9-bf98-534097d7c8d3\index-dir\the-real-index~RFe58ba43.TMP

Filesize
48B

MD5
168147b8071c6ccae3401d37bc57fec9

SHA1
f2237a4b33541e005d8f01dc928505bfcda28d4d

SHA256
5c1346bb75d3a8804819aeb85e6d0a6a12f3adfc9d391031729c730409f908dc

SHA512
5f9029dc63605a5d77064d490b37e9c33a044a9ea69465b1d169a38098ca5652a4ce4e820a22f6941b46405438c14668555d3f685babb32532b6525e183b3403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\index.txt

Filesize
235B

MD5
668576ce83b4ffcea6fdf2270ae711be

SHA1
64b20c6744d0dc287b0b449516217eaf6b4265c1

SHA256
53d162ed819c38d5a475bde8f4561453aae6a04fd9d7b4256d0954d5132e2312

SHA512
983f59ce36c0727c055d989b3692454d09b48888df6670a3b10bc0ff6d80ed15cd83b6992e5e4de26994bb13373b9eade62f543337a6330864b728fa033cc745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\index.txt

Filesize
231B

MD5
ad1e0f9399755362cfab7f259c7f490f

SHA1
4d0b36a4536479c03e9520a7851e868d48302780

SHA256
a9beb33088a7576ff6a9023de9da63f3800611b55baaa96f5bbc4b0c510784ab

SHA512
69d7fcab96809bcf5e8234f34c4c5229efd21cf57fbefca09fe501d6a601da5de1eb60f067311855907bf4dc3dc7946c74f16804a998546cdc77124003f8f359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
6ed129e515cfb08fa10c158c614de081

SHA1
d91aeaa14d174484073d98dea6eeb615bc428db9

SHA256
40d03b6e00edb05652f78f2cf37029106f21a9dbf7a6ee2b376d2f2e9cf3726a

SHA512
5bbd73d8b7800225875b9999c27ae7b5cca9310aead5c15908da4fa781101e5e81878b0d46d59c61506bb74fe243eac1f9abdff3f89a0b2743fdd4b9a825f6f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58607a.TMP

Filesize
48B

MD5
4064212471399d5227a3febde62ca4af

SHA1
2bc38e62689c27ec5a94f3a1675f37affb4a1f53

SHA256
96fbf11b7a3764f4ca278ef49531762b34b1aabb2e3be370128a23685e886e09

SHA512
93a9553072cc5a32a934b1237ecc6847c6b06be98812be18241151c5d99bffe5cb3d61c341eb9a7ad8883eeea47d87e9f42fe97e02258b6b700c29b88d7b3b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b4189b018bbed56a1fecee25d254b9b

SHA1
71b17dd51951bc51a19309acb73b1f47eadbffb3

SHA256
afdb42c295e012955f9e8aa31685ba2cb32aaaf31b038f792bbade4121d83a7b

SHA512
21b05e3d1ff35e3cff6f3d6128d001488c96d4443c9b6c05e7c54f2332bb6a776d76c00a7514c764a658763b0efeabf86ead99b47c624fe4dc8aed9dcf402fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d468c477a090a3766c45df58aac2af7b

SHA1
78dc59290a631a9a148355167e395378f9877399

SHA256
319cd0bb2c6d4fca7d82277307c22eb275fabf09a5e85927170729bb954d5196

SHA512
2a7324dea2647aab45c1ed7828e24e910ad1a41d6c2b491daae31e5ddb912c7217af774232fc882cc62a1e3313eaafe0a4eedab0758e7be45afb22c89191f178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f0d8dafb451c57ce61563f1df99ad7c4

SHA1
1c51dde775c1f216e532da4125c59e21763a8bec

SHA256
239cb2a5ed001e4f07209511848070b789b2a9e1bdc7e94f74cdb0c9d962361b

SHA512
99af1fc9c3dc9b0901673ce3c3169032af5a049790c876d42cdb09366586531669a36c19d8b8c9364b178a26a19c718eaa3618853eed5ff2fc324f23dff04d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
31707beef0b7ab02351d8e264d4fc712

SHA1
8919b6bf77f8c1c04e71342834df2bbd22c36470

SHA256
9ded6066ecbd05b4b35a704077f88ff4ff0940ba5b7c2a7e71c5630bc78d24e7

SHA512
1d542b13f1c8ac52ba4eda864565480870ade0219a71d386c2ab2732ff97a15b8192cde2ca3b7df36f89f615d1914169b3131e9f732ef5670f7e9eb3c94aef55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c239e550eea8895b692b2c949e049500

SHA1
213e9a369d3879ae7ae7a9f4e6696aa8463124cd

SHA256
2d95761445dec4d9edabf5ec0d627b0a7ac838ccb75e535d50e4fd6cfc7b94e9

SHA512
d22329bfd7a38c07149230d0a1a1b2e3381096fc52c9ad822893684ec0979b44b14a60f22f51987618c4fb960197e74ae49df3add9eb7b0bec92cbb2fc61a625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1bafac465f35ee129c5fee1a5be1ba9f

SHA1
71298a3473c62acf60a7c5f517302dc68567afe5

SHA256
6695af0ac0d8e55a9ef523a02de375277a9e0ab0d5b4d79167bad30b37e94052

SHA512
c8dfdd4da63f76475940afa2230caa28449d54ba29ff3b1eea59267f4b7a82d726c713fedff093ff1a06bed1a87cca46893df2332323c29e977612b6c9df8bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6f7.TMP

Filesize
703B

MD5
23c337df6f6adad85509702a6d258ed2

SHA1
7e6366a06d3d5530c09853b19a751f84d3d4e51d

SHA256
38d69898210beacdedb666d47039a5313f9dab91a1436b9622efd72c48c0fd00

SHA512
5fd3fd8ce2c58ca57a6e733283b3365df6f80c235d72108499e68e0d9d0353d331b9536384e65c7b73d044a3a821234b77eaa2c6a12d7f4150501ab35063378b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6bf3f0865eb223043e8558117f29ccb6

SHA1
0065f489eb863b15f9c539ce8d8488a989278de1

SHA256
1358ac610925ead9094ae5421b3ec19752b0708863626e7d2cbfa76e957f92f3

SHA512
d0f9e0f846305bbef3d57aec2859f8a9d454a583c7e9a5acab806936543ef6557e9371c78f596f9b52697f8816e14f271956b1051a149fef357d04630f91f18f

Download Submit
C:\Users\Admin\Downloads\quotation.html

Filesize
1KB

MD5
743073f0599f3bd2f3947a19067f6e8d

SHA1
16db3b30dd955d5c0add502c2d0190cb369902d2

SHA256
d8200d81d107d2921e6d8b54c83ff69976294a6323bfd944d679144f6c4467c7

SHA512
e38de10457bfc99a36f3e550fbda27e24aeea468d8ca4741289df82e5fc0c587c25239f9c8c022d68845610e530b0736baea27f30b66a8b91c1fb7b68efb6a9a

Download Submit