hxxps://malwarewatch[.]org

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-01-2025 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://malwarewatch.org

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: chrome@90
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	discord.com
86	discord.com
87	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3870231897-2573482396-1083937135-1000\{836D2028-D6C1-439A-8FF6-99D34E4CCF1C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
4456	msedge.exe
4456	msedge.exe
400	msedge.exe
400	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
8	msedge.exe
8	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3452	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1040	4456	msedge.exe	77
PID 4456 wrote to memory of 1040	4456	msedge.exe	77
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1512	4456	msedge.exe	78
PID 4456 wrote to memory of 1700	4456	msedge.exe	79
PID 4456 wrote to memory of 1700	4456	msedge.exe	79
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80
PID 4456 wrote to memory of 904	4456	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://malwarewatch.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e9be3cb8,0x7ff8e9be3cc8,0x7ff8e9be3cd8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8028096587382395715,7692626359464225580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
20KB

MD5
914b48d8ee6e1ae69781cb516f8b8747

SHA1
7b3ea115e5ac4bfe00157ba0ec3a7d45bd6cefee

SHA256
b2884b2174ebb83b9acde472089699f389417e7bab5ea8039650f00d4c70fd72

SHA512
c445c443bf2b698091e1353cd152117a7f0a4aa36f7b0a6dce9a3e5f287e0a11c54f3db396cc24f3ab18a0bed34cec64cd397e7700955ba070565d7688c1ec6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1556a04db1cafd68c18b537db0b7bfc8

SHA1
308fef7ffea2450328cf1dd727c3903bc10a4c11

SHA256
6db4bbec35159ee1d8a3022cf77613f43c0acb435cb663c83ee8c59583ce788e

SHA512
d3d132dd1337b9adacea08c49a3ea89cffa6d0418cbdd44f9f95204fd3c93b4ef4e235284688ffe1f9e2fa6512c6a5c069d3d25b05872d56e85478d84cb1f3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
666b3036f04ee06350bd1643eaf3fe20

SHA1
cf959c6e3b346c388f6f423cd72d8e1440752133

SHA256
1a5042ce2c69841a58ce4bc8b96c185adcef2a2d48fb7f6621e9ed85e0c96c24

SHA512
f430a9d5cdca35a0f8c8ae9fc4a564b75e7a24471517054fb4ffd3a3869a116e9ff245f6fc2e607728757cdd32c4d2c5b9cd4ae985c6f0450c00e9c51dee391d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
55554152c48878de9a4c1e42d3a8ec9b

SHA1
b42264aeeddfd5e0debcce10159ffe87a7cbf5de

SHA256
9edafc5604ae8babd11d189b4755c46ec5fd8cbe9aa0f90966054f01c57ac333

SHA512
d2c554d66eb6d2ce28d7e1ca2af7d0320a9e6292f7a1f4372c6cbc6f39d7b77ca2542bd055635b5a488a16457318d9139a18ebbfad7bd4c56239c30239dd7b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
961f22c0817c34d7225abaaa719cd1f4

SHA1
11534bc6f8ebf5ee9018100ab22fa83724ae59a3

SHA256
25c0a16b66af847195badfb45b003d30da02df89cd837b5f90dae6e3e86000e1

SHA512
3a86d1d3d5288e9452774abdaf62bd838fc8a9bc9782775f28ebb46b2a4a20d5a902425f341608a6317d842eb3ff54f5cd443abb404e3adb9abfc6865eb0eebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba69850cbd9d7444009e208cc9b59f44

SHA1
e02c7dab70728d6065cb201c24e98a7017a7e42b

SHA256
e732cd85903004245e2f491767bbaaeb97e2e667675a72f1192e1d0e94774a04

SHA512
e80a837a292db66bf9d81b96e066583ff9a83e3c82f145cbfb0a87fe653a1574c732646e32f883c7d5002e01a9afeadf6c88565e1b9531d249dad8c407bd473a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
856cc78db573699f452dc0d309acedf9

SHA1
aca263a3df2fde58860fe4c5344309dd265e3c35

SHA256
93161c307ed8764a0625c4edd78e26dfaa7f428891b065d5146f59a3ba2e3aff

SHA512
286f9b9f952dc10d8f36c0ae3ed030dda50206953729d0c690b71de433ef536821e6579ba7e25a77ea2fb666b15906a0a100217c289c5fa93bee6303763a4943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da3343715b9af6275eabd8bf66717455

SHA1
50d1d17059d2633847f1a2bc112721fec29be756

SHA256
427da6d30f68742cea455b79dbbb86c93b5872f240c728ca6e198cc4b5bac073

SHA512
87eb503461ffcb2198c12439b1f08e13c35ebe7c3c4abbecfbccaa0d45b9cb376f0593e1fd892c5631057df08abc69f19be558b32d7affd3401810bfe1b81ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
af41dfa4ae7d8b993767cca29e012a8b

SHA1
feb6fa9b82c3da1a7c4f20873c6644f9b8d12f10

SHA256
71b2b7a1b7a9d0ad296eb8a6dbd6cf7cc8183e739b3fcb7369c7e706123a96b3

SHA512
dbaa9cac13c03fc5b26a8740860a03c1b45e493b2df1f83518a6dbd60456242d7bc098246bd07521f3c6921a63d1ab7f1b5274a8568fae99e0a7d9d50a8e19b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
391dce4affee0257bc4725a766002fde

SHA1
9ffa8c888842c3b914db882ece9696d343162cbb

SHA256
a18b2702ec17c861bf1021b3614e215c3fe2166b800982ff4c3e2fe2f44cea3f

SHA512
d45025f38dfdf7da06388d429f954dc5fa4f56be7cce622671805152b0cf5e92aee05a35f6c08bbd080f1149c288d834304f3b2b39289246f193947144a65ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
99692bab724aa9e9a53655fbbe5cc6c6

SHA1
691195b17e31ff68db868cdef3af96f7a0a128e5

SHA256
451080b163edc720c47e3083a7c8fc5dceada3057eea349f321bd89c1382874d

SHA512
b6f599d85db85cb0a3577c0adb12b6f17baa382f4846e6e1affa85f0a1af7a1c08d623210a930f7fcd6d89b78b2746366d888c44ca318e5450b81c983bbd7c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7d9e337131cde59fc52db423e521e8e5

SHA1
a68cfb669fd2d525cd641beffa77575473adc38f

SHA256
44aa1d13ef5fc2ec12f225a74cb2e516666f39bcc17de4b6224e1f39fba4bb65

SHA512
54efe03012de9e1e252678c79f689d09f7d1c798da090e7924af24d920a452e5234a0a8a9992486000a47d96aa99863e087a4cd38b939052f696bfb1e4db2642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8cddf1a6bff37069a76ea198b43382b1

SHA1
8d3accfd09f0257e12db63b8d0137414ab668d54

SHA256
30f8a8ad4e3d22af5cc40e1927f4b10ddef2b59259fecd9e24f2e49acd5d64fb

SHA512
b1469f13546b4a03d88b07c06fbdcd244a72aab22181d05348d4defac7d709c1ab7bc799caf43e391187b7b0b6db144ac9daeb9abdca5cf2b97f74e985692746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
778650e722b173e3f211ecbe3a58b86b

SHA1
b898a5d4a1d475566d64abea22c5bbd3dc0677e8

SHA256
8934b01d7979297a17a36d816c2bfadf726b95545a77db78b9123f50e10b4679

SHA512
3a969f1ba13245313481fa7f05e3a25ac805b24dbbbc2e69682a54159161366ae9ebe1c192b15cf821b496fc7c280cf18fb33aece13575d155d5a50c970c032e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6ef5084530ee6782d4579128384d945

SHA1
775d5f47bf4d0c4c62d0bcd23d504e66de18432c

SHA256
01bfa514da40cebb6973a2ae0079bf653c66844d194db484f3b567c3e58df8b0

SHA512
30d2f62f5d1a71c82d3ec1100e06a8863928d48db9c7a2a124f32e2cd1dce90ff1cfedf4090c92346bb550abca844a7363170b79daa2a11bddab52f8c86467a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fa49044ed88756f445a7ff375133318

SHA1
f367d38204f759333926aa359e3d0fe63f714f1f

SHA256
9d8b687a7896a2db84ee001a395fccf88f32b447e31db04bb52bf2d36b161caf

SHA512
0987eb9abdb178dee2382d771c70afed2f1ff547f748e046e473bc90490e41e02e7e93f607ffe57a487c663ed0242f25c6557161669176cf6795ccd68c075f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d4691.TMP

Filesize
539B

MD5
4c930680ef683c531b2556553f4b885e

SHA1
ba236d56330337648addc157868437f8d9b28082

SHA256
fcc6ef669c8cb70370441cb658aeb77a3113c14ae40af99bba67943f97529863

SHA512
9a7893cd16e4544792e88c224dbe055a365e3058b7d5ad8a3fd1777f055a69cc3d82f5c40e0a20a45a71fb70106b79b8a6c987efbeb0b070727665985d2fddd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
910601038634039dd461823ebc702d51

SHA1
78f0f412cb6af910c60ca85715ec3302a95c120c

SHA256
d650f3b357a13d9a69100068e6b937e69e88e8a6c64cc08d97e96185931e3e4a

SHA512
867f7d16982a24631b070c2aa5f4d73658ef9bbfba14aa14becca49b428e4a2c00e5ca9f49104086c914efe4d7a1bcfe21cded4fd91447928d33476b444e50bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e3f39e896ca4958e1ad758f07ea865f

SHA1
6f1a7da2f556f9ead09f291523173050c2578b74

SHA256
b002c53d81f6139ff2f9771351e3cf2aa2a85d964c2b977d2158ab799b84cfd3

SHA512
f99e430c134dcd1d1c9cf53f8b2e667b89175d9a3485afacefe5773132483ae0421cafde324540cdc5c1ab81873671653703e0a006a2d22ae79c61ed4db280d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit