hxxp://marketplace[.]visualstudio[.]com/_apis/public/gallery/extensionquery

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://marketplace.visualstudio.com/_apis/public/gallery/extensionquery

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
4440	msedge.exe
4440	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5088	4440	msedge.exe	82
PID 4440 wrote to memory of 5088	4440	msedge.exe	82
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2228	4440	msedge.exe	83
PID 4440 wrote to memory of 2064	4440	msedge.exe	84
PID 4440 wrote to memory of 2064	4440	msedge.exe	84
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://marketplace.visualstudio.com/_apis/public/gallery/extensionquery
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f3e046f8,0x7ff8f3e04708,0x7ff8f3e04718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11945766420425607060,15168579317210286001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
7b8089d46339d37e089fa60a6994d701

SHA1
b5b14d43fb7ade4e2b74f772deb5f696f0c21e0e

SHA256
e8046e1ddf894024eb858fc4b20dd8a76508a68f8da3f699ab9b1a59a1046bdb

SHA512
c79b81c4378b8e5cc7c13409f0a99566be6b21c5eb1a59bfd9e25e8eedb2ecc9381509115e7e40844fefe1746fde8675010a9bf9f909c33dbf7c4d6e50081c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2d8fecd6980ecdcca0d6c448a158417d

SHA1
9bbba813bef13b7f1be1152dc1d586218a5d1aa7

SHA256
70a39eeea966083e7bbbbd92ac7fc195fc8872e94af5ab62cfa5f74e5fcfda79

SHA512
e7003b47687aa3a84996477207609f9b0610df45d5b6828fccb3c1372d9442c2352b58b58df02816569c78723c618e698ace58e925787f160cf6b8f1d18a4f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
968B

MD5
31337cf0ea1ace158a87789ea1ae061c

SHA1
6fc4cfdbe7dbe3f624a8c5c3ebc95d840b2ce21c

SHA256
c58122f72181f5c498671dc47fd11826e7df2d20f38dbf32d8e6a8d1333d6749

SHA512
d461f48275e1dde1925bfa46edf0c6e8c8c43e9180276f5a96be8b9fb209019773b19cbfb8f4840d5dab39b6bdbdd89e6c16e1e222fcd9cd2c503a81333ea1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0b8f3038e816bd6d2b3614142834e091

SHA1
7960c4ecc0533dd63967e5ed0e9cc9a485ded874

SHA256
72eda5de8e894b8759a75e2919fbe1bfaa3b2d5b58b402f282d86c05dcd8c5ba

SHA512
969c6dd7fdf87c846502d0a6fef75d0b54face174d79a1ebfd19053349183ae2f94b77be0207a59508dda0764d16592b296be50700a6590399ca30464cbc064c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
81d5cce6b7fd04e82c2251ebeb39c35a

SHA1
3de1ad9dcd79adbdbea81df8d00b65aab030ef27

SHA256
3b643ec50ef0826d1e98c7e4c5808f71e4b6b7c6d5182ac373d5162421f3bbb6

SHA512
45d39512e7c4a51ba2a96568f8fbf7cc71a9309030cf789eab3fb4b3a4031e8d27378ac86237e37ad033d5ea33b2e579d8550182defa0cbab5207f25dfcaf93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c635980f5955fbd48ceb9cb66c32428

SHA1
6164d2c7f36e4bd2e58c58e663744de6af1b2138

SHA256
256eaf681044662daed4cb504dfee5bd44741c46f303cc62913b48115743ee61

SHA512
5a1b428fb4f7c8211e74ea04feeb36d75c6bef778f030f8cb629dcce7a85e522fcf6bde4b8b9a72412ff96c16b9537508815dcd94402e928f71a3d53dc121815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b144d4fbb80085cde6826bc4003ab05

SHA1
31b0ce93f7090bd112f2726bc2f1059cb1c42e63

SHA256
c59060b7e7458f08653aaf497650ae9f8b1efdeb8443ca9e62a32fd3b3100b01

SHA512
f8a92d4f2e1aedba692e0def93e5d58b8c82bdc117abbf7cdb15d6cb32618d5c09f7171dc5facafcdda1013fd0364f57d53173e7134da832d6324378bc5065fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
b2dd00c36ec4823a0f118877373f3afa

SHA1
23992225a640aabc26c85f9d63312e760f1491a8

SHA256
98f5a4d95fc87955b4a3f08cb59151deeaeb75c1d7bef9cce9c4b930ceeaaae7

SHA512
cd4e2b3b97462adbbb2007bc400b6932c648ad83d416e57a76cfbe22d838c6b8fb931a6bea67a16364717d35a42de638659df1dfea1f49c52d18fda15ec4e10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a1c53b63bce50c09d6a8e69a6f675cd2

SHA1
0b74a43060a3e506a49f694044b6a033899429a7

SHA256
5787137630b1189935515190780a0dcd1c6ee03d1c90fa8c54be9e3988bffd51

SHA512
0b01323ed48f61e5c47d3cbf933ce88f85fb3fcd132a04600f1e128eb9bd01a744dc117cd170ae0338f31660f7934fb56dd0c8dd79e6ac98f7074a72b4dd3d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ba329dd1531b32977a39781a31be0d2c

SHA1
f15fe13718ed93d7a4636fc48fa13dbe51c74930

SHA256
44c7bc9e3b4fd3b7ef9ed73195b1855b495d9518b25ef66b52a69eb054deb620

SHA512
999fd53ddab2b90666ff0c959dc92daa41542dc8c74a3b2d3815f4e3d1a5e575e9d86284d92d87d67fcf847bcf7e75097f4bf1fa4a0a3fa98a19db94d5d8c2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
19bf5eb057f356921879653c552124f1

SHA1
f0fb389d39529b97930a18a759872317d8222028

SHA256
235ccdfd9cabc2ab1fb2aea9574c89ce2386a150c786d2b52e149a4f5c20acb4

SHA512
f8a0a51175b602bdf788a345a5425dde5bd7daaedb360a756a359a659b9b879604bb522cff7f1a48cc8ceb568c4da23dfbe768e443dfad52657a989125252364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580579.TMP

Filesize
203B

MD5
5edb678dcd8385b39ce4e2f2df2f21a8

SHA1
23277f1f38a71e83511dcfb11992db0fa1d9ec9e

SHA256
c8d3349b37adfd7f4f26f301f88c927f0d9b9007479e72fafc2d339361fdb417

SHA512
f91ed9912d70fe97bcbf93805a4546ceede9302b3e8150dbbb2c4ab73d6be0c7ac19ed51bf7d2a6b0ceb9e233bf7681f9b7a56e52cc8c04c9ad2bfa19dacb312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2eeeb877c4c84d3b622e2afa0f5290b6

SHA1
8d6527ed6444c0211e5543f8eb04b2c0411ab874

SHA256
efeed32b66c8575e7bae5764a65fd6417f6b276372d7b8f8bffe5ae57050c08b

SHA512
ed16bb57ac6c3efc5b37c572c04186950bd96f875a7385073acb83b7fc4f164f513ef5ee4fb7047999cf341a45f10be039c043b2e89eacf4d83fbfda33099edb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit