hxxp://marketplace[.]visualstudio[.]com

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2025, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://marketplace.visualstudio.com

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2284	msedge.exe
2284	msedge.exe
3464	identity_helper.exe
3464	identity_helper.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 4896	2284	msedge.exe	83
PID 2284 wrote to memory of 4896	2284	msedge.exe	83
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2308	2284	msedge.exe	84
PID 2284 wrote to memory of 2864	2284	msedge.exe	85
PID 2284 wrote to memory of 2864	2284	msedge.exe	85
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86
PID 2284 wrote to memory of 5092	2284	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://marketplace.visualstudio.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b4718
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36b6f671-6a59-4d3d-954f-7a3334dd13c2.tmp

Filesize
6KB

MD5
d233a5a459399230daee5c6c55870c0f

SHA1
263aff287add6504b23c04004fd5297e387801f9

SHA256
6adfa27cc8807a0fab413874b431d50acf8b7fb24b8a6aefe7921113baae14d3

SHA512
0b4ab646acdba7de1075c87934e6ea86802b4aff4339edacfbc73b0fd09a5bf4fa843a3c8958c7cba91225b31749d093b5e1fe6aa48f3fbe16dbc14ff0025e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
110KB

MD5
a445c33b2031d0b578477e099f96e1b2

SHA1
58448f2892886556bcf925aa28a1b93964d27553

SHA256
7cb659b6178db5a4c858c7b7e405accfaa3af745ce8bb68c001d9dfea67254a0

SHA512
de36e77436a72336f4fa06c736ddddfd3b45b5c9e46d83f4ba374c3c4577bab3d110dea3638cc97a2724da39b234f2b134dde50818c4d7d64b1084754a64f80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
11581f2c579626703f87b1400030fde9

SHA1
872762abda91d6bf615641e61be8312259b7a885

SHA256
4d71ec24b2d3fc6977f9fb48eeeba5fa5c43e4af68a08e74a0dd16e6fa4fcb62

SHA512
1fb315c50f4731fc2e9c15eca6837346efb3a611cb3d0cebe1b1f2908be66e199b5df14021ef489f918b7a8dbee7b8b3c95f17ca290e09010cc2ec28bf790d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dc2d5fb9081a5ef4daa01a646f48d042

SHA1
be74147d857b8988eaba8e5b02da5535f2a1fc42

SHA256
7e06cb38189933934bac4379f0f67fdece35589b496aaab20b096c73ed0d62ea

SHA512
a04d569879dc414e10527b027e0bff4268a60c6d9ac8967c3466c215d3474fc1f64d2ea4fec3105af3f83b35423a0b83dbe828244ab01ca322aa430a37c9f79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
f50c78af74fe4fc1a0b0bfc14478422c

SHA1
cb7c4da5a2f92995f2b3cc99bace6ccf07e98205

SHA256
c295a670b56853eab28b2ca6be68a61c1e2da143a3714c7f02c2740c09033667

SHA512
789bdf2af52a1e8ba7ec3805fed6d1958fb3942f8230065f02d49e07f90e87223a54b925ccce9d9b3df5cd0feafffdc4dff77de0b32771160685758018f95179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
352B

MD5
3b784a1d9523594ee66300f6ac91238c

SHA1
c5935bcc5068e5e49e30525b7ec0fa30010675e1

SHA256
95e295f814d0a2a35ee4541cb0102d5a51f2ca2db4e7b600d49d446a424e7edf

SHA512
a7cf6b6709141829ec67f1a8ad736f8f7c6b816c8707f05c9cff4cd53b49a4e6e4ebb954088bc843e8ed4eaef36fe7eaf29de0c41ef80331cabaf1b1d15d40ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a905900213665052996b394c44a5154

SHA1
43934f9b25008f1adae2b1909e89c8d7fff136fc

SHA256
d4a1fb72c4716543228eac22a3cac041093578087a0f31e6f741faf868f3c37d

SHA512
e47dc1d1ba029be663dbe40caa7740e8b9def9899ebebfcda70e53526bdfb17dc04112e959a12478539eb481a161fa6cc4e7d65472352e51ac0151ae4eb732b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1557cd4e629438a104c456cdfe53b22a

SHA1
99488e296538e18044efc57f39dfee4edab1656c

SHA256
7a62ec71598b78a41f169af033b8bc953d8d689c62c3578d76e54ecd8435f08e

SHA512
cb02ff27a77b1f8ba354be79f9aefc0764ffc056a85f9dbfae8ffb5bf8d976a1be466efae573af093e6553a976cbcefde8a38441fd1bb52ed09e34f4782e4c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3d3d1dba571d39ed5585b97b8cda8a4

SHA1
2bb2dbe47e71afa329a311ba01e67fb706e89084

SHA256
64a1fdcadd87e302af7ff19fe3c55c94238389350a12d1c3fa31c16fd7b92448

SHA512
34d301c3ee0955c2cf767d528a948a92882189cf883191311dbad89410c84492e563e3c6595593ed85f6441b2a56a0fb3d3cb64dd644d9d3fdc913c6a6548c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3ba96b80c48c63249978760aac174e19

SHA1
b872c068f96589bbf8031957c13abcb7e53e68ad

SHA256
0d969898dc9ee857dec6438c75baa9119173f899620d2a665874960da95373fa

SHA512
ccdbd534c54c5c08874b52a0b0ad90d47799fceea55963a96d4524dbb2ce2797647eeaa5db310f5e9bec687579f282784cdfdefcb17e576c0c71b9c10c57d6c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c12cec9ae227b8a3a1cd675d2ff46218

SHA1
eb4635d52ca4e7c1c381523883b043062be2ecb4

SHA256
4ee0c0c3bbc4a24831a7547fd787c6ce593127c3f84ed12830f29fd10ee28116

SHA512
b000561e4a7f555f6ec252325995a3ad42c47b7690a340c55759743972393db3cade5b8eb18ceed8d53f55271ccc6091a0ba9b01af809830fd1b6fae5caf6a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d1c1c4ed21a3d37917d86efc0a717ce4

SHA1
e5819a11395a745544e2f2b20525ccd311e89e22

SHA256
f5393f4f3ecf4c48110dbaaaa14d9f12e5b6fd68656a2fbd46e71b099d2b8116

SHA512
93fcd4744b8901cef4deb7d6087bb092241d0f5e2c82fd52f34a70ddcb0ad6058d00cf23f8a9d2119809349fdb7f392f69e75fcf0afeba95bcbdd92ef96e10fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
01881a48d1ced16986ff0e2883a18a93

SHA1
ffc0fda0cf94cd8a5bdf9d7ead846b8537fe9fa2

SHA256
5cde5c843646941dcf0a75efda44998d858417bf1719a6f8f01aef90d6b09684

SHA512
d43759e6c1d70676ffad9a6b519d9cd4a57dcf4d7d6ff92870c623c64ceb756d7b84452be6c0313b0aad876f92ed6c85cd74a9a603214f5e4348f0791c7e15f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
a71ff49565178f115ab64b5369463a98

SHA1
112fca97efce8bc04158a8ac262c9d6c313ddaf3

SHA256
827026cef99eb97410b5b081cac25aaf99b27bdbe1513a9bb73e4584962f0244

SHA512
9629cd3afa521801daed7859c4b55e02d2f3099d33c053918ce51071801f04a2e51fe8e92a9042881a97c236fbf2fa8bb553cbbc368421b2e2d45b0b13fe4bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
e75c8f59c2103426dc27678d3d295303

SHA1
94dab5075685801e200d6937495e49944cf1488d

SHA256
9cbb0fec20362399404dd7d5b162668e775061d58176c56b10295cae27f11f2b

SHA512
5d7ed477f3ea03874133fe33fd8cff17e57415810bae78d499bcb0ff33b2552f28146f8f09cee15282d3142bf85be827b4412fc58d05a833309067fb136c51c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b427f7d8c88488f0bce256cde10f9346

SHA1
50ff8f3f9bc51e0729d850f6c02cfb8163743e9b

SHA256
e0813bf3ea999e14275d9b40f6793f01a5c68a774796a6ded76bd7aea143157f

SHA512
3c584efc37d50722f4fadd90622e4504f98dfe0b9033131b0f531aa3d997d56d1b259431f4631294011a769229d9dacedf2f98c989ec76f9d4fb03edddb24f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9ab.TMP

Filesize
371B

MD5
1018b278c4d6d7ff9b7957b8b9c78930

SHA1
fc482857218a3a28dccdc33a13f660bc2cb3da70

SHA256
e401e56d978598cd8c1965cdabfb4db32b6059df3cbc3a28cda5155b36b49c8f

SHA512
c030c26ec3cac80831dfffac43727800d8018c8e9122eb184d74437520dd32ecae553e7a7822ccabafa83f8de3c1a2d19e64ac04f71702e4d532198bf94333f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ccea395c730c0e9c74071b76475be01

SHA1
b185e234625b174098c4e5ae197e601369982256

SHA256
3c62c4d33eea17f23d7aef1e773584c4bdc2ba4cd4ccaa07ff67475fd1668300

SHA512
872518638035079b512ad904593237e213150e69b59be4a80c26acf07147913aa9c86315f38ed299f2c99d7f3a2d3f1b44229b2efb4ec735224c86f591c152b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit