1aa677b16d7c9d06cdb7a94f454f4616f6814a6d07ca91485ca3ce549e204a97

Resubmissions

12/03/2025, 19:52

250312-ylj6ma1wbt 10

12/03/2025, 19:49

250312-yjp9vssps6 3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xd.jpg
Size

142KB
MD5

11bae8eff2fe0776d74dc9bfac3780e1
SHA1

ae5a7ad8813d802a821687098696ca0768ca597f
SHA256

1aa677b16d7c9d06cdb7a94f454f4616f6814a6d07ca91485ca3ce549e204a97
SHA512

5543450f3fb52c88b86b15105d3ee8ce50dbcaf3b14ecfdffc666cbf0d933c02167d6d04933693f205368853027f7c1a0f013d4c1cb07f30da3c1fd1d11c1767
SSDEEP

3072:VMSgJeb5J5EsbRyaFX1VacpAqoOSr1zkhKmF/g6EYrmhXCsG1QC8:ySgE1J5EsbRyaFX17TrSr1zc/IysG1Q7

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page 1 IoCs

phishing google

flow	pid	Process
43	3332	msedge.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1776	mspaint.exe
1776	mspaint.exe
3332	msedge.exe
3332	msedge.exe
2296	msedge.exe
2296	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1776	mspaint.exe
1776	mspaint.exe
1776	mspaint.exe
1776	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 5016	2296	msedge.exe	99
PID 2296 wrote to memory of 5016	2296	msedge.exe	99
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 4468	2296	msedge.exe	100
PID 2296 wrote to memory of 3332	2296	msedge.exe	101
PID 2296 wrote to memory of 3332	2296	msedge.exe	101
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102
PID 2296 wrote to memory of 4324	2296	msedge.exe	102

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\xd.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9b14c46f8,0x7ff9b14c4708,0x7ff9b14c4718
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Detected google phishing page
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6845365517839942474,9106181409708786736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
530542a18a6a8ed6ee368e1ef7dc5b6c

SHA1
dbe2ed90dc289b52318ab71c4e1afd4761458a2b

SHA256
d82bae18f65b2d3bfba38ea5eaada2191503fb0d723b8788eb4f664ac553a718

SHA512
50d2ab00f22e942d3fc7293ba30dc7cb91bff5faf91c16b970d99f59865d5f1f7c58b4e886658779cb4b15bc21cc998d04d20fe3043cf5a2379f9a6befb37571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
e6bdbbafd0db1e54b799923805de6865

SHA1
0259693673f1bf6df5b4d22cbdc5f3766b49fadb

SHA256
24333b9966c121cc45c599066ac4ef5956d97ee7f42c6b36df0eda88a66312f2

SHA512
05f3944d17757a7b41c8e66d750074f92828e29a0ccf13c91d9a3678c6156f0cb7753a2837352a69ba9508768eac6d4e18c8b91df3aa863aa049b43fe102a949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
26KB

MD5
f153f1cf878f1f4c575dfad123e9fcab

SHA1
62c410a758362af100aa38f904ed535cc18cac45

SHA256
8ce415587ee999b478e27ca52904ca3427e6deb5fe4529efc674d149d1c08398

SHA512
940562fdeb512bbe643c72367634b4577617b5a62bed169a238d402da31c5d07af4392e12fbfb3304ad119f2fd4ffb2e2c29cd6731ff832edbd7d1c2d11c3e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
64KB

MD5
54c07aff64efbfa7cc409c2c39beee1f

SHA1
484508546a33fc90e6b97f6240601ecc135c362e

SHA256
49c44a97498af5cdc2abaa89ab61f43895326914e942068e4bcdd946627ea065

SHA512
39c0bbe4cddd7eb1b17c6690b580a650640a1aed61ab004092af6cc870286c13dbdd59df763b724b7b022d6d071a18f02cfa751710d38954eaa1eada5b9a1abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
17cbdd2297ba8132696489401bfa253a

SHA1
45bc16715fc4a8f89fa5c77e0d435580b1488360

SHA256
5bead4aeb82ea62db63aa0fed9cd0492793b38c13c5f8f225da1e9474269d0e7

SHA512
7a8e61e659fc60e5d627e9121b0180f7aec87ba2650c06b16703fe9261b1b25bb11e87ce61c86f6d2da6bfe82e475c84508a665601e80595e556117a36dbc312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2968b54fb58da57b5da27769a5ceaab3

SHA1
eb16217f5cf2d601d5357fd7c98f4bd11f4d6c08

SHA256
aeea68b23ea1e3b656016a5865445a434d3a1306372c2e7fb7e4aaa04198b694

SHA512
a914001c7c02ac9c325e4558a084bcaf8b20f1d60cfb7cd2792510051b5df62e507407532c52ad462efd48daadf7e08fc49d83d9a7e01670af153f890d0eec38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
04721c167ff05bb779b71efb55d264ac

SHA1
d6a828462076f13db3107bffe05eb81e15d463e3

SHA256
99415bc158c5fb8ed367d3ef63696bcd1fada35371c8cd2776bcb12cd8dcd8a8

SHA512
5f6d003fdee5bf6d218b9d43d7515cf1127009759293ea45d46bf046ba2251a4d2474314460a639a8552a38661b1102a2b18aa926c69c121d7144fa4526d3f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9fc70fe128e016b755b2c2a25674d92e

SHA1
d17d2285146f79531bc983622987f7ed3cdee75c

SHA256
ce934cd7a43ccdb1727f2ee3626954d536bb65cf1c4a3e693d4fcef37102e66a

SHA512
d24bfff73a70660b197f3b60a8c88caf72bb91234b8cd03a232d6d049d494cf2f2d4f7d588bdaee32edec83db8e45ced8a98c2b4085190a7f171deb8e8094108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9537132c79e863e04cba5b6f2b6115f5

SHA1
4cd3714e76d6076ccbbfc5a90e7587f6facffeb6

SHA256
78170d30f0f55e2285074da3e086f69ee3872716df704671e876226572f20966

SHA512
b337474a671b40ec61f19c7b4f491ec8cfba583d014949edd9b3e699df16f8c65b263c381bf61f2487f386ed5ea7f804c6b17becf2c7c0547493e804ee5a5ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30356fa050e71c64e7c24f1f145eff6b

SHA1
1699f3b0eb0b453b28190a716656c17461ca3a36

SHA256
0aa1f8641f7cf7f8df59aafd4427fae4f0ae7e414ad0014815eb05fea0c753af

SHA512
3ced2b2db310167870bec4cd85fe360c91653a23b1865ff761e34dd7db853dd3d8839940b626a24cf7bdb8436888b745284ac8e07caec0cf9c08275c18d6529c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3f20de300d525abb17e06642bd2874f

SHA1
2dd3c5b8408ffb5ef9f606404b6dcb23bb1c31bb

SHA256
525a7fe93fbf4a95328c09fea0e84044d94d49bf6b773441a215fcc36ae52938

SHA512
a576996229eb46abe8e17d8ade438ff570c675c4772f2ecfa8f5baec36acf3889e397258040d396f821a318282136cb199eb830d8751563905c872f4cc463d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7b706f81ccfddbd2defe1dae334468b0

SHA1
8eaee7ac615073c268177d2938f08c1d72c9dd92

SHA256
fc464dd3dfc999d09fa7bb9c66eecb61dd942e386382027383dd7c8cc71a0221

SHA512
7c3a0dd7258c8ae1516e7b3f469c61d53161ee3ae8a3e82050dc70b56be2875eac8e3411636baec9a4e2a9d5cff6a552117d946f39fd9fcea4ad682d6412d995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
697B

MD5
be9252f79a914955c3092e6d4193bd66

SHA1
61dafc660b4542f110258263b7d8b0b478f64bbc

SHA256
d970680b658ca75ac31bc2f0c656bd58ae40802ec1edd5ffdfefc397991ee939

SHA512
b45a2971b20118e5d11d78160d8c52d626097381d643db970369c99d6c73f16a52bf7046777b35d765147952329dd4f1c16b29f9880dc3f81533e3fbfbcce4dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
46caca59eb7f9226b8778a79ce22d209

SHA1
088a2b058deef7bc4e391433b48af6db666f7823

SHA256
c2b53e3e98ace574ce1157d658ce3677a3e22798e70a2d1ae09c01734474f118

SHA512
9079d3fc002903bb0e57d28a8959a4aba6ecdddfa30b74405ff8cd4ca995c4f97b9ffe0197bb8c41c572b4294451dd1afe8a1647e04daae2e588735423e46356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
25cae25787e9bfdf87dec6c522560015

SHA1
610332d5190f2a27b52ddc4385894c1f27f106ce

SHA256
e02e1d9297c684580bf1d36c88aa7722d0b5b4fb0dc6cd8a793c59b4e192b227

SHA512
31dac6010ebdc2ab22ed55c5d1937e5254554ae28399fcc49b08929082745008fe656ed7bdaf7a814b44518025b89f74323f81c9c20bc21c2ab9f21975ba43b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
9d35c30f2371a9c4c03b377bedba717c

SHA1
9d9e101f096348c51b1b20040c81c89f34710604

SHA256
115375dcbeec77b77881ac670a9203e0f15cd5ea2e3bfdbd3c6c119311f47bd0

SHA512
379f689b83e722d35e9956566fe72ff2670f8a231cc9f1ede935cac2dd77e40c26ca51caf182e3f615aa91ccddd0649f39e325c28d9f127510c2847188d27cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
7b805f1f5e91afca9b3afa907d8b96b9

SHA1
ed6ca136fa95acf4a6167b58e1621599cff70c92

SHA256
372bd137cf5a5b2516b021da8aacfb50fefeba1db620b362e12090e30f04058c

SHA512
f5e99ab41e3cd18c87fca6132a6fa3eab8827d0449fde8408b7d63f42b59754c11a7ef9c81433bc54e42cce879bb8f510482aa40047d1ce82badc6d315edda6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
d723effc35c49930481111802cdb8f4c

SHA1
ac77b91c69857245f72637b4690babb5dad71e66

SHA256
84ebc377687517bf8b0867ea99a7796d904fd0d12dd0f468f2127ff68363b895

SHA512
717f174d4cf2e0fa0300f5444fe286de80cf2ca60e825afc58f404a40c6cbeeaff0c79172082cd8e2763c693e4eb78d623daca9666fe58486d36edc69a1517e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587903.TMP

Filesize
705B

MD5
789cc894752d907113eddefd18a22a33

SHA1
e1e9ff0ff25d5ca7a1afa9f44c81fc1cf905092e

SHA256
f8fe8906059bec2bc0d6b9dcf947f65dc104594517e47909c164aca572ecb502

SHA512
5669dcd62d23cf74348f98c93b6c0324aab340b9e88089e08dddcc06feceebd4d4c43d93dd09a2f902a8c9ede1f8a05d37580fad8f152320245c8370dda72fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cf22907c4d5a583f6280e7500edf69b1

SHA1
0e8a7d05709ce6bcecd38df8d17bf78a6b1f34fb

SHA256
1520be44b89409d558547c06b8d79b067ef864d0fec97539cdd93576ead8da42

SHA512
2c43b11d2d18d4ee23727d1792e1e75ca170a2b10647a3de8ddcdb784f3d19b05911ae7a261d57d3c4fe07e3ef8e0282605f0aeaa890b8327c00a9211196d90d

Download Submit