5e58241e927085f20834805ccd9d972a5caec2f56d7d532e7a7c861c3559b1d2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jdfrf.py
Size

11KB
MD5

087eaaaf618aa866699883c2de14c693
SHA1

9708fdbc52e0220ca7e373189186c4cee519f5d9
SHA256

5e58241e927085f20834805ccd9d972a5caec2f56d7d532e7a7c861c3559b1d2
SHA512

4f32475e942a3c1f27b74e49c6185323b92880c949bdd72e09aa25c852a1a9c2a405fcfec01dfb481eb390b0959ff9c852cd7cd3fcea0d970635ed5e2c5282e4
SSDEEP

192:ZGw0KEa3xRH7mCfjxxnGe/ARlnim21DCE7KGxBD+FTnmpxbY/X:ZGrKEaBt7mWjxxGe/QlbSKGzD+FTmpxS

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page 1 IoCs

phishing google

flow	pid	Process
35	4140	msedge.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4492	msedge.exe
4492	msedge.exe
2604	identity_helper.exe
2604	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2996	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4116	4492	msedge.exe	95
PID 4492 wrote to memory of 4116	4492	msedge.exe	95
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 1684	4492	msedge.exe	96
PID 4492 wrote to memory of 4140	4492	msedge.exe	97
PID 4492 wrote to memory of 4140	4492	msedge.exe	97
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98
PID 4492 wrote to memory of 3192	4492	msedge.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jdfrf.py
1⤵
- Modifies registry class
PID:1988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ff9351946f8,0x7ff935194708,0x7ff935194718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Detected google phishing page
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12222706977852506439,283998797195500593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6cdd2d2aae57f38e1f6033a490d08b79

SHA1
a54cb1af38c825e74602b18fb1280371c8865871

SHA256
56e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff

SHA512
6cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2b08db3d95297f259f5aabbc4c36579

SHA1
f5160d14e7046d541aee0c51c310b671e199f634

SHA256
a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869

SHA512
3256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f32f2fc-43a1-48eb-88be-4ba702815f5e.tmp

Filesize
873B

MD5
8fd2aac9c4b6fc5c740102b07e8c1abe

SHA1
654ee7f72b45585f496c4c2aaa1f1f9af5dacd7d

SHA256
7de94e729b12607b52904846373ea3342748952e7b66ac29aab8a5ef0ec11053

SHA512
3eb01b2bb52093b52bb76c9c0ab47b94e72e794e0114488e59e17c65b6e4a8807f72dbf442227c77ffb2a0e91c726fcb515967283b7f44984665d39bd8c9c6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
23KB

MD5
8edf0d977ec3a56d97032b3ec1e7feec

SHA1
b111e23107d654bf3aa347a4702fcf295aa0e24a

SHA256
aa1a1c2b0de673cb215551c48054ea32c549dd2e0b09c2d39dd074d1dd55a69c

SHA512
6205ad90bbb1c4e24a7c5b1d68b3f3a55aafb7eb9d13ca24991334d8f278b55f8cea18e2dbfb84e163027413121aac3fe02c370ce54255ec4f865f8b576aa4ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
48KB

MD5
e6bdbbafd0db1e54b799923805de6865

SHA1
0259693673f1bf6df5b4d22cbdc5f3766b49fadb

SHA256
24333b9966c121cc45c599066ac4ef5956d97ee7f42c6b36df0eda88a66312f2

SHA512
05f3944d17757a7b41c8e66d750074f92828e29a0ccf13c91d9a3678c6156f0cb7753a2837352a69ba9508768eac6d4e18c8b91df3aa863aa049b43fe102a949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
26KB

MD5
f153f1cf878f1f4c575dfad123e9fcab

SHA1
62c410a758362af100aa38f904ed535cc18cac45

SHA256
8ce415587ee999b478e27ca52904ca3427e6deb5fe4529efc674d149d1c08398

SHA512
940562fdeb512bbe643c72367634b4577617b5a62bed169a238d402da31c5d07af4392e12fbfb3304ad119f2fd4ffb2e2c29cd6731ff832edbd7d1c2d11c3e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
599923a5222afdd2da8e3f709ad93610

SHA1
2fdee1c88bd29f60f55f9b4a5331bc51752cce91

SHA256
03e0660c72e474092e249ba5bf66b064bbeb8d827b689f20af2bf65e79fa9434

SHA512
7d2c2125b79b91a3371eafe52ef7eb0929d9136f2a48ebe49e0e78bf02b3111bddeeaf6f958cf8c8b4bb89a5faa60bb55f2a0c280ea35d91d4961a824b3a9a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4b92aee1abf55e672a077c1625ccea88

SHA1
b49da7232187ef5520276a451b67ccb41557c8c5

SHA256
8dcf1a0527a8321f4a90cf84f93a0cd49f667fccf4677cec7a6093a10bf003c6

SHA512
06e90e65f5615434f092b7944617299d9632bbf4ddb8d65e0c5358d10e44017cde0c0bdea884e0db2cf093cd9479bdb99a6218696b8c7c3a1d829be8dbecccc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a9e988eef65878f326c033a119dd1e14

SHA1
fac1299fc40d6567b6ecf1a75471c38e48b964c4

SHA256
649d06f18db5ade9c1b5f5fcf3b0fb4f5f8973bfdac17375f5df9e25955ce7b1

SHA512
88facdf431e1274e4eaaaadc3fcb572db6c85dae0cb7984934e213338df58010ab6654f27f5a435c9b415bcee545272b401c648c9a439f97861b4d77e5250eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c5d8cc1670a54a893bc4c8dc7e71673

SHA1
a06e6b507245ac973f8b461cbb5ae485b19a158d

SHA256
f3b876c1d2cc1f9990be75a607ded07c5801095d224a4fd6c7821af0fbef20d0

SHA512
7c699727bea11eb347114992bb7f8ff1e11b6665e12917aabcbbef58673ff2df9bbcc548f52faeb0d0865a3ae6e2d9de79fccac22b7c138861ea2953e991acdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d79fb5436e8c91833e12e1b7dc0140f9

SHA1
09c9e2775ce92e1e8a273182dba1727ced21c700

SHA256
ecb9579b3bf3dac28e6348d589fe2deed9e1aed63664d8843b437b78cf87d191

SHA512
37c126afe5e59eca3bd96211fe029a697eb72966520d2023c533c73e34a260a49816e1e05f26957365bb3e7f313032884bc84af8f99c7ddab85bc34f957ea160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
436898782887c1c61a9ba895789d459e

SHA1
5c34f9c8a5f5b16f5aaf665f8ba75d9566ccfacb

SHA256
ee0ce1115bba7ca36cc2c1adebd86f95799b1d07b1d88ca6890cea76e11324ef

SHA512
9343eea757ee725580515a25f093d4b465cf799c360476151c9c8abb4d363497a4d68c13e090bfbdac3f4460a8b55e1f1141871b0e5633c2d499ef762b40d6cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2723ee0ea6e3b71f1f60a8e78a2a8f81

SHA1
44f0808db68a9f8103681793725c1b332d4be177

SHA256
7738ae8137d88314a8da65f52698534c4c4e6261301762b5753a844bb0b67a55

SHA512
c92b50587c0b24116d06cc9dcd8551bd37ce0dfb15d98236753acbab0c987aedad30cfe970ebd4b0964a07846fcb0118937210ccaf01c1a464892fc36c20d2f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da5e80fe9916e7109f0813cb1d2cd852

SHA1
9cb022ef78e73110a63c7c3dd65a0bd1ad1cf261

SHA256
b858fe4c762010984faa0e5747ad22a6b9a88fb5d5f7f40686782645ee617bcb

SHA512
56bc608d377ce829d7e9e464270d4c284bc42ababb3f8678e5a082399f0af4b0caf02a06bfa1d6ec8d0fffc0e978e5f82b5d133e31909bea9950f1e2b0f6ade2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f36b5664958ec71f07952c9ebbf54f50

SHA1
173f7fe1a9de7f8b194dd92cecf4d5b5119d280f

SHA256
b91f81f647c8e5b57285db09c6df89383eabf68f6fec079e21d3751a4c16b496

SHA512
9845431d0a1bfe8eee2d283c6839edd84c55df649b9ed3acaa6a7ad7db67977a820de3972f70ced421d8aa27cb5e6c4a3515fd0108f563c4dfd77a288763c6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5e6d87dae62c60a98f2a539948743d88

SHA1
9d1f983cc7128eb8fa68de7fccbc7deac8659c1d

SHA256
4cfe27c6c667e8eb16639da37c460e5f765efa0cc798e861c6f1ff3cd8325f43

SHA512
e50cf0e3de1d9510878ff685c32fc7a6277f0dc716f74b38d20d42f1e56fc63a9f8b147d2b1edd1cac717b46eab93d0a2d3f6960ebfbc9e7817cee6ac856696b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5665008819b731964962322d6c5c39fb

SHA1
82a2334a89d7a6caaedef2ff8e40dae2e52bc53e

SHA256
1e1629240e72a330c1e60bb271379222b9a716e99d8d55a9776fa03bfc8c1db5

SHA512
45518b865dc38e306101d35902b241b96ea60ddc0830ffe616f7005989acef1f8b5b42b72189416cdc9474715abd3be3919bc6abe254618a3d4be7dbe5f6afd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
74cdb0ad7eb3eda89f443f4341a27f45

SHA1
1407b3ae3b95b9fd40ef025223bf12824e03a3fd

SHA256
2e3ed8f4131f07d20cf99fcc002bd78c1e92bbac80a1a87b54fd820e5d6319f0

SHA512
60966b0df9d06f8fee8977740fa2e55ba08fac24693ba37ea29da40144ea7b2a0b99387e19325aa5e46da561f353f9f8c845c12f89f9c38033b7fd388d4d9df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
174ddbbb468d18b598ced177b8048cf2

SHA1
00a6559284a2ae819d3a399db00f5d08ac1e1529

SHA256
30f67ed51d33d333903af165e579a00ff926658be374b507cd14d67f95bfb55d

SHA512
392be708d63d62fb3d2485b5a5f0af1bfff98736526ac9829c47e44066f25a7e00538e44c11617c0c7269ffbeb0fb0b70f4d198c4b9f8ab30012a7d0a73cf757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
eef4b17788a618b6af70d7ec6c32c011

SHA1
9590a198cde69f490fabf7e7963116c5849459d3

SHA256
3aab74a0f3e1304aa96a08b84842fa01d6ae84be37ab2f97f9ba5c3c2be330ba

SHA512
663a61f49135e2cf4dd35a04c08bd7fa1d93668b4fd8b958a858ac5244856131ecad9eb79fdcf7184e104b6cf08424f6584ceff411904f340f517725634a3e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
6f2191fdf7547263821953ba42994e54

SHA1
dadc4e0f1d9c317bfd4123e4574518655d6cff20

SHA256
9832b16cbc4d71f1e175395cf4040abed5daf10342b7931f736f3ca39c0a29af

SHA512
ea1ad08670478021f4e8b7780f7805495956bad11e7b0c6062ac6f06057cfb4e4c27cfc1e6e46cb4f24fdb6a787ea2c6e0effd74c4aaf15b20bddea07454d174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
b60d679633fbd790aac6af8c8de790bb

SHA1
3ac52705084dfc2dffa015877e9b74fdb36aba4d

SHA256
1287840f63e96bfcd6341cec89add3ab47b4edbce8a2edb0634ff25d21f5fe5a

SHA512
b535351a1e4f80d6d64aa45a24cc9ea2c74073c7d50caa6fecd00864b947665211a6452d78ee10733e81916ef5a6148a80ca89369fc226bf38fbe7060dfcedbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b12.TMP

Filesize
537B

MD5
4f8482170d856f3a4af72fea0c548aaf

SHA1
aaf29acd89bcdd6bbb8b6e5705b4792f2690ecdb

SHA256
190806d839193f4ca6820867e136a2a14d59c4479c681e8e5add4b882ef9e456

SHA512
ea7bcd857366fbaf57c23bdc4ceddb162fcb08e26a128905aff9836a47ac76eca6a43e9f15ff7d15e556f00ec251891d85a08f997cd468808807466cb78fde83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cdcc15e3f8e5963e062f68e871aeaa19

SHA1
6dabb9a63083fe4ad98acb81466a6ffa091afced

SHA256
a93f65e9ca1ec1527e4f2f94f24bb75d034ce5312119c3ef760b42a0ebfe76f4

SHA512
41798569c2ebbbe65d45763a17fc4494b0472c5e7ddb30da32a041da62c438c2a0400e0fc1e6dcdc08f518053e0cc2af83feb498d1182842a22175b38a59a800

Download Submit