hxxps://s[.]id/6wauz

Analysis

max time kernel
53s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s.id/6wauz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869803726947341"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{F768DABB-DC46-4B0F-909B-4DD9E1C9596F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3336	3400	msedge.exe	86
PID 3400 wrote to memory of 3336	3400	msedge.exe	86
PID 3400 wrote to memory of 2644	3400	msedge.exe	87
PID 3400 wrote to memory of 2644	3400	msedge.exe	87
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 1292	3400	msedge.exe	88
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89
PID 3400 wrote to memory of 3020	3400	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://s.id/6wauz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb14a3f208,0x7ffb14a3f214,0x7ffb14a3f220
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2108,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2604,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3460,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3440,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5364,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5504,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6064,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6320,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5448,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6868,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6752,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7196,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7136,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7588,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7716,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6888,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7140,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7172,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7028,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7804,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=2072,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7632,i,14696569283139201846,6291427522155873577,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed

Filesize
105KB

MD5
da7fcae4308766368611b35916374158

SHA1
05a209260fd46aa423fc8dc987f4b1730efd82af

SHA256
6caaf6eb26118dd3e9fec44d6c8aa9158817d6599a15dc4d8329aac4bc9dad19

SHA512
c4d3c326b530f2f8fbc2367fadd36a3960435c7b00113a211cd001f3d9f4ac08fc58e8f26063869c37f425abcc8a7e68343ed9b96a90471aaf72658555173b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
0ecea636d9888db13c3b6a2eb20e7509

SHA1
714c4e18119a1aadec913a8c2c71076a5d24afbb

SHA256
25e12e0b96d44afceb8084a568959865cd96e3365514f70a073ded7bd1e3f747

SHA512
e6732a1cfcf312791899357a9aeb5de909471ecb1d190b38fded310827159092c8c1df579618cdac8b72d4d9d43c2daf06a5f355ab41843ed5e8cc3b4c099f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
55b8b41db6b582ae4f6c02c742a197cb

SHA1
ff6ac4492cc20588034974124953b29ddd9a7254

SHA256
f668c304424876cba5efd26dab835e07783814f39294813af2e33751938e04b5

SHA512
87a80de44581f0156537c1565a9e1ceeac50da0f09e3ed6ae23e33b3c7c296c3a8d037404d4f814e9a67832434344c6bf0caaee546ed77956f5f06be43f9f1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6f5fa3a096cc299462ae28222ca61cbb

SHA1
807be53689b5f2fef6a00c63b4d5ae0e280aba65

SHA256
1ca1d81b3451b6a5255ebc3952a57de9eccf4ee8fd412e498b9ae5a3d5571a1c

SHA512
fb4698cced14209aba5d48172e601900bc6140ec3d5c39124a22de81b9797770eba87ec178bd553349b7fc8abbeb6b58308239bd4d45dd52a024e8b6db25ed2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
4f277cd0a3c870555c6cb7cd813c8ee2

SHA1
8522776719935fd17918c3f12869facc4b3f84da

SHA256
883d967f013f44454dabce206018e1cb8b7ee5173cc54ec4b201d893065ff761

SHA512
8431ec0f47e1793cad9fbd0879a1758b8d41dcccccb5e062eca9a54035353cc4a18711977d60f4957abe07fa834e0a12a7787211724131bf41c75087900b4f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b23d876-3b29-4552-b5ee-c094dacbfe2e\index-dir\the-real-index

Filesize
2KB

MD5
8200e18182029027645c879efc6f0f1e

SHA1
56ff05b6f6bc149ecf84c1208b994e02841cb248

SHA256
2a692e412f78f8ec8a3b2fcb161aebb73fb9451041245993c1bad2231da85e15

SHA512
fd4b1be624664b9e027fc3977f93bc98f3c2b31ab641261571195b963142dcd0cad985033ef1dea1aa6a660e320370463247305616641ee14580bbc33477276b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b23d876-3b29-4552-b5ee-c094dacbfe2e\index-dir\the-real-index

Filesize
1KB

MD5
5d3f45e0610b8792978b4fc821519425

SHA1
133ba33106f0d70442e99006adaf9efdb3c96a06

SHA256
32d924c0b9c5c6e5d9ab5f1facb7b8ca1d9fe736e3734fd59e0520cedccf5e31

SHA512
cd6c5edcd271eaa5642b414aa571904f9619919acd30d0ebda0d5de9f9ba5b8a0b43c76f603f62efe6a192474714d49c5279ee0bddec3fb1179f59363801a0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b23d876-3b29-4552-b5ee-c094dacbfe2e\index-dir\the-real-index~RFe57c1c9.TMP

Filesize
1KB

MD5
b98ef2958418d6a704b8c6472cefb3a7

SHA1
073bc2ff34794b111a9d9f1f8dfcdca5bf7481cd

SHA256
ddd1288ce36d948005048f9e24d82d9b6dab94be8bed09f7c4c9d2be4172b424

SHA512
121f7ac4b7043dd0a228627295ce326af36a16966254b7cf05ac9c5d8b742c364f9cc50391a83422a49c50b5b69ecdeeebd8e93df4b94456d59da97e408ff8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\509375a3-c058-458c-86e8-dc2911f03d11\index-dir\the-real-index

Filesize
72B

MD5
235fef32497a7353067161018041efd1

SHA1
f108adebddda6354e8ac7866577dd9b66372e3c5

SHA256
9798c17119b96d11d0671072fe67b6a1dd2918b4cb2800c95d868acaf6b37885

SHA512
fa4a9b69de175a018b3804c0fa470df9fbd6581d9031c56fd7e8edb8569333f9eccd5b97733776112ec251d5f4f511a51633211230964e95d087e6c13b16dd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\509375a3-c058-458c-86e8-dc2911f03d11\index-dir\the-real-index

Filesize
72B

MD5
a5da519830b489d1d7a9e1e753328d09

SHA1
cb7d46e2b3bfc13e699462f36f589244981752ac

SHA256
8831f7db22d6a31784663d25a9958eeb8a9b0275dda29c45996b0f67d6c3eea8

SHA512
248c5ad333271829a60996d8686a3be6296c13c8ea7599c2ca8b0318248277d361431e40811ce31f0f091608cd736f8c193fc279738da65824d158ccc9e8d62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
6f065b889b319ca1f23ac0ea1ee3aee2

SHA1
20c11053445d49fea967625f194ecec61a19ea1d

SHA256
39174f5f10eb107a67166ef845588241fd3ace935708fb5caed0e8cc4a50dd50

SHA512
b5562ba83320347f1fdbb693b7d4026c5ef191bc6f9d617a06b095a4a357b71caa83068fe0daaffe0388997a0321458f495f3216170c7f7a2780cd62863015f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
4c98b5af2760f2d0eefb7d64549730ea

SHA1
2706dd0456c2dcf91015b45025d858aeefd0d019

SHA256
03b4fee03475523994a389b0e61400f57763c22efec8338fe85920ab46d3283b

SHA512
6a31552118712c13946b42c3512fe6b3d86cb649d5d68a5c1a2ac098e42c8ebfb211e5bf024709e0a22b70c11e8556b9349d515361367de3df09f38b5e80d5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
db02eceba6baf2396eb62a1fb2c54c17

SHA1
9a2fc95db116396c53fbe71aa9a0b143be02cccc

SHA256
04d78a553c8a4cf2867f221e5a187308159ea699926d595e973a0e4bb091f8a3

SHA512
1ae5b660d53485362f3e4133f10bfdee45b74985439f2c1c3c8bf0e22a730883b2b1123c796c3c6b583694344c49e9e891a68f45de3b3955512ee0cbc8c2cbda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581846.TMP

Filesize
72B

MD5
3131a332e583ac8a6ff984cce000c9e0

SHA1
ada3ec9e4d4855ad560cf694d8765895acabdb95

SHA256
addde6498c1bb68408d05f49cad745b30479d2a63760870b6397f79f973909d3

SHA512
db95d7aa62a69ab44c195f861ed74e5f720199ee7654fc92bdcaa9dca3f4f5530ef41dab23307123bd69eb573854c1f343ac088dea6292d5c7f932ec065f7125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6fd202a90263dd2d23055740af1200db

SHA1
911f5f0764157abc5cf184190245ddc1f922b679

SHA256
778793fdb6a2b0a386bfeddae032f8b5f166274163e459c2d1dd03da00c0ce0b

SHA512
636d1adfbc8c3397763c6f6f29262b9784d23101963fef3cafe8eaffa072927607ff2f6890a0a2dc8aaff08869881753c4b3b50cbe121c12ba253ed115a08bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b8ed5de0a3a54948d2a6cde853cb5ae9

SHA1
63912b46727cd2c4c54bcf0c01e1becf2e5eeb60

SHA256
d4c10a61ebdf2f5fce5c078060c7670e27daa64bd5f27d957d7b7c8e073786b0

SHA512
32281ef75ffddcc59e21be44fbf4d985f4ef58f36cb8a9a3b368a3c3efe9410a40537ca0da934c0d1618ccaf58a7d199cd3def25bfa421e07c32d10718a4a870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
aa4f08a9b5e78d17968b99860cc243cf

SHA1
e049c86baea2e828a63b9a4c94d30e9d62ec6f0f

SHA256
9d166b84287a9360e379e29a0496e8b7b4bf784586c55dae3c1092036ba2b83e

SHA512
cb0c1854dbec54de7c3fcba4a8e1f12bee2ea4546e9e88a985bba61725ade81e1b2e5d69ee9232afb0956033734ba2c0b2793170584c6b6ab862265c294ab622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
8e9eb16337be5724a69b2f90180c6768

SHA1
f682b1a1244515d4d308d922517bad81075ab597

SHA256
100523818adcaff6abac52a84b3ea2ffb2608d4c79039980e364e72dbac44b69

SHA512
324a00fde6069c246b464d98cc9d6128cb660f67384b8c4127166906fea262808f314674dad09ac82cb0e05bd07bcec8a9b8c28a426e4a73588aa1b6a4ed1d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
998b9e97e97edf15ae76b10592248e47

SHA1
bbe80da08b24d32513528360dcb873ecd9d22d8f

SHA256
62042e7660d2589e022ce2b5293e3248615b3b602726282787a131ab6ccd9aae

SHA512
2cf86d149bcce3808355e5ec55c9095e34cfd466a5b38d51ed2f09f314c44d0191dec8c931949852e8a1b260cc5bcc3d9669962b5d95ec875385ca40c5b906b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57edfa.TMP

Filesize
392B

MD5
25cc407dc14b06c1e12a77e8c4d7d318

SHA1
0bf9a061535898045477b34e6ea30f35641bcccf

SHA256
b9cf5e90d199bf231c9daa124245436daeb5962ba9540d5a3bb3288f6e208e0c

SHA512
8f6b64c0a1c99ea1e1f5e06f4f95cee8620267857c9ddd3d8e989bd32b626922b7691bc5928915571beaf35cab7f4c3419589d025f5b371c955021626d85f35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
682479b5fd3025057600f94788e85dbc

SHA1
6698ce3ccefa9947dfedc47e9884567821e51461

SHA256
598a89a63cf0969ec780ceafa5530032de526e4af46250b4b04b93c9dcd3d4d3

SHA512
3c52b8b6832897728e06e3dba7b301daa2e725b68b15e7c32efbe0a6903a1f3d48fb2370f92ba097ed2d39f6a8fb05fd58535bd67f5f9874eea757da67888abb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads