hxxps://1drv[.]ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
257	3760	msedge.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4292_308525756\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4292_308525756\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4292_308525756\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4292_308525756\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4292_308525756\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133872871233489339"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{E0080B84-7B26-4B91-8D74-AA33A244F3E8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4872	4292	msedge.exe	86
PID 4292 wrote to memory of 4872	4292	msedge.exe	86
PID 4292 wrote to memory of 3760	4292	msedge.exe	87
PID 4292 wrote to memory of 3760	4292	msedge.exe	87
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 692	4292	msedge.exe	88
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89
PID 4292 wrote to memory of 5600	4292	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2bc,0x7ff92e23f208,0x7ff92e23f214,0x7ff92e23f220
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4328,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5696,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5576,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6344,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6592,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6584,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6244,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2808,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6920,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5340,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7136,i,10158400952069978591,10051159406275336389,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c070ed94324fdd1a6d58d124c3cc402c

SHA1
08beb2fd6c524c2181d6c8c5de826bf5cd8e8666

SHA256
33aa1e827cf9f769438597aa30bf0218faaa7499933aa5ae83c0fa894b14bb72

SHA512
d2a26f33e71613559e2dbef6ac0cde343fdd4a65315039792ca05beaf854faa31ea9772ba84360100c08fa3c1c33133b7fa8735203dc8b4c668e86d9c66955e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
47d1483d337f5d022f42045eeed34353

SHA1
4db20fbeb29e97e5139aa26a5329f00de089a1fc

SHA256
75eb6c30d500daef8ec5ccf9696983724fbf106b7a67e3da49236cb0622d0ceb

SHA512
af3ef56a4b2c54c7c2b6412742ca09cded71997d9a486d3976eb65f84fe4be035cefe086464dff39fcacfcf5a21814f7597b6bfab06495dcda4f30b9a5522480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fcbf.TMP

Filesize
3KB

MD5
648f2ca3c073d7a1fbca96b7d4d2c889

SHA1
98f53c4b6266927cc0d577a4d763efb17c2ca4dc

SHA256
830c0cd243b67d4e5d1ace01d2577dc4c5ed906fbcc161cb7a5ad6e8f1ed24cc

SHA512
bd24f42947fee0231d217d8f1501da46947b87a08273ccc0ccb126d025015281004d58f31959ce2e19ddd299e930a0ea5be729c93bb8580c06ebfd2561e2ede7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
3da9d14626beefc56dffd764806f2f36

SHA1
1ee0161135d27b4487a7ddd353393128e3d3f309

SHA256
c5e58cafaf25b10dcac26f6ab608e9eadef3a144b492db0b3da3f908c6cafe08

SHA512
c5b352f7465bc0499b84cf231de7aff5c1476d85aebd938edc8f0c0c47ce6cd7345548670a4c553f6dc2268650aba2d9f84f0b357ca13abc170bbda63233eea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
5415372535409205c43a9179bfd8e76c

SHA1
52837611a8721f14e6f1368a912cde96f60afd50

SHA256
6af63f822c093ab54ed2b0b6c7e3953b98955f7a6717889779ca66585155d326

SHA512
c11acd8674a2d685a1dc3e37f7ccff480028c8cf5541aad15359d53744b936b41e0259d6934e9d35d55662bed13b4532f59c20cd3a6bf7a0097d11a1d9ab3b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9b05694eef965a912f630e264a1787a6

SHA1
0904c52384a7df3853409e227d1861e762d11020

SHA256
63ddfc861cc85e713ef0bab7a1a9a72c6d65006dd9ae52ac2d4cc4c570c91811

SHA512
32b9e2fc460195653b28b75ea64fc5d21ebac801f28a339bbc41d3f141fbb507a6fa22f721878f37093679536dcf7e6d8c9b176a9054297e3fc7a6d381d3b48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
9e5c764ed60fef258f6f1e6e10b7fded

SHA1
d53e02588366edd76da49d6262cd40195ef75005

SHA256
db79f31fb913e48631d8d1c14e7a8ae94d7c33ed1999c6e1714ed6ab6f0d44eb

SHA512
42de40708153c2ed8247f7977eabbfdf306fca9cc7f1954b6564d4a8d029696488590cfc33b8c996aff5a4c2dbb2ef956b755bdb76927d93f724e260857128c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
67a91d75a7ead404942be9c2f443c38a

SHA1
26d843700e815c7d189b5e11720b8ca985acbd55

SHA256
8b2b50e7b1fa0c2b30cca57ba4fc7e885eb5e793e728c5f560b03a1bb91d2a8a

SHA512
fbd43874bed5f55c41f52099f9a35f39627a673dc96bfb278c0f38834918b87955716cbe71b953ca4fde4cfcd035ff095ae2d1ac56cd259e17dabbe74ee67362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9536810-6983-4835-898c-8beb3a0572a6.tmp

Filesize
16KB

MD5
a061b175f22bc83d330899022f120c8d

SHA1
2e3f11ae39c37c7da1770564a7e291444eec4e95

SHA256
d97c74ac7fbd1b67864f71ac9d0ca11a251bca01280677545a9dc083b4adbda2

SHA512
1f8270b44452924cb499ee87346a53117f1ff71febf967f493259be6a06a3879727c2ba71e5c263cbbb1849e5da239bf1b9b97ff567e2d4d472b863082e9aa5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
0a5e2b1853cf74b868238f4b919d2fb4

SHA1
518644bf5ba6d8978264845c235b1201f78f25a6

SHA256
59f53dde1c3a69bc6578882f5500435bfcb8a567bba45720a71a026a0585e772

SHA512
f0b6a8de5ef4d360510325df3dd062850e6d9679aa0e72ba8765b44635e86d52f70a4b680ac9119fb8d3ccfa6ba4277c1f687925dff323df041fec23b217d97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
c258515c0e6ba4347a0e03cdacd727ed

SHA1
439bd438e25873807f8063e6682ca8c4db4bbab5

SHA256
7ef7c864d238265a05f52ed945a1191a00a11c7f4b79c72939e87dcb6103832d

SHA512
cc79bcc5737b963ec016eb603f849fa44b9459d3af135cc8be832024a3ec25f52d8adc523dc6198cb4d0f8823dc882d9382742bba33e48314f12e3fcfdffa795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
2cc93242de8f43ca175f3a1526bbb53d

SHA1
3a609bb4ff32606bc6d780d48601798e7563db8c

SHA256
2189dc5bece87811ab9febcb50c51ba71cafe4e40c4ca501540a1dfd456ebbf9

SHA512
fb3d1e565df6a738747e974ca9040f256dc13e42ad2cafd74bd9bf6eb2fe9b2bb0a5c1263037d416a35eec28961e6a7f5c2117e14ba64ffbe71be3baa9634dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
cc8402a30a9958d7f891aa0cbf3c864a

SHA1
967a2f001444ae471f899484265ff67600150e24

SHA256
d1c2e198c1e929a0d25f6f4bb8e107f2037bbe5c27a85524b07e512467f46383

SHA512
f022ede089c7cde4ab7296d23034735b34634f305c2803926ba80b29811b6dbf50c32d24fc8bdcc0ef5858819182ef3075e73477249962d7e6b8b3ce59028f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b6a501b8c34fc10bba380ca0bc0461b8

SHA1
006dd20e8ead01c543e2d102004f360ee8d37c6f

SHA256
34b072c91e480bb092457b0f35b2c1770ed51ea0ef3adb0ae0015c9a0cf51b6b

SHA512
6ad4eb53ec6584566c542993ffe85c281b22b7bc6b7ba1815ad0843ff165033920261c84b641015f98dad5d092000b055d852d1c0788a705c7beaf5d56bcf24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
afd6a9cbbd2c69b869a02f0e82bc2359

SHA1
d837788a2bebeeb73394588f98a6e2f17590a989

SHA256
b95c7ec714036f76e903c7753904df3828836f2f6d2086f05a9aee1dbf903e15

SHA512
9777f7bcc742556bc9ddda01391672712487034f3faaa6df2e22e946a4e1a31f833e4730ea6184d24fdd32d78d1b8dbe8aa6b22780432a9180dd8a3724e06240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5b5ce518c6eff2090a642d79f0deb95a

SHA1
be9322a5421b9f4a92165fa24b681b2c17ed09ec

SHA256
b1ad869553cd6f13f9c45a55e1f9ec90556cbe414f5cbe55423410a562258930

SHA512
4e0cdce5fe313695fd0ec19309b5e34b9837848e9aaa8bb5148ba27cc21b00e13a97169dbfdc0c250e9f300950606bb5024cd4268b905bcac9337edeaf11501f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588c2e.TMP

Filesize
392B

MD5
fa88a7ae26094cd164f207bc99e66eb1

SHA1
1ad7fda2433f0799846354507f1e143f0c6b08fd

SHA256
d197563c265b9c8f7dc9e5eaa854d2f2ff0feb2cb1350f7a449311df721998ec

SHA512
adfd727cfc1cb311c5e13c4b88f26a55274bed4169c59a723205f3d482bb0a5bea8103debca600a7effd0d53be8cc90d82dd35121e0b35037b0cd53357620714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5992563-d020-450e-95ca-3951cc05aef0.tmp

Filesize
49KB

MD5
d406a9e5485295710b1a77502f581f60

SHA1
25b9769efb4203ba43715dabf9f23c0c26a5e8a9

SHA256
befb2e6ab6011932da93ec5d113ab6ef69ac82c0eeb918997af9f25537d6b7e5

SHA512
75807a19b7576e67b28ea63a64e35a669862e0552ef2ed6adcade10771920d0358d19457caba49d3088acde48d898ce2627dc0f15c7b704db066d25b214d551a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ad20a7872d3489fd03805c2025680d78

SHA1
f2763d2ebe393a826b55a91e2e27037a6bdf119a

SHA256
2c5e6a6edc6540629fc2168cb3aaee2f9ab4c99e2c0e3cbf159aa19c3d09034a

SHA512
52b6d3df9ab3c1c71104c3290e01e7e69fd9ddd6ca916b94ed77e721e9df98438dfe78bff706a47a8868b929b50853a46bc7589c3afa1902fe998c025df1ed51

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads