hxxps://1drv[.]ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Resubmissions

24/03/2025, 11:38

250324-nrzhdsyydt 5

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
242	4528	msedge.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133872899236388387"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{45952AA9-AA18-4651-BA39-B8E52672945E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3252	1164	msedge.exe	87
PID 1164 wrote to memory of 3252	1164	msedge.exe	87
PID 1164 wrote to memory of 4528	1164	msedge.exe	90
PID 1164 wrote to memory of 4528	1164	msedge.exe	90
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 6012	1164	msedge.exe	91
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92
PID 1164 wrote to memory of 4480	1164	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b8,0x7ffa0301f208,0x7ffa0301f214,0x7ffa0301f220
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1728,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3740,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:2
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2348,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3092,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3108,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4788,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5076,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5932,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6080,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5208,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6736,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=7164,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6104,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=764,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5436,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,17272319214730301494,17974621258898928789,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1164_1559820018\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1164_278563300\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1164_922737410\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
776518c233fd35bd84933288887ed71e

SHA1
816b51f255054c65756b2b4e1281fa29548a517b

SHA256
a059b881458002565030b599b01f2bb8b1c9a20f53c28f66e8912fc52d4ccc78

SHA512
16db98adf79bac25b526db17c45664dcb56a839108d2cc0a0c19f344371fd7fa4bf0984defd37684e385623c4af97871a1bf93455882a3c6ed0b1a16d077a282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a37e.TMP

Filesize
3KB

MD5
5e991ce1dac785e7eda036987318a225

SHA1
51e14c3b8f887014d8ccaf704b6468d1adea9f17

SHA256
9a3077b27ca8294818433425d32470bebb4825d662843440622588ddaac60edc

SHA512
0910a170050206e7bf5b260d7eb88da7e785de25a8516760f637e8978bbb7de8bd1df064d38338520f4456148674d86ee4fd370aaed7dda042adb66c5a66c9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
34f707480613e42e0a2f566b11827921

SHA1
d52ae7fe02f499a426984384115306f50ef499c6

SHA256
ac8b0b2a675d82e54fe65ebaadb1a08b224c5310d30a28ce1c552e4a629d15b2

SHA512
c622ac1ba454ea1d24daa114b511f3c113c93c893b2b04dfb6680bf3d03bc3ae1254c2d53086e31ff3e5c86054173279a23c1283a3d1b8882dea338237d2f669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
608b57071c861b33c1437f7146fe9825

SHA1
2ead209ffb9a8f88b8cf8123a467fd59b1c387d3

SHA256
660f38df88a3d8d8f8ebca631134a0569a765d47f7b9ff176ca712a78be2483c

SHA512
e59c7a22238bd3fdbb20df6df4306b1e055375373e4e00af3491d0394b93bccd690a7449ee571ae5cf2009dd4506f8bf135a80727b8e19a7854d847b8ec984c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4c60b92bec305b2d7d559826c55be175

SHA1
499bf86430b6210a505b4b5756ad5697a69041ec

SHA256
156e812cd31ca867d66ec9a9ae41f8554bc6c80e314f3931b52a8ea969cb7d67

SHA512
b5199948ebf7106fc4992273f5f5ed5f4fb0bb8b8801efd6c4e2e670ab762dd9f16a1d0b7d1766b7dab4eb20bc013a524de246a1940808df865a9d8ee2d56458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
21b3e02d5e7b70c924570afd8f7c8946

SHA1
9fda63b7434fa4725e70bd75a1256833ee8a88cb

SHA256
f58c52b4e38c7ae1c794503f20636eb972ddeef4e858e014f344755c76c9122e

SHA512
14275cc898d8d88c8181a5598b5b5857eb9a985a2044dda38ddb1ff634075923bc916be7cc1592b35bd065ce5f93449c985c73c97e0aa0648e63c88c3f3dbb34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2c146d76322c3022d5ccd4215e5e2fdf

SHA1
1f3b21fd04b7e532d3ff18e00919a18f97032d1b

SHA256
8de290b02725a8ed88ac770fed1c26142299f980ca54e4666663b79c0a4b8095

SHA512
98e41b4ef233f8abac15125d6fd0267af041dcee6eb044091cf4e77de51af066694c93cc8998964a3919809fc7740b3f182b069dae635c9fd858cb3bf0e5a34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
99bd8306c18b8eab19e00bafb2a5ef47

SHA1
868b5dc5284cbd131d7df7d580cee05195699879

SHA256
5dac7770a628cad555a45a25a49237310c2fa4aaa8836e0337fb8c0967516477

SHA512
4304bc54160b932902d108548fab397eb4cb8029529903c413b7c760f01d24aa0869b02d553c70268ce434541901202bdd9105701b1cc949a12ddcb1f687b6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
b31b42f6d594e612ee8abf3f88d589af

SHA1
65015d1a32e2577475c93047117d523d2e6e36da

SHA256
e912386216e52ba252304e97da88a20362195a0f9cacace8fd4bcc3a183e78d6

SHA512
51acb3225143986fdb16efcb7d342fc49c6d47cf391a61ca4a83ea85b9d6c255cb98e93422e95167cdc15e0aa082714a13be20d3f7ec397added550b1b800bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
78d3a7d33f7bf53fd5804526755f42ef

SHA1
52fc96539441f30f91cbcfacdce9039eca92f499

SHA256
843ad4af8b83b2722596221bf125ee6e18ec59ecc1b9a5f6cae4313a81d8285e

SHA512
317e7a854cd331a749206566743859fa2d22636679db532f2be4ed060b2a2609bec95e8c482c21d5fcb3e307fe25681924f6e936e895dd59588f309679722e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
efcfdc667b7a88ddb787b1361ccb3df0

SHA1
f852d9f9c5d2bae9e00f61225efd9179ea50e8a2

SHA256
ba4a34612d5890d83fbdbf15996f7e5b9725171abbffce1d7da254d07dfeed76

SHA512
c38a2b9ff323df8563e417255c2f48393d64f2abedfdb725301523413b5a673955c54323d34e6f88fd430b354d32716d67c34a0b5364808eb51478922e90ae80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
626a4d96f97cd2080739f4f85c941c36

SHA1
52dddc01c7d1c9cefc40a4bd697fe53c16417338

SHA256
b8d8cf354c9b8db67e404b6c20a49adc2f15d5ad09fc48b93b353f8fe64b7661

SHA512
2dc9d561cfcf329f8699003a225faf33a9eacdecb27bc9ac3af7861e9a622ba2b1e109f2b850ceb28fc228ec828ce4620085a53e08c81a4c6a58d26b86d82117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
aece011f669cb862ba7949d0bc7575c8

SHA1
86f1e85a660d4c55f72ccfc15f9762d97a76708d

SHA256
85eb40dcb9174f3076016cf7f6aa15147f377c6283067c481445407563893eb2

SHA512
0859fff93984b34212b5c41e4165f52ffff1b6e229cf4b3ae2a2ba1de65bca528f95875422a89a240489a3e10f772981254f256b17658fd85bdfacc711523127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
6d4f1dc5b801a8ecea8b938b87758e9a

SHA1
4289872b4891f13edf4ca10878997364e82a9315

SHA256
fb9015472b23e67e6170618420e6f5ed7df900d74731497a10c7405da39e6c2d

SHA512
daf99cf138de14d80a6746340fc342219132d5bba70b00a8c45ba82bb0c1e6f36859f651f19054b3aece065875c73f29123b2c668f3e8c03865874196f0e0493

Download Submit