hxxps://canatultd-my[.]sharepoint[.]com/[:]w[:]/r/personal/laura_peltonen_canatu_com/Documents/Canatu%20Oyj%20-%20Yhtio%CC%88tiedote%20-%20Veturi%20-%20DRAFT[.]docx?d=w2b3584c11b814e10b672dafd906ff941&e=4%3a65470d69e7fb4f1b976550ff8a8c4503&sharingv2=true&fromShare=true&at=9

Analysis

max time kernel
39s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://canatultd-my.sharepoint.com/:w:/r/personal/laura_peltonen_canatu_com/Documents/Canatu%20Oyj%20-%20Yhtio%CC%88tiedote%20-%20Veturi%20-%20DRAFT.docx?d=w2b3584c11b814e10b672dafd906ff941&e=4%3a65470d69e7fb4f1b976550ff8a8c4503&sharingv2=true&fromShare=true&at=9

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 6 IoCs

phishing microsoft

flow	pid	Process
185	3668	msedge.exe
185	3668	msedge.exe
138	3668	msedge.exe
138	3668	msedge.exe
138	3668	msedge.exe
138	3668	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873014705189124"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{A68A433C-CAA5-46B9-B817-7335FC451274}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4296	4424	msedge.exe	86
PID 4424 wrote to memory of 4296	4424	msedge.exe	86
PID 4424 wrote to memory of 3668	4424	msedge.exe	87
PID 4424 wrote to memory of 3668	4424	msedge.exe	87
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3992	4424	msedge.exe	88
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89
PID 4424 wrote to memory of 3636	4424	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://canatultd-my.sharepoint.com/:w:/r/personal/laura_peltonen_canatu_com/Documents/Canatu%20Oyj%20-%20Yhtio%CC%88tiedote%20-%20Veturi%20-%20DRAFT.docx?d=w2b3584c11b814e10b672dafd906ff941&e=4%3a65470d69e7fb4f1b976550ff8a8c4503&sharingv2=true&fromShare=true&at=9
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff8d587f208,0x7ff8d587f214,0x7ff8d587f220
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2580,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4772,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3784,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3760,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6236,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3548,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6676,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6936,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7004,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7140,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7008,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7420,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7124,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3520,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6868,i,12671772130184329336,730691040566618405,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\_metadata\verified_contents.json

Filesize
2KB

MD5
c7182c4ef7a2cd6a57e48d44bfd4af9b

SHA1
2e1e4746da948d83baf4bcebee618784f8ab209c

SHA256
6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822

SHA512
d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\filelist.txt

Filesize
134B

MD5
3bf6b4eae5af15288bf0d79702f9cb78

SHA1
b8a052dc4973757ae865661ea0300dea1d27f3b6

SHA256
543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b

SHA512
25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\manifest.json

Filesize
658B

MD5
2cf796650e5ad5bfb6c4a421d81734be

SHA1
79298d3cdd584b290d825d6fff4b857012e71992

SHA256
fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430

SHA512
1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\third_party\babylon\LICENSE.md

Filesize
9KB

MD5
e57b8dbca804bf4a2db759fa1a70b3cc

SHA1
8acc131b3698964249b08a0178f7c8c467337048

SHA256
4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63

SHA512
d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\third_party\babylon\babylon.js

Filesize
1.2MB

MD5
e1adfd8f62854c2d9ce65f13268c1ac1

SHA1
d564ea1d59305bbec12995ee43f1c28838e82519

SHA256
b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d

SHA512
ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\third_party\typescript\LICENSE.txt

Filesize
9KB

MD5
f632dfdde0adc0da86f701c6f2df38af

SHA1
5a7612b4d9977a7e79f60e88df556b09a90df828

SHA256
43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a

SHA512
87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4424_547978996\CRX_INSTALL\third_party\typescript\typescript.js

Filesize
10.4MB

MD5
d931cf27eb964f239e5bec661810abf5

SHA1
1616508213014fa7cdb50e691cf737169019c6ed

SHA256
986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959

SHA512
9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\devtools_devtools_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ec7d1002915632457d511476d07a9507

SHA1
049d45252d2e4504a6087be5f9f53da138a9dd5b

SHA256
c68c5ef6fba16d01d741e2266abb3d966634f6a81158c299274ca68eb70414c8

SHA512
6d6c2b7f4f141747d92695d2f49c599069bec336a76cdf250f45578dddb0b0dbc1d087e2ccf761e556e3c9e3ed989425f8a51ffe48b60438a0e319ad1cab1834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
d98dac34118ae055062f763c4a88f988

SHA1
17b0faf41b19ee43a97732f9011bae0f3275c99d

SHA256
c0a1597d475e9972ebaa2f8258d28b1b21f02aa70c955bc36ded1edb1dc6a89e

SHA512
37688efef192aec2fae6bd6929e121d03f41e8befdcaf5f296cc99610f99ad3ac6d8e8a2b216a78c49ec00a4a99c99dd62d199b44654515a81cb61b8b5d3e1c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
95b9560b9f6bea6a017d262c89828222

SHA1
5a332a91c7b7061175ffda1954896ec0a02775e3

SHA256
1c3a38e280cb932f933bc67421fb01149d73d097e3c5da11eee49c45112dd321

SHA512
0594cdb667b5f3e73e5d62f25efecb109d2ee086931c7ab706a2fa43c509da12a0ed2445460ba70864f1148c1898b44a282434f105be58b8aae7269665820e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cdabc30c-1e41-4853-918e-d52ead5a25c4.tmp

Filesize
16KB

MD5
ba8a7f78ed200cc1a53b9d87352e1218

SHA1
8419e087e204e087a58baf757361d20014f94b13

SHA256
fc4f88ce1f331205b993563e9bdd384fdcc0580aaa11ba6ba95a00840418888b

SHA512
0c1d88f41c083ab2e09247f2197d64a26d54f9b9f32a7b8900c446075cb8029f9389f7cb6417357cdf166ea1d51334e6b13060d4352ce10aed9ebca9878e4dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
04ac0602633fd0883212fb3a4e6c401d

SHA1
74486f0b578f752d195cf5262823b3fec1fc05c2

SHA256
394f9486ca702f06811eea5d611dd741f30957d89f44f54597c47c9b85a87317

SHA512
35adc654a09e96a5be7d072f18c512fba51d0a0408329adfa1021db3526d140320a3106a74532ffaa6faaa1818a238806b6e94ba37690220a9f8f27728413812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d902acac2847b3c33d36871fd684d353

SHA1
1915391c91b4b2e6a75a21d920eb1f4bb8ff26ba

SHA256
f4dc1c4c3a9721855f7a3bdaba7585c3736fd301433065887faefcd42281151e

SHA512
41aeb6c584a3e1e8bdbc53d4b5a02c6463277fde556b3a5a6509e65db36f7b81bb5d653188fbf3653c6c81ed7dc1fd14a1aad3b2669992ffebb82056a5e51486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
867668464058fb38ef775dac91070ecb

SHA1
be0794f886f3275df5d41e5f106f3af36e289613

SHA256
8f8d860a10c41e846ad20cc6087755f79e88908ac7efc27a5ee96e01bf6b7780

SHA512
d8b86ad2c5f18a9d4a6271270bf21f3982bce09188422e3e4a8d6670d247b7dc570a93e91ab1030fb4814e7681fa4fd6716c61afdc0fbb60a1aee3242e8b0499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
048ed677682f7cc24f2e43cfa38761c5

SHA1
bacd42fab17f1b27598ca005910cc3d889b67870

SHA256
2c19e00f5f0e4f3e5333c845f39dc86557398680fa385d28debdab4d8dd8602f

SHA512
9ea9690d550843bf36c83d081133e047db6e11e542fad11c116b4a0b2491dc41a67c21b222ef871e5c5b8bd726843f141768637855fc1180fb363e73a62c2a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57e530.TMP

Filesize
392B

MD5
57db7912d1aa727aed0868bef20abc90

SHA1
85eb1cf88323771b28363b6524cf7317fcad18c7

SHA256
86f8d16144b14d1f8b202891824c4cc18c5120d305e0eaf614ac2b368d19bc2d

SHA512
7b3456c6537813e26bd7562f64fcde88172b10304e8d916c5c24ed65db359136cd6021659f0fd611872b01b494e1c56285980fb0c67d67c449c619d63270a3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
28b5a9c0d55455cae9325cdde1644ee7

SHA1
37dde8aa07d0e0846a4f700e06d55e60c79a159f

SHA256
deabb09f008c9b4b23fa95a92d36430dc48785981084d59e1ebd698e4ce20fb9

SHA512
615dbafa359d2367e4a6a9977b875fab1b9521044c7fad34393fb0da73cdc713ccf3797363a976e5a1bbb33833e07747c51e1a67905ad66448e5a95058e9c76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4424_1014720317\32e4e149-6236-4e87-8024-4c82a44e8b3c.tmp

Filesize
2.1MB

MD5
4cd67032e35fa92f5182df10df289906

SHA1
9210bfc66bd808ffcd7c6443e160dc8d6754c416

SHA256
efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07

SHA512
f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads