hxxps://account[.]activedirectory[.]windowsazure[.]com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&login_hint=e_katchenko@wargaming[.]net

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2025, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://account.activedirectory.windowsazure.com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&[email protected]

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
42	5112	msedge.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_396687719\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_461620677\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_461620677\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_461620677\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_461620677\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_396687719\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_461620677\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5524_396687719\arbitration_metadata.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891133566141312"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2362875047-775336530-2205312478-1000\{94387F1E-32A2-48F9-9B5C-92CB71B078E5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 3616	5524	msedge.exe	83
PID 5524 wrote to memory of 3616	5524	msedge.exe	83
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5112	5524	msedge.exe	85
PID 5524 wrote to memory of 5112	5524	msedge.exe	85
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 5696	5524	msedge.exe	84
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86
PID 5524 wrote to memory of 3664	5524	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://account.activedirectory.windowsazure.com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&[email protected]
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7ffc9365f208,0x7ffc9365f214,0x7ffc9365f220
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2068,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1404,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1928,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3392,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4964,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4924,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3596,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3896,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3912,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3920,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3972,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6148,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6216,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,5469499902151794814,2475752575931915209,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5524_1346079548\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5524_396687719\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6ec80650bb87997281d6b2c490e5939e

SHA1
40faef4ca4833df8dd17c4a05cae8e4fdea72b89

SHA256
025280e5fdfd02d49c42c93e14cbc699b80eb10e21d31bd0aaa8a9b1067a80b5

SHA512
be947097b9fd14a716388b25cf4c253ee4d074a8b13370873b575ce5beb3843f1961df08e94eb07958657c64ae27bfb9f75ba9b2e19ac29985a5fc6813d500fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
7d2dba21c5773d14718d816e3c354bc1

SHA1
e6c7cab1b17a12e0737f901a6d1b2bafdb57ff05

SHA256
52539e1687e26a7f074bc4709867012a290f6a03a40fa25e70e15d858679c49b

SHA512
307339837c9f803a00aef2a6e8de673a41db61f5b96f54b972dbbbea0a97217587e82e3ab67407f513e0fac9599fb8424fc250c35fac2641339587ca47e0e4a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ece0.TMP

Filesize
3KB

MD5
47ae64bf9205269f5d23bc54ede190ad

SHA1
ed487e89e8e53bd476a2193f012f5165018c51e5

SHA256
e2a55ceb5fdad7636d182df9b369ced8173a252df8d470fb44b1bc12dc710c4e

SHA512
4594f916ebfeb5235c1d40b904850e91e8bc23c43e0a3a02d5e46b1153bf9a1ca0e75ddbbedbf2c8abec9b06a37e5208344a66a51b84bfd89133bbda5a9afe53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a03dd3ed7a0a4b51cbb8bddab6884261

SHA1
20e426def9709c52e21a8e1035ad145f6f25778f

SHA256
db497b4d86e5af27469354d18d5cf336042a7dda241fd6a2f2d1272e59b8046b

SHA512
f6758255089335524620a28bbf774298b2a966969e4301efe39395bf3dc7d91c75be3b369f4bec315e91e51e7d9c2a6cc58e5066e5dc88c19f13b278761f0e49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
90f60c63c1a799314960af282c2c4364

SHA1
40cb387f4076a0fb508b62a5de14d21fce3271a0

SHA256
6f8431cafb7061ee8eb81676a6ffa1a1fa77dc3bb772156ad3366818765ed5cc

SHA512
aa2bf6063c061a27c5abf85098e2eeafc665a4803da2cdf91f109b514e8329c7a6f586ba9bc28235fc3f5cbb5315f90a074602846c9a48e129c5ff446ec766d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
fb3e5f02ee22f8db34e2494b1f6da0c5

SHA1
cb24040457d456416ff853ad17a99202df142e42

SHA256
f10dc683cdd49447c27581a9eac9b8e8ed5f9d5f613afde2cf83c0d9c90b04fd

SHA512
c09f9c48b8ee2099994296e28e65340875b733807c78df20128000f12b3693584d0ed4c1d8cb9c566e83646e92fb2aba5166a06354fc5018435ede590422523b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a5067aaffd78e650b2047117408a27c3

SHA1
3db2d3de66f175c90b4162862a0948c6770845a7

SHA256
ad66d29263be7db942213e4c2b9fa6f298d0f16c4001561582f313c968bc0a4e

SHA512
c2b56f26a68a404eb7ea1479f6c485136774cfa65680e43b007e44b3d5c5a007c379dab80e692d6fbdb7576b32c5c5972dbb4af3c6531f26c91bf080919059c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3db79e636cfa438222adeb94c9402b37

SHA1
0dea2430a912300c33d3a3f8028e32d23dc23655

SHA256
be259c255fa8cc5eba3e118b9caaf75306daa0c1a5a1d090341f833c802eebd8

SHA512
90cd6c96382f5760d972c01fb3cde3c5530c2e21dfa891908103417c0a937c5538a733cba0db7d85559ac89417f1ee47a56b3aae8141f5095d3780c5ca83a3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
89a418b72e8c86ae9c846a96c82eb20f

SHA1
b198a65360bf98555eada347fdb95d4cad520e6a

SHA256
651c1c420b06c37071e27e1292d87149e94bbd2ff3e12189b4d5b9fe3bc3c220

SHA512
c06cde25aef8f0ad3cf58af18a8d996880ff62d45681a25e443fc6f90b413992d2309b089fe88fdcf6f43b195dc6b38ac1965f24155a6f000edee0db1531f62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
fc4b7936d92c6b9569ca6632b23c1c76

SHA1
d123613ed45f403dee3b5eeba3346ca4cc3c50c4

SHA256
9ce6efec43f199eebda2e800e1adf4c9b842d1bafd8753cce30ccd95476e9289

SHA512
c6c4b4549c073249a15310728a8ed5a3394536f5ddd7f6200dc9f9019f9aa3fc663b2453990f317c4a2dc9bec80f6defad35c966d1afa11cb1786c34a52b9668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
7b24ed55b53a71d59d0fe84597888a0f

SHA1
1fd862b00ee63504f431c7069644d09358c47008

SHA256
1fe85f65b2c53e787f1b0243e93e949a66751d031d89acc111b6c1a840fcc14a

SHA512
49eaec174ce8c9177420583f2edf302f2319cb2369eb57d7e404d8152316bc9554f86c35d3f6f1a65979c2a6718214ce3a5887e310070d0ae5ee2a0ca57d6767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
59aa97c3a768c9fd178ce454d378e317

SHA1
cd8929f5d019785cc868082994075663f758be14

SHA256
d3ab3750eb076cb28a3c6af805c27bbb7b06a7399470804710059fb42f3fdc50

SHA512
e88bb50a3effa259b2f46cb48eb910d441126fdca6037f98586a63ca86b37c2966a8d506b1a155e81bf20388050dbe2ac8ab617225886c5cc6d98df9787ec0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
71e5e43dab4ab947a4d0325e2ef686e9

SHA1
a5ef83ac19f87a558b67465f6983b22472ee17f7

SHA256
000be97f74f7f835728f9b233dbd431a5ca9fec72dd6f5a20e89445c20509741

SHA512
c8f2a0a4321ce2fd0041a1b88e59927ac07951d5ca63961752ab8fb0184865e69b0e6f8b088e1b94b6b7c19c20d7841f22d0ab6bbb9e68ed538ae3bf6abf922c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5154f396ba50388a6bbcbcd5aaa8e0d6

SHA1
de3398c70088f23ba28cf39d47c3c1f0baf50750

SHA256
d4df1005c7f3f20c1e6bf45a36a4a3127074ad0a0da238f0c32f9c845ef65bea

SHA512
6618b29a4924a1338f15fd8449f9be9d47e06fad347bb2c2963065483b09d85ba2872de22fc33c92f38dd230c5c1a1be769734d7c5af91e0606b2552add353da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5f6fdbc3da743617cb849448428bbc20

SHA1
c9058d995e48611dfdaff9e5f7307bc55861fc2d

SHA256
9146a9cabd2e63badbd0c8170f27a4fcd2bce4502590889a2d8ea6efe55414fc

SHA512
090873c72cdf1c69ec97a90098de917696f56c8e3a307165b0aec69db0b5a0852eaa07562987077576fa6107d6c80bff5406a62cfcf915d0a3816527efc2bee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
5a7d064d78686e3304a685ccee70c766

SHA1
4a5f575092a88711d5b885cfae66fe84f3f5b377

SHA256
544c00931edb2ee1710fdd283c961b0cbd14780aa7ae57de8de7631cd208eee2

SHA512
693e1aa6bedce61ef903fea0328e2edb755579eab604b92b5de25845eb393717df7fcd58e3ae6ededc3da47df68c3292fb1f7a0e6b4d36a0bff28a54393c365d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0338291deb4b66310fad7be16d380249

SHA1
6adc53522874d5b7b8a92c1baae422e15124e78c

SHA256
f4b9a59249fd450340658fd50bb745a0c5385adf3b774d48b7fa3b0ba3a00c8b

SHA512
5bb33bc62dbe39f6c0d7dcdd7e5ebdf120473d3f536456c074f8eef582e4f34801b37ce4ac8ef0dcba938e5d1e34bf870920bacd7e5df7ff531f777631388a09

Download Submit