hxxps://https---www--roblox[.]com/users/1328674965/profile

Analysis

max time kernel
146s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
16/03/2025, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://https---www--roblox.com/users/1328674965/profile

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_326863497\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_326863497\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_326863497\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1648835252\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_326863497\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_326863497\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1648835252\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1648835252\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_783204155\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1648835252\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3400_1648835252\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865888716515552"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{26DBF0B5-DDE3-4C4C-9BCD-5458895596D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3868	3400	msedge.exe	84
PID 3400 wrote to memory of 3868	3400	msedge.exe	84
PID 3400 wrote to memory of 5264	3400	msedge.exe	85
PID 3400 wrote to memory of 5264	3400	msedge.exe	85
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 2352	3400	msedge.exe	86
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87
PID 3400 wrote to memory of 1796	3400	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://https---www--roblox.com/users/1328674965/profile
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ff818baf208,0x7ff818baf214,0x7ff818baf220
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2244,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5088,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5236,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5100,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6104,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5276,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6412,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6388,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6500,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5424,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5988,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6904,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,294699204753380338,12334422193392776930,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:8
  2⤵
  PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7da492a02c29529dc0ca538b502e3379

SHA1
cee6a1b81936f6a20f1c9c4f35c29394338ff54b

SHA256
553164a83cb91c4905a86373c61bd899bc1007e7719791878bb95290f1f27f36

SHA512
3a1aaff3da507ce35c4e06ff9fd2516c65780849b24fab33417da2e799e20bda3594e5f2f32b1326dd1d3da560c76dbff1f626c147e99c7a990fe09ab0a2e89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
c6374030ace978c95751ed82f15ba1c6

SHA1
9112d0b9128a53a0c44fa8873b1649349c5c906d

SHA256
8ae9c1962e0c2a8f0fdc17f79fc2b912a6205520a29a06f55b2e83f9fbceefc1

SHA512
f9a3ff74f3973a185601e0ec4be855e10cde1e752212038fec314e95efe72ab7d4f22c5779be49abf986cf062744d0be439f97c7255fb83229a25b1b15f06115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ba86.TMP

Filesize
3KB

MD5
23b5e85c7e8f7b4c7f198dce7088bd65

SHA1
423136e6400e6f651a65ea3c2cd96899401287a1

SHA256
e814171004f07bfeaf10766fde92463ffd39e89aba83994d56dffc179f11b8e1

SHA512
7d1741f6f5fb70c47a8c961b197cc6550df42330ffb2eb47f1020d32d947fbc512c8985e240ae1edeed0f7d7443b3e74356ff2ed81f07ae9ba7db87f66c87ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
4720cd2472bbe8313fd1e48bdb862935

SHA1
fe8b6531d70b7967a464e52f705b279f6dc2a772

SHA256
3fa036390ba89b185b79afae8cd188f0989daf3f4a4563ce8302e3886798eef6

SHA512
d8de8592041191fdc06dc54ef9ed5e7579c3801088e05cbbebbfa3963d5dd13c4c661587fd27bcaffb69908d9eb75a1beb709b78b5a199c2edf2e215145732f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
0b1a3fa4007f0ae889639fd5300c4fec

SHA1
64a22ef460cae64e7d21821eacb415ecf2940045

SHA256
e6fb38fcf193f4ac9321b7bd04879e226701355992059aa791fa2db2a4a5fd03

SHA512
51736ad6f47299dfde16a4f276a85e02e08f9f735e5fd35dc30c0e3ff391ceeadb777f9a56b2472b8ae8174c3c8a344e18c37756676f2d7c89f40bf56f28e746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
f0b2ddc1673c4d380c227714c6f68994

SHA1
b79b23503124af70f495f2f44dc2b6c288a34199

SHA256
1e8e97b123ce5945d8c9ed6cfbb1210fa22791c32e2ee073610725e784e753e4

SHA512
b4d58bd7c8e5d42c86530f01e25b04da2ecef6b15b53aa2f7646555b8cd8020a0432403c787d182183d12bda99aa04865b32e048947417e4cd8dd1332a7e9be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
7200d35d6d9b7604b6ce3539de4b941c

SHA1
f3a267990f3994f952b3f20ce5312c41b8768f2c

SHA256
9042db28d23ff1b4d6197bf80a68193d6e7343473250a8cc9ca1e39b0d17992b

SHA512
ffe8b892706fcf105c08c6e643e17c1864f23e12f1a3fd446ca7cbb57570b685a85b53a8fb8f2a0defa46816df0b8cef28add2704e5c16e6cfae46aabb0a38b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
5ddc6d859149a948f72d9f8b800ab870

SHA1
038e9ab1fe093a9b747c42b6e70a949166e1d8b0

SHA256
1cd23bcb64b02fbb61cccb2249aa7ae82b2459dcf918f5ab7abaf95178a0c784

SHA512
eee274e8c41adf7435168a492376391ef66962e1f4f6cbcb9fbc1117c6e6ae2bce31979fcd4997abf23f1b2a388122cb9e1656f82bf03381c359b11d3d19ce16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
171166ce8d9d172e679ed9a651c9c5e7

SHA1
bfbb4a68c78d9d78312cafc7395adae63244fb59

SHA256
89642fbec7df45cbbf6a2a0cf67c3f43551cc03b8907a2839ab6fed6b3449a24

SHA512
56bbc14cd9fa456feb570993c92e9d82ab3c7a42bed936adbdb86887a690a810b828732b901d98bd651ddd5dcd1d2b872daebd1426be429e088bd7382b06f4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a4021f774dc7aa175f77f4748222e597

SHA1
07e232049207f257ca0d14b88b0ecd9ad3c48cc6

SHA256
d89cb655245b8c33199b29024cf61b0dd38c88216bdca3bae9f47145d10e6480

SHA512
b95c9559b11304169fc97cb5a9266677f14d28f88362f8767c9321331e679bc3324a71a9490682ebe3e07c15ed86dc9c0ae804c5cf934639ee0976f88f421be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a3c2.TMP

Filesize
72B

MD5
04f176201a8d1a3727ff55aecc570e69

SHA1
f12103f7adcfa2d3bc2e291145bbd76b6ffc74e5

SHA256
917d2ad450d7939646f34ab95a50acf65c3b036b65966aaeef1b6baf6d10bae7

SHA512
2a82da62731e67c6cceb23a47d1311a18e49f345690fdf670e06d6b1554e8519b14354387ccb7822e3644d621e3be668dbbff76350abc603fd6cac6134574a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
cd11e4c689bef9585d93f8ddf5a67170

SHA1
6cf70710695e80200ff615f0a37730ebbca0d00a

SHA256
28394b8fc42c1c75c78aa846b61e6b97c851e814405e2ab52f187ac653e786e6

SHA512
3e154bc6fe1087eb960e5f93fcddc8b825c7e89355bbd3c8b53022453000ece8b59ec7c84f751449577cdb30a8a2761df99e54e47ae650061cfa8109c4b84d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
7800da2ecd9b72a5bf5af70f3647c3c3

SHA1
01a3146f1f1c64adc6bb29c9d7846d03b0f7f607

SHA256
6a58dbe233f7dce3583957096609ad3a4288ddfded8f94f1a02571331b80a332

SHA512
a26ed85004e97783d772b558abfaa222172b8271e2f2fadad165072bc6883b10f8349be34825e7b73c37fe92b282cf89dc9e5176bcfbcd209e8cba9c11d725a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
628b6f829c672e43ca4c1e08267cc20c

SHA1
027cbbab303d2c9147f8abf34bf060d3df2c1442

SHA256
7df7bbeaecf6b9546b2cb939f1643f61fb5cd411999b139073d68c174e3e02dd

SHA512
33218c92c6f673bc21d551296ecb4d0fedcae9746abf71112103063dbbdac9b9d55afc8758b520302fe969d4ed75864d0ef8716726f8940dcec7fa4d46b7b156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
c9539f232ff38b26f04a713e46a924d0

SHA1
e3c22cea693de5c582794763875ae14f41a0bdbf

SHA256
1b797dc72832f827a42ecee06ded7ec4dfa838ecb69954cf627b11964ea33c9d

SHA512
9c83d3219b87d67887336d58109a37a278f2b80a92440c4994d02317bb244a05f059740a651c2eb5c2024f1f35eda0bffac79dee1cb25c6b2dddb9b621f37def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e6c1b8d6a2f4dff99f1e42dbff6f9f98

SHA1
dcb642ec55905dfac7aba82a722c81addc17a78f

SHA256
29bb4a4a8f5aa308437584397ea8680a86c86b9bc1da16832124a2e186c55a51

SHA512
353323e1db8fffbc6fa8166095d6985b67b0faca74bee3bef096c0abc9fc1af679c45a779fb0293278e20891369304222cda6121e5c28aaab8fd30e8a72d2694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
e3650fa99e50ba0af2f883c92b070288

SHA1
ffbb2a8d8c5aeaa671ea45b701a014276a02d63e

SHA256
0e6903ab2fcd9ded24ad6dc262911e28bb31227645cc40e47204b5e1a1198b03

SHA512
7cba3f5e4b2414b2dd33f0f1757dd2eedae9c780cbf51c13be15d3ca89e81b24b63f864193ba2974e63216c87e2c61e199d52b4cce73c2447424450ccc7775c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit