hxxps://www[.]roblox[.]com[.]by/users/374145971785/profile

Analysis

max time kernel
145s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2025, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com.by/users/374145971785/profile

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1786151435\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1786151435\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_794859112\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1786151435\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_794859112\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_794859112\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868783137188677"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{76A8AD7C-F213-4D0B-A2D9-048522552E19}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5680	msedge.exe
5680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 5508	5808	msedge.exe	78
PID 5808 wrote to memory of 5508	5808	msedge.exe	78
PID 5808 wrote to memory of 5092	5808	msedge.exe	79
PID 5808 wrote to memory of 5092	5808	msedge.exe	79
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 3580	5808	msedge.exe	80
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 3580	5808	msedge.exe	80
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 5152	5808	msedge.exe	81
PID 5808 wrote to memory of 3580	5808	msedge.exe	80
PID 5808 wrote to memory of 3580	5808	msedge.exe	80
PID 5808 wrote to memory of 3580	5808	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.roblox.com.by/users/374145971785/profile
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b8,0x7ff9e9bef208,0x7ff9e9bef214,0x7ff9e9bef220
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2512,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2120,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4884,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5304,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6064,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5052,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5052,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4900,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6500,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6152,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5864,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1028,i,10160940914179967400,18188558418941560362,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
18KB

MD5
befd9c0fdfa3d8a645d5f95717ed6420

SHA1
c8b43436ab1659f32cc05625389f63e8047f90a8

SHA256
94e5c823e72e71cc20f4bfa29b0434f2260040965d9d066c0e7cb5dc99ffd6c3

SHA512
4d0b790db4323558a9eccadd1df116883b7044e0f7e4dfe120c2c98814e55ceb1bf4cde14e0f6af38541ef723571db0cdf35a2b3ee398af2d3031a9928df1d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080

Filesize
47KB

MD5
d4fe31e6a2aebc06b8d6e558c9141119

SHA1
bcdc4f0b431d4c8065a83bb736c56ff6494d0091

SHA256
c88db2401bef7e1203e0933cc5525a0f81863bfd076756db12acea5596f089ec

SHA512
1cbe7641b8930163ed3ea348f573cad438b646ed64d60c1923e5b8664c3de9c2c21ba97994ec8d886f489e4d090772b010de72a1167547fb4f6a2d242d46aec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
bcec42a4241652e3875f046821d678d8

SHA1
e93686b6f002f84a46ea4878482dd8603bf8ea5b

SHA256
7a960ab8258fa1c20c623fff8f0e776bfbfdab9b2c3add531813e9b1b26412fa

SHA512
12d622e1dcaf0333c1d94b4a68e1d69c814ffae867ba06e3ed0e8f553391cc943e68ca573c698c27f0418f0c16bbc6b34c7f3e14516cee06974b9f9e11a635c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582611.TMP

Filesize
3KB

MD5
aed8568ae577d3fbb2d1fc29b2703eb0

SHA1
f4445349ae9067b00e1d5a91cb7f5934270afc83

SHA256
e582ad75adf005f9b5e2680d183bb4fedf60411e26e249f0bc6fea14432dae60

SHA512
2d0523caef95d74c6ae3fa2ae4289877b6fc06dbd1a773901151bd29700b5bdea767fe46f441803e7075874383e07443e439610ea983d1a1d2aba862526a92bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
18ba8b82e14291b105b28d7a9a82a789

SHA1
9c013ce1d946b89c59a16fe1ab6465a683dbc74b

SHA256
741bb36e22520f3488545223849f8b498a8498cc5bae665dd914eaafe7a30fe5

SHA512
9074336679cf62a6ee29dfb20e7b359717bc6b8530eacd08a236ac7733dc51405dc5cadf446c37a26b47ea940019d66d1ec98b18a70ffeb251034a214dd34b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
410KB

MD5
fb92c406985bac86e4fbc26bb88a9ba2

SHA1
3c4ff84d83076ca537103eec54150a568aaaa9ed

SHA256
b16057be3a6045f06d41eb46ea1d835ef2aa099b5b94cbd3b615faa8381dc0b8

SHA512
586c16af59b5932c271178fbe468246e909b3fca3f6ebed72026cbea5299ddbfa6b88d3334b33ee22815ac619be5b328d4e3561142c3b5068f65a7fc1129e04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
410KB

MD5
533b10f91ab308e2270eb59802aebab4

SHA1
ac8a3f2579c84f5f722c25b40098ff23a56b0832

SHA256
ea012d09bddc28fec334d3bcf7271b64416a73fbc7aeb1b683bf02da0ef8b293

SHA512
ceb6d11ec19e7a40e08c833d3a2902f271edc8c4c6f094840fde54b5dede76c34552b535c948a78853b019b3ac763952615cbf7e83926c03b6d55487e5300f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
80b8dcce8f03bd1ac9db5e3dd2f3fa22

SHA1
5d271d6a061d9fc71157704ab89955ecf14a1ff2

SHA256
7f438752644734a85a5ecb1cf6b116bbd847ac82e78225b62db057c4bcdd6856

SHA512
ecdc70d1bcecf51d06504cfc3abcbddb5c6aa13ddbc03893fc5cfc6b32526157b6ac8bcb8dcb944c018986ca59b113cb1e379badbf445d21542c281715754f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d682640aefc165c008bf0346c59acbdc

SHA1
daaf086016244be1c69cb521ca344f66cec07645

SHA256
4863ff300bc237906ffd6bf2ff9fe293e34a138be0d0571c93110f5651bba6d9

SHA512
de6f912bbe85783f605ad4a5b37337af66f200781394cdf21ff720f52c460f06d5da34196a0b6599419ac02cfe62065c4c4373789ed68caae3df23c41b224c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
650b538bd3deb644f661a069a35349b8

SHA1
2dd02aad5df84e2f0d051947af16494d4920aaca

SHA256
02d91f9f0922b00ab92d24351ed99cc68a01b54edbf9310506a8d61debff2127

SHA512
c81483fc1045011526fea5dc68873de76ab968c79704cffb3955ba9e1b78e144feb528865e3e99ba84e8b528e4cd78914268520ab35787cb50e86bc29940650d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
e4c2ddd8aff5dbf628c35180615412b7

SHA1
343919da4f74c3b1c5249d348b3fa4afc8b73603

SHA256
247432540415afc16d9651219a7c2f3c0ae9ffc40ceaa7f91f76b3ff53ae4fe2

SHA512
0eb4d4c15dd5939bc33ad55b236ddffb950bfa68a8e6f248a034c861ee8bab5e5a9b1b9eb4d06a7b05c357d9fa9cb80c673ea76cf709ead0e0e040752f55a7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
b535a816386b04a0f4804b241c849cc1

SHA1
51aab8e18ee7da16c672879b7a5611fd3306bfcc

SHA256
411da162be9bb23e50b1895ac86a05e0524bcf72cc95963e87c095d6e0c67e27

SHA512
e672885e1fec59df411dd1a5b6a6414eedd6dee4055c9b0b31273e39f3188a003a74a25668a4501efef3fd8a8948e53ff6cfcdbadc65e1bd1354d314d7268353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
38d6c5a1c6032cbe019754d396a5b496

SHA1
bd45347b777f3574020c9136fb614fe955538b0e

SHA256
154de9c3783ac4641cad37208be393529c0c9d749efb86e90a5c331e502846f7

SHA512
28d7489758000446934b62826c1624946e6fea55c8dfaa7f354c1215025fba40406218f48774ee4dfe77f9c75531d00ce9686c34bf2f75bb002648cd26b3edc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
071ff69bbf8477f4ab808fb4738b5322

SHA1
97e8c248ccae45d88cc75532bf357d209513bce4

SHA256
efb3e483976bc83d9d3a10a3dd81be09c191c9cc2bb51053e7c45a1eb9b57598

SHA512
43d40c35f71e9a26bcf9f565e28b197f31cc5db8d104ee2f087000b451257e34878bc3048aa93d905c3cb304a295346c130017410dd01cd4739e9381ba834082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
e715f5771462f039c605533a29907dce

SHA1
3e9b7d63ab864271973e280288091bea3d83c3cf

SHA256
db5be6021f823f2968d29846303374fcb3afebcca573450b095280c6950f52ac

SHA512
9a56e833d83157444346d3729026618080859da20bb404de2f206dc8ee6a7b72e13be92d1bebf3495baceb932842ff4dc7005b7a8efe7a5b6a9f3d28b06adb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
fbb436b1ede20386441658e852477e4b

SHA1
032a02e48bd19545eb71b22747c85b7cb0433700

SHA256
4307ff84a99d60b6848d7ead6bd958da72ebbec7ddd7fbee3373cbf8026c7d13

SHA512
7d2a82b8937fa98c854457ddc41c2f215b4fd2e49bbf4dea057780b7be7f1cba9c53c7c1bbdeea9f79a07f125d5a2265c40df5ee7e72782a682c2ccf6cd33972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57d6c8.TMP

Filesize
392B

MD5
69e4eb643846d9ad1ee354d4486b75c6

SHA1
104e2cc5038945d5ee3339d0d38326ade786d34a

SHA256
37240260b2ed2b01a423dd7a3743e81f2044b96bb549893ade931a43eb2d30bf

SHA512
f9bc84f80b4cf927b3a934aaa92315636e552a9c4e43c7f33bd10fe114617459c69341b3f008adaaefab9b37205569f889f3ab1915b279ac6ce3b2ed2fdaeaed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.19.1\typosquatting_list.pb

Filesize
638KB

MD5
ca87451145b7744bee71724af1feca21

SHA1
3d99f1ad97326e49ef04904db63c312bd8c64612

SHA256
d03de614aecf8590e013746de46b715605b72445a14702edbda12b5ce2db3df3

SHA512
ef4a47b30b6b03bc73e4c876111af6d08f741998308bde635427d466d4800f8764ea94462f4bd9f13d21c9eff12cc3c2b8ac13433a8cef3f7aa5bc8395c4285f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1444861630\manifest.json

Filesize
145B

MD5
d4e12ffdd8993ba5a661c6d6f631b132

SHA1
2ad30a3f86c7ce9df7a520e8a03e7d2ae0d0492b

SHA256
6c0822b52a411b119a1260d77b6e4840363639f7004fb9528895fce52012c773

SHA512
151c7557f18c8ab074d5f9a13c37f47b896c19437bd677874c0a48e06dce418ea149f84f5e27ec0f5ca0abe86317d110fa373500c36c48d6c2caeff660be13b5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_177961635\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_1786151435\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5808_794859112\manifest.json

Filesize
118B

MD5
1c86577f2cd4d32c2a66df8ea2688d85

SHA1
35a17132f6e9fa4cf9f7cfb307870eef46b697f7

SHA256
312e962260bb133a4c811348a75396477d2bc284701393137cbdad971317578c

SHA512
ab8583a6c1e0f34f937296d12b9c045c99a8d5eb61fb36e797940cb0bd65f952eb99cfcd44c56ae45d6d14ff330bde0bfbd9cf5c18fb8296bf68a64b38ef7594

Download Submit