037289c207c8e229d728f247c2d7eb1459fb4413fcd4fe662f74c711169a1e08

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Size

10KB
MD5

ff5e80953341f1cb01a5d31fffcad2c3
SHA1

cf2b440681ce3c658ff734517a16cc13afa7ede5
SHA256

7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a
SHA512

bfe9629f07e9755b2df63d632f7eca214c29fc3d701c77ccf4b1eaa7f9ec518af01d141065af38bd242223344c518b57dbf8c9c43d669a191bfdeb22703a9509
SSDEEP

192:PN2x2BvekROFASf+mhf7h6RyfVah9OLgmiMMpIFaHU2y92N:AxeJROFASthDERKgIAUn2N

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2066218298\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2134294252\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2134294252\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2066218298\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2066218298\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2134294252\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\ct_config.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869757473224366"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{6269B0B5-CC30-40B4-8134-763AE3A6E7D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3028	2904	msedge.exe	86
PID 2904 wrote to memory of 3028	2904	msedge.exe	86
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2248	2904	msedge.exe	88
PID 2904 wrote to memory of 2248	2904	msedge.exe	88
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 2936	2904	msedge.exe	87
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90
PID 2904 wrote to memory of 984	2904	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\void\7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa848ff208,0x7ffa848ff214,0x7ffa848ff220
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2012,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2620,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4860,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6116,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5836,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4968,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5664,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,3502534805466330477,9050717008056862356,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2904_155631954\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2904_2134294252\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2904_271150449\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1cabf2daa555f8676068a7f38b3dde6d

SHA1
8d618bddbef1bb299c0002a6ed7dc548ba50117f

SHA256
ca5cc10b848d884c19c9dabd0b7b202445d948901411f98abf8d14de8af705dc

SHA512
48e35c3680be720b037326242d14cdf9c4a5394c9faca2c2944879d7b33a5dcca80a03e9bc9a48da7c8b705908106fb493f860edf8c5769ec8cbc6a0a3acc041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
2356308f0322b90520a0d2306c12266a

SHA1
2b9e36b115d3a6f6d3f17af2076be4da198943a2

SHA256
b61d18ead9193a17e610401c21492b61d5b6bdd289b9baa3cc82920364ea2c7f

SHA512
37a493b483072aed529e43371bbe59177680bd31c2fe75c68302e0f35eb1531f0ab1116e86df1759e393127ac2dde07209647391461f281eaffb657f0602dfa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
cc6737bf6131342005a68a082fc502db

SHA1
f1739b13ad4fc9a4b50a7b62e3973ff4dea58507

SHA256
612989bf77548d4f635ccc666421efa76fae239b50e398fc8502faaf7ce932f6

SHA512
4fdbb07c56032eef03c59d82787d53126e621a8e98b0b0f19c4b3698600904f3f006464d888d29aec55577dadf43158250374bae1c12a2e797955993e9f13ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
ef5cb4a928344f7a5e04e12dab9aa72b

SHA1
27f0047b1d6f3b4008bc4af45e60db0151e86705

SHA256
b0e5e205d3ee1fcc67c618cf7db6ae3d48033334b31953c5f54c810f12c12401

SHA512
01c0526628d4adae2af6addcc01ddc321ed94d1ad360201dfde8d0bfccf62444d1a59e3bc4ddcdd489055bf7e8eaba71cb377ba9fa433fdd17e9a945814bbbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
99521464382d837bee7512dab1055a95

SHA1
ae12819c0f31f23d08fcd431bcf8a0a95e353dd0

SHA256
9fb3aa39b0ab03a92eae6c4cf9a45d82e615cf700ad4030d4a96d647e7794d05

SHA512
200a292687f899db037e4b05f98ad530ac47ffc1f49d860b65724233780ad2204c885c8a0a02505c087d5558fda6cd4cdcb1fa8c39db32e00ada720a58abb9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
8a9d9c178af0e8649c2f54f371f53837

SHA1
7f635d64c59ea5d98673289560057c42f56251e5

SHA256
2b624d5f86936776d1515e801cf0c316c356bec9d71849f74f11ca6aa6600ed2

SHA512
f50d4077475eb0af825fde8bb4b996b3d9f5887e6e2f47e5a754328a7b7a26ffe4fa83dc4ff2b6cc9b7864f7a5286f35e008f51b3917731828b7bd9d428d08e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
61eb02561079162055628db8b75c16d4

SHA1
1b5637df737cb632c847916710aab220d7a0d93a

SHA256
de63de3c443514575b693a721795e157ecaa4ed9c9ba126bc35ed655170a09d9

SHA512
7f8c03cde07cbd82406735357d0f4e4fe8a9581b354793b5ca767670f6023c6a7335c45a16c624ae4aa91067abf42bccae79920d64cadc165172417f26ab5d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
431d476c5771c5da473f572e57a38aad

SHA1
dee7058a4d7aa1b422c0ac6814ca0d2b68def64d

SHA256
0aeaadaa521499fd3cd2c079dac59c1804dbcd7cd8323911b58f6d3843eb127d

SHA512
ae4cadae42e509955a2b02d10acea64a8001ccccaca91ca507c47fffba2e925b9fc354e6f4e59d53808c9658e67284c28f3846b293706eb4a00147501188959f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
47268185b0c00da90411ebb66a98a28d

SHA1
16bc66f7952cd432816e6b6578a4ff2c16dd826b

SHA256
9ff4f776f4a2a3128e7ee48137446157e057edc43c2cbc0f5a459fcd0f0a4d71

SHA512
c9b61398382362176767a85d3872976026069c830f574642908b3802792945dcc5b7a3bf7deb2e65d38ff2b09c3197cc27de5ecde61b7ffebbc0f113f405ff1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
efd8ef67753c72fdc768019bec4683d2

SHA1
7a755cc14fcc06dad4e0df864121bb2018ce7fa0

SHA256
7f68ff826221480284bb11569711ce66f5f6c63d39584d71e0868194ba422f58

SHA512
ce05bd90bd665353c856d58b8ac2464f79417fc311c7e54544315226a2856b96e6fe3bfae504864f8577bd1b1e51458c6f37d7874cd3e0c4d254c7c3b98c5118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
18516bfdbad128bafd3b8f674fe79f13

SHA1
f83dc7cc7f46449bb3af9e599fcc36f20fb899c7

SHA256
414aa6eea6e4571ae5515621248b21dc3ee717865374f2f39ee3f1722cc8b402

SHA512
7397b02587c52294aa6035a7f21f2c3a3e5ad6a58b90b45a21d523e966dcbda1de5e2f25001c38dd13b74f46f47a2b96092043a92081f472d4b5547155583fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
f0259ad138a4b3e6a082008259a845c7

SHA1
68697f5a557908d84c93a21030e26c8ffd732c23

SHA256
ec77f2a3325fc30d4d7ce31525ad2299f6f3c1a0cf7ad4932bb4cd59b9f02c95

SHA512
d81bec779d36bbe3121d2fa170b81f48f7545ac2f1910e59e37ca5a7a8c774aee98a936022addb4e55793c823c997c6ac71fc1ff00134ff48d973970cccedb01

Download Submit