8e30cc67dc9b93651af88aaf54a024c17ac8f4ca11381ad81853d83a06b1bd72

Analysis

max time kernel
145s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TailTeller2̌(1.0.0)/www/index.html
Size

1KB
MD5

1b204bde6eac9b90a89c79061ffca448
SHA1

42cff584edda12421c758822b9acf2e398e52ea6
SHA256

91dca6920f6cd299d0089c4911492054cf4096b0da3d0da31f574ccce21b50d9
SHA512

9a59998a5d462acf4d88ca5bd8ceba2c459f02091e374458a6999962e9580642e89ade3e1ea24124798b45f22bc2743d2c2d5a90da38cdb5547e9cef768efa90

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_1046950995\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_1046950995\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_225912506\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_1046950995\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_225912506\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_225912506\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869802421321914"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{0342B614-670E-4ACA-94E5-4CE733710B05}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 2924	5636	msedge.exe	85
PID 5636 wrote to memory of 2924	5636	msedge.exe	85
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4636	5636	msedge.exe	87
PID 5636 wrote to memory of 4636	5636	msedge.exe	87
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4628	5636	msedge.exe	86
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88
PID 5636 wrote to memory of 4724	5636	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\TailTeller2̌(1.0.0)\www\index.html
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fff697cf208,0x7fff697cf214,0x7fff697cf220
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2184,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1988,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2496,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6008,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6428,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6424,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6408,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5508,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6676,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5852,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4020,i,335201232562948010,10174165188778297476,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x510
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5636_1046950995\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5636_225912506\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5636_622859848\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5636_645408161\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
93ab684a21edfa3b2c20c9957bd82290

SHA1
36dc26ac8e891b95ff9298f89c55dbfaedb558bb

SHA256
7e27127748c2a5b7a7c397b91d45e235f29ce1b577045c835b2331072ba835df

SHA512
0c97fdc931a6cba992d0525d9581db1aa9e99be735bfda22b9874732474d7b4fe73ad2d2956cb53b26990b3df1261244a6f60f7b3686eac7761804e25cb56e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e593e89bdf6aca23e1d4da0beb4e5f67

SHA1
560f989933c13353f1f475840e139ab2060040dc

SHA256
bb6626252781ae7c4bfd703fbcba01b18b54c25fe02b2cd55de38367b8907457

SHA512
54457687eb1c5dfdf2912897d2fafab893e4b0cc0cdc42ee6039cb2914e91a564929013fb99cbf495f52c8d55d9cca1e544bb83400b33789cc383bbfd13ed5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c85ae690-9beb-4cb4-b9f8-ed8c6d7d8558.tmp

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6c8d9946a5d702e4d41a829a8806260b

SHA1
32a07c32ffe28f1f5f49ee79970788f3bb2023f4

SHA256
ba9d5bb7559c5ffcb78046eaec8fad4daba2f226a2a4ea93a44878d2678a38a5

SHA512
74939fc9d3f5f223d6a6702236107febe3728b1331e950ec1ec8d7380511b5ceb9f06903e97ed4c6381d671364f8cad709b6b5eadf96075cb1e3cefed37ee716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
c101a71403d3e6463c27303e6e1ab422

SHA1
26a97b64fc1843cc2abfbc8b4e5165248206f28f

SHA256
533c232b4d5412fc3dc3cb84b4b12ebcae68c447ebce20dd55d4942d510c5200

SHA512
a5973e3e13c71fd66f33448807f6549900605eccdf247bd7982e96bb3d7a6b12d0b6b4060cbb7d005794799e55b18c373c7d63d99f768ed5d01fcbad75fa37b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
87308d76ce4e9bee047b2576a5b008ef

SHA1
da08ca3aa4fe47bd6c2d8f533c2082ebe50db8c6

SHA256
c19979c3eec129a2167ba581da11d4ae978167dcb5b5d7cfa3587f16533d0ea6

SHA512
c912c103017dfc557e9bbf53d03e6e6196a6e5144bc2aba4de21400aa34f32a62dc143502ecd2a8cc64bc59e2930dcc13185a1deb42f3e232e11aa1618f54818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
be33130d16562ea87d7dc51d3f3ddb53

SHA1
ed27c5c909247dbf9abfc641a17006b70ef7dc5f

SHA256
0430f76fc14ec3c6bb3a3de0a44fd5b5982949c71a5f7a47155fec97411e705e

SHA512
09271309f7a667cab9d8eda4f3ddbda45d95af4e8de0f947c741f969fb8ee51d2ef1bd55203b7ad76c1343246cec1694e91b0206caddb9622c326f0aa8b6ca07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
4c8b10cfbdea5c8d531d6dc8ed5ce73a

SHA1
af41087e3a696d55f8beaebf657731b8c73dbdbc

SHA256
fa46757a6821fd02cb3ef7c0ccc473fdc86b8ea875e1fed4a16dbdc049157756

SHA512
5c91381e718971c9b9eeff09f5e7f9f4c04edbc5bcc5e30b24e537fb027eea0b4310ed1881c9b81904b03359a2ca7ab616a833530df3fcbd20e38d432665a5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
2dd969d9899aa3e0dd865a9cc430689a

SHA1
71e93a2c0f3352acb0bd7ad99222cf80ce32a9dc

SHA256
9593052ec293e4069924ccce36ad7c31874a9b36b98c12a5c3e5b4f744267cc7

SHA512
bb828350184b560bbf96bd68af222c985d9cf5efa1788b0a832a0f12c29d6c024a3a99eb40dc24e2a5be3705d6af99a95a8517d4a2534eb7fb0eeb87b4e33732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
b4c35801f6c5ae36c687971d9e347be8

SHA1
f01155c7708fcde23f3ef031d8226c1e9d7a50e0

SHA256
9779f29548d8d522ace00c75f0373b216a25cc847dc87248f5cac7605f420874

SHA512
ac27f3a3e9587e4c529439d89d621d1944dc8915e966d077be175a01990c146a828ddfa55fe1798e89d93d73730378baa34575e6d95b5d2b3b77037992fec4d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
438ce96835e1f6c99f6ac345c50f1ba6

SHA1
1e37e9ab19734fbefb629864915e3bd66ab83da3

SHA256
f74b7c277465e688d807ffe3c0980deeb956d9f806c1b6abcf38bbfb7891367d

SHA512
dae2145416e5c80fb8d2519c224fa0c6c4334a6d67f3e07bd1b88c80e14a7924793c6bea46d7cb6e710da898c730585e59c7ff053bf52035cc1b203513ac3d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
8e6b9b88f0fd40377824eb68e5b5d924

SHA1
7e77e980647fef8cef33b1e46439268241f5a7ea

SHA256
ad4082c2e26ee53b84cbe4671989d6e64e0f2ae8cd317a2ead4fc35fdda8c5a8

SHA512
a90b4d66a00bc7d5650c32d0e9d8401817e88e60e186de5e37db5118a93def6f92eb0d70916647af5ccce01f9ad3f946d8cb4c792bf1d553d6874cad2d62545b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f55abb579062a8e02d406c5bbc8fd569

SHA1
d6381594a95d2b561881912f6962f6d721b10d79

SHA256
8ceed76dd6d30f86edc703b959debfcde47403b174febbea1262ed76c7c1afbb

SHA512
9e9ebca406a12804c35231cfd1f9828b9ed2ac86470dc9f26d0bfe8c0c63a03c3d3fbe9a7eae2dc0e05d25f4917654fe291887bc0ad5b78b5a1ae3bbdb7dd259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0a7d4e9f728b9e88f172720de129c538

SHA1
97926bd80216ea7f27ce9f3e76742d988b53db88

SHA256
aa5e98757b9c22180c695f121436d299bc84bf041eafe2e5664373b2582231df

SHA512
7a4c379a577df1768c6397eb6206bd5d08067e1727a9113ea3e95d324ed8130473271772c76e329605034caa0db0008c80c21d8fd9051218633957fe69e8bbdc

Download Submit