hxxps://shrt[.]asia/FVNn99Wi

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shrt.asia/FVNn99Wi

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1946938881\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1946938881\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1946938881\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1946938881\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1946938881\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1047240478\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1047240478\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1047240478\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870712129452130"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{830264CA-A0C2-4115-AE41-618D54A29492}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 6132	1796	msedge.exe	86
PID 1796 wrote to memory of 6132	1796	msedge.exe	86
PID 1796 wrote to memory of 1572	1796	msedge.exe	87
PID 1796 wrote to memory of 1572	1796	msedge.exe	87
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 4824	1796	msedge.exe	88
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89
PID 1796 wrote to memory of 2184	1796	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://shrt.asia/FVNn99Wi
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7fffe842f208,0x7fffe842f214,0x7fffe842f220
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2604,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4320,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3812,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3808,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5144,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6300,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6320,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6320,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6404,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6528,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6520,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5800,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6820,i,4014158566859221097,3489614261826909110,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1796_1047240478\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1796_26003501\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
5e3158d9da8148cf026a4c42181669bc

SHA1
e3508c7783bda85339d1bc05e73034037f12b631

SHA256
9e2aebdd6b92655cb40fc63cd0bdd4a4672b64feffa5dd93e6a713197579e5db

SHA512
ed54050ad687b3134cf8086d02540b4885fe7e8647c166178a21a2d5940bf29ada1a9898707c87f080269b6e462dbd441f81b99928cbc285a8a2a318230574e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d15a.TMP

Filesize
3KB

MD5
dc891e02328983cca929f26179b0efed

SHA1
812edcefd3c61519d85e6876b7c4306f0dd5b6ee

SHA256
7ded1f37ab4c8e5e4ed2d047ab492e88db2f0afb7bc392192660c19be851762c

SHA512
0b5b7f7304b9b3e56ae066d1a553f60fe42c190169720fe495e20433787003b31dd91d342e43dc623c1f5e328bee0e2e0dc9bc52495182090c20e2bb718f2439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
e3ea3b0c754741f98005f0eac2f43ebf

SHA1
51636c94d649662bc5662325853d3240f093bcce

SHA256
2c58b9e30b277aa3f1e0df23cb17dc18d75801051884335589659c4d64981a86

SHA512
ed89672e44c5ddb131f241ae740b70f051ed01574b28cf2cb3e4cc9198245f8dea62c76c27c8b7beb4aebd82d7d84fb95dea6deaa5b0d75f7bc46222e6d9b52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
04a9b26e2f6f40cc7f002239fd8c6181

SHA1
b13e20c94dd72d556d2e32f522e440ecef975163

SHA256
ddf8b71592f736e1f99eef24e9f0362708144653226005824eb24273ecf7b511

SHA512
e06a86a4b49f1b0f41e1a4755626612a45541dd07a7ab84add7c6d4ea59942d90b417b371ed20cac696317814e2195e0717ea52eaf86e34c7a9212d646f7636d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
239db84ffdb928c8c4917a14f27709ba

SHA1
8debd733b26793db344b093b1fff65a550d3857a

SHA256
c49082345b048402155840aaab6e6e7f6f501d317cd5b4f4e20a6f772fc88a6f

SHA512
a2582e4c3eff454a919cec3237580816375a98a64f6ecacd028496136b5f20c9df8c5e294b7b69a65ab9299b2538d1d430149975ffbac7c7f2545b33120d5d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
c2bde477d07154bc99bcf6e21e1731f1

SHA1
f13ddfa13caaf8c1e762582070749e9f40be9335

SHA256
89356ddd7ba7cd19846170ff5cb7ba2d39c3618c4e5d9db7f88a95e5c1fbc6c7

SHA512
0f6dfdf7e5a7d27126fe286654f4f82be4ac279377c0c238315d9ef6f39b0c0febaa563f60f3bedd74fea486950e66d9da9f647df4bbeef3315a4a14ad960aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
44aa15b91c23bcbd41b183fe49c4b37c

SHA1
f1e437f79786cd4b93837192513675592c22f7f8

SHA256
c4ec078bad4a2ea565ee153b73f6c895ab273a552eb1a0f07ca046e282ab0cd2

SHA512
79a019651787c0f33f5bd7ed9a50f0b575c50cb0bc2ca5604e1b907d431fb48df0f1b82b2c7e443f181fb08e4e460baf4cc3f477618c1308e3872589f26b23de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c4a8.TMP

Filesize
48B

MD5
d5ebc2c0f429513cd443380d7c1dd9cc

SHA1
df2887202455768c6090cc0521f004b576cb2c6f

SHA256
e135c51368040ae05a76b2f58414fc2ecfec55d0074f7ded56981664dee5c30e

SHA512
db060526a3b63f70862c5bbcd96d74cee4b8193056984a08349d8810fa51234df770943b564e65356fb7e81cd5464d905de4592aa310988e54184a6d68a69306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
f8f5a00be20e878a5d6bb8f7bb2475e1

SHA1
992e7c56fd4ceabf37fe50052ce22ae03a1dcd0a

SHA256
1001df0da2bad5454b38ae79ebe4cda7cb87fac25a9b5b21d248839eb5c1885c

SHA512
f0569af68e4d0e32a730bf14d36220a666278d5710687611c20f1e662a1e0c537568b19929c329a56dcf1bcc2fdc56c78e3223d763e640d04aae70d6924708c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be4a7628-da4b-434f-bc28-f3e449dcdca5.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
d1e9fc77257abde37bb695b426e8394d

SHA1
11f8e8411407e40fa9119c84f59a883559ff7fac

SHA256
48932e5f3318e5b1103ac808d4b9601c1adaa59d03fb0bb14d7ad4d35254fc3f

SHA512
ba1227786785229810a88a9c6349c8f9099d2f8297d8025eb3a6b54f72ca1ba07467de8028e51380c3f8e19054dcabd94f99b425a2fefe85cee02e9e605a6748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
f6c8c52d7c62562af643f0eb077f8518

SHA1
082e36fc632d4399f02c3e5b12e937d77ec9e2cf

SHA256
84448d135dad7aa193522046da3b19da2cb7f94ee5fcd0919bd1f6a3d30b8da6

SHA512
73f25e42461e8ce9267cd6d91e2c93bda7a749493b7c7566cb15cf66063ea17c05a94c04405895fa32325792f7a08d6cad644427bec070c0e3d7b5b98a10ddbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
91a30663cddc1164334a02e0f730bb9e

SHA1
d0e242ef4cff36d46968e224ae56aa538cfa9334

SHA256
85de25c7ce148ea93fdede5ca6b7076da5e4a57c8db2f6027e3f40068746f39d

SHA512
6f9bbb330437c220d26aba58137bc3f83a5aa33513a8d2e6ba3ad28ee292338e4e7c65900d83df56b22fb074dc67eb416b27862beebce79df0fa563cc43528ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
cbdf2f2867a474a3cbdea6cfc3927a69

SHA1
13da532734f9c2f12a25fe3b4cdd52521fa6a32f

SHA256
267d7d3dbde7dc4aa0560858a099b2172462e9bdd9e97637fec05578cf7eaefb

SHA512
d6abbbf673c3526aca8252b21c3465a7f1e39cf7f537136f161e2ccd1cd9681f727d520c658ad005dc867812980ebb16df58a2d1b8d9677ac09dcec6d93a0e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
1b31370ec70609cac29d585131bcc45f

SHA1
13fa8ef15afa92d57c6f7572e8d4e2415b2789fb

SHA256
3cb2314161bc815b9c0de3e8e8844786fb939e05fa222be819dc054e11e48480

SHA512
146bce2d77f94f5bb9f6184ebd96c14ad05c8a7b4e9e196497a9d103b425569e73b69bd5c9b65efb2e1b2d8b8ba83dbd1364dd8c2796b73b12ecf519c87316d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
4200d5123e606cb64589479285ac7f2b

SHA1
5df7b8094d21d216be4448642e03d80a73af369b

SHA256
94a71fdbc884ac906125ef10408dfd1dbee35ba26df965c11d0e8072f30ab4f9

SHA512
51902c1773cfff82c31bc248a528cf69cb5a5478d28ac6579bc60fb5e250719a6ee1b9543042ea57a5635eb836b93719d1bc767c0031184ddc3bb91e4bb2271d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0355a182f520d05c19a7b40df1cf239a

SHA1
4d91a4fd2077b10844867849cd8f02d0340f9a54

SHA256
0886b76260e8c9e486054eec456d67c7e32caae7b091527c32b93f948de01fe8

SHA512
1c528353779ad168ca0b259b22ce77856b9ffec898f9f22c152586289d3b77d8a9dc0d084be032863f7f6eb8d4e8ecc79cb00a3cd07923c4053a9b87258bf87c

Download Submit