hxxp://nrxg250004sogei[.]nsr[.]it

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://nrxg250004sogei.nsr.it

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_803465925\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_803465925\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_803465925\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1904190970\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1904190970\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1904190970\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870176891724799"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{F3E8A7AE-35E7-43E5-A7C5-CC3780719D96}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5336	5060	msedge.exe	83
PID 5060 wrote to memory of 5336	5060	msedge.exe	83
PID 5060 wrote to memory of 6052	5060	msedge.exe	85
PID 5060 wrote to memory of 6052	5060	msedge.exe	85
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 8	5060	msedge.exe	86
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87
PID 5060 wrote to memory of 3224	5060	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://nrxg250004sogei.nsr.it
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffd44cef208,0x7ffd44cef214,0x7ffd44cef220
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2496,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3364,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3372,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4228,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5692,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6000,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6152,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4264,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3472,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=760,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3480,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6132,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=968,i,8747572203782010258,7306327338939287835,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1533983824\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5060_1904190970\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5060_796400648\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1094fd368762724db7110e29668c2eb0

SHA1
af5a2660240798eee611ef333ed0593f6ab6beaa

SHA256
0f11a52775b1e607767583f7eebe1a75bfae7f265eaf608dc3378c637d25c477

SHA512
322fc5d30827ae1147703561f14fc1724e7be6231148ccc0f90ead713f4bf12991654c9a2bf09ab55914b2d0006d7ec8c0c83a2f71e288565e56258f66cac9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6230e1b98c4b3290d57308868792c173

SHA1
02f725b018cae075f17004e5ab438f117f5884ea

SHA256
c4ea568fdab1269847e151a9432b5506f7eeb3b6ef914a69e0331cdeba151d35

SHA512
093563b0a09a3e6f79b87561e866b5838ae448cd6bcdfca2f4303e660226a08030f02ca66c10014d98d213d7b16ffe55914f02a8cd09770b797f994a6dc8222d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
56f39a26b9351d1fa80403ce31a79fde

SHA1
570c585133876ed62b564d33e5be57f7b3b3a935

SHA256
f6d261d31b4d9c0925022a1ecebd50853a4097b7120bf30ae7e10f014ebef583

SHA512
e1d56de3905df9b4856a27a3de0cc37798cf0f9f7a223357bbf5987d0e92edc348c0fa2b8dcfd104b503bcdfa8e71e404731275326a18f155d0da6547bd754a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b4616a23532309956c98a063281b5f76

SHA1
4844132ca59d2b767a95f667092dbcb1127439b8

SHA256
2ee8a873bcbe8d45977571c26568a777d18b48d524867794b815f347f54e29c9

SHA512
43b7b7a2855c7384e04740dcd8c105f292680121953ff31fc5157749fe58c1e526534d33562a0141e846824af2a16a95961e22114e04202eab76d7bbbaa792c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
b10f00b862f06b25da245af8948efb04

SHA1
ddfdc3d18c72f3115a621cd5b62734fcdf1f3392

SHA256
aade8d97a7910a828f3d65d9ed7f7f057d047b3416ce9bcc13e4fe52f0549e4e

SHA512
7e93f8db8931e718faffc2ab8375a8dbe894fe75c37a943861268557ea6bd867e3ba58061c70dae95403ee28b08903b3bb0b5e4ae4a3dd8072af3e72272cc8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
e15635d956f5c20cf59c561206bec515

SHA1
198a899a49c6b0aaafc477d8a19ba0976545f126

SHA256
990240a35ac0f52db36b56aad10cf9a39ab60aaa1792baf632aff37ef7cfb849

SHA512
c5ece784e132abcdb7c2d7a0d96d4096412ac65564a8ad2b289c3555e82ffd2c4a7c17e6048c16fa258b22cce8a5f5bc77d1fa059aade1ab513a20a0b27306d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
8068710bc920f55ee4d04ef3f8811658

SHA1
6298b9252260b613e39dc8b2f5b62469a4a2c5ba

SHA256
bd20e962de3a7fdd6a55404a8ac153bc7d19eef2c84a53f489efd32453945db6

SHA512
91f906d57b9af50925bc26bcb076fd7b7f7500cf30c587f0deec1fa6f94897e8b704332606687c2da83e6ec055fd46d9549108e8e824e89ce5cdaf93b3a6ad5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
2678abdaebe57fee85d68f3be33e296e

SHA1
62d06a2b630d109a771f03107181e02fae3c85f2

SHA256
3970e531d4664d92b0eff914c5650835cfb5ee263a15353b54034e184b760e4b

SHA512
da4fc4b5828a54098ba4dec20f677125f433542bdb2d214c76b69f08a874d36d8395873eaba4ba34c49fcafe3778335d41222766a1df20a55c73a6e89a313a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b5bd230f-d901-49d3-87fd-16906fd26e4e.tmp

Filesize
465B

MD5
405c7b818aed2202da7d7e8a6fac6391

SHA1
5cc560ec62aaeb20be85481fd2d0bb005f9e17aa

SHA256
e4fd34421c6f2c7b4ebdd2478df5b9e0b2057937f463fd27a26d085f2383b548

SHA512
006bb99afbf9abf15f40dec8b2388a09088be8e411d1fbfc33832296f75320591282bf9835b024f08717d64a051a71e00f7e353818e709edb337c656ad5f34ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f2d2cac6e95dbf6865757545ac4d8b87

SHA1
662e8899f0bc7bb4bddbaa556d4233725a1f422c

SHA256
262baa2240f65cd4e6810238b8a33fab834208ed5443eaeec785b4a95b2ebde6

SHA512
1d1bb883cf852786370f7eadafa9443d4a9996e442ae15ef07d00b16e8436504fad045f9e98c8d2f319af0bcf35ebe1140f44e2de584d8a4d191772918d29e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
55f22163ebc92b81f5aa4a1fbf8febbb

SHA1
d84281423be6bd9351e2da75488031099d3df34f

SHA256
6a58f0824696ac89b350c5a864d836d66049593773767e39042d3540daf59347

SHA512
3fee72a420024256c2d4b093969f15b79c7d2d3d8aed3ea681ae09d88bb421efd9987834fb481488af895a14a40bf0918b6a88e08ec20c246f2f3f9c77e35008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
414e5dfd3f13a3d0b0f157912ecbab43

SHA1
a7791da202f07476f062445b1147a6ab7a2a02f0

SHA256
78910891a2eedafff923698a06263d6990669985de62a0d635596355b9cee76d

SHA512
f77e34a5f562025816193742616d0f73ce9a6220ab01d58f12eb7815ad9d736e286ededcde076b366cac912426a050724800415a0f51218c0ebb9c935ac88761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
d8e1015b2382a70846d8c2219b37c43c

SHA1
d15a30dc49dba6a3db03c422769b24f6f2733e65

SHA256
ddc5c2b17da11dace822b0858610a560c11a3e5bf3c60e07c11241b256be5003

SHA512
ac7e821da0b189fce5f4ac2e3c419a1c3e9525503c4df3e29e94527e2070c18d3258aaca6d7d923e9f708165cc1143200d52bed69327f52159861ebf715f78d4

Download Submit