hxxps://rb[.]gy/03c236

Analysis

max time kernel
144s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
21/03/2025, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/03c236

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_317388699\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_2140561257\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_2140561257\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_317388699\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_317388699\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_317388699\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_317388699\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_2140561257\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_2140561257\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1939510262\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1939510262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_390749169\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_2140561257\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1939510262\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_390749169\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_390749169\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870374319488105"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-780313508-644878201-565826771-1000\{E9EE81E8-0981-46D2-9919-D82825D8D516}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 2892	5960	msedge.exe	81
PID 5960 wrote to memory of 2892	5960	msedge.exe	81
PID 5960 wrote to memory of 2924	5960	msedge.exe	82
PID 5960 wrote to memory of 2924	5960	msedge.exe	82
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 2632	5960	msedge.exe	83
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84
PID 5960 wrote to memory of 1088	5960	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rb.gy/03c236
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x278,0x7fff4911f208,0x7fff4911f214,0x7fff4911f220
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1420,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2276,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2432,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3400,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4936,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5220,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5400,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6304,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6544,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6544,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6560,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6416,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7036,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,10092259916599342968,13362972657449123464,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aa9afd16e8041e8c80250b50ea6899e4

SHA1
a3a698d431952253255c343f2b35f74e73e63088

SHA256
2bd7f856d73f78bc3a4de32b447b21babad42c009b19fcebe2f8cdeca2380926

SHA512
344de0888df8851d957ca6fab055eb9e2f1aa6d958022c2c30442cd6aad4d158d0a99f8908184abc60fb1e0ccdd3d9395d8c0d37fc317d3700974c3348d4a5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
38faaa3f033d522525d3d4589d00863a

SHA1
1b9feb007c1da14e7430a90144a49739fc16fdbd

SHA256
6e5fb833f1265bcb458cefb2ff2c6ab301b71d0a828c5710116ea282df9d8d67

SHA512
0f3b8a1d7fad4081d60d044ab0c3bc002c8f090853f8a40f1b7844220f429a5216020d17346909f4ceec3c3d4bef9e491b335a799b413b38953c49692e5d823e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58338e.TMP

Filesize
2KB

MD5
777320ce68f41b97ddeed36584a848bd

SHA1
ec8d0a5e0be3b57ce4d47d24ef1c890506fdb794

SHA256
3a9e64d80cbf3cb40481b40defba1ff61b1452a275057ae495b7983e485c547a

SHA512
ed24bd9c113fda4b11720e51bf4dffee1c787bcf80c21b92d2615d58b4d080552465598d65e555547a6d8a2d1c01ecbcda0c18c80ef528422a565a316909e6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1390c066-7e4b-49bf-b617-11974dd9a128.tmp

Filesize
7KB

MD5
ccb6139ca85ca6c8adb4adbba90f7575

SHA1
e69ff43f8ad2da8f387f4f18b2d2d4a43282a290

SHA256
2b6ae9b95fb3bc24d995f19fcaa405123fa163576e3f7c108ffbee0504de05c1

SHA512
e96d28ab4dcc7a8db200dcee02a9e608b101fe40fec1709adda691c3384f39e2c13edac7837fa5b0d4d96953b4e62de56cf1b7c1f7af9d99c7cf7a3d7909c7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6952874563ec232d012ccd72e58468f6

SHA1
72ff9246bc32d12735ba0a9013bf2d3653d0b0fe

SHA256
761ab00104e7cb406b6b374a9d729df3f485970a4562e3c553443a661331a2e4

SHA512
0c62ba69d6d94859ea61a3cca8edae313a7d641f6ed16d742bf702dcff7a987f313d6708b673ee74f98feeb86b56e7a1b9df4ca9ecefc6272b02d7e241d8a2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
558cb63669f5c3b13287fb7fa40d9110

SHA1
4a886e170f0df2c074d92c781dc83661d63801d5

SHA256
23a9ed5171714f201bfff6490c842e95ffd9ae4c6f5e5c531b83d81b4dfc7f7d

SHA512
a4d3437e39e60e950d145840402c7e37a3c26753b53ffc4e3eda986d28657111738081f776cedf34e6ee13323df29846298cc7902f585aa38caae5ac92b9b81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
2fa9bf64f543e76e6af5b09d88196460

SHA1
c192d060813f5f5d11c4d5c09f228b48ad373aaa

SHA256
26d739d84577265dd8ef22090121f070ad821b4c10579a0cd3d6f52daf97c86a

SHA512
a49d24e6dacbcae32c4d9f103ca4be99d6b11acb5db61cb8b8b2fe59a8049d0a301e11131a5037da75cf841527a1663f1e51b59fe34a86af893a74c9838ed57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4ef3564b4792d91990e3ab2667320129

SHA1
8cf3a76d2547b01cde44f1f8eccdb2ea36a5a452

SHA256
f31308cb9f287839715c2d1687d2d25ef9147ad055c38d2bae630573899e0a53

SHA512
d62933ad59cd6e3ca008c28e14f4cf6294f536937e0ab2368cedf6afd9ebcb62f19e09f1766776ca806cab9cd1b766a6339ecfd0b758e5f2c382e343797ac2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581ad6.TMP

Filesize
48B

MD5
035e14cd9eb96660fd91f691fac4c4d2

SHA1
9f334b2fb1c122ad3bc31a78ca759fce1b50a1f3

SHA256
bd06b3f5e7442c4ce0b0f3920754ab24c20422c5c66d695741bc7853e1f5300f

SHA512
f2644fd1082a3f68bf63cf3968de163546281639c633af53fe01e59cb317cfa7a9e54801b786b2b127e8fb6817bb3d8fd15e3fc6c4d29ceccda480c2585d29ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
cf868c7b8a96a26aee43ab12cc6472cb

SHA1
b147849f40ad22e420d112d255d29ee624ff2d05

SHA256
aa47cd78610f98c482e4f1430f6d555adde85bf9bf3a2ace9e000df35697354b

SHA512
18f49dd06b2265c0750154ac4a0da00269af7851b783939646e4b9d1c70947ed85315313bd556fbdee53eeef2711ad115ce193867df61b103e99901b311e482d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\02ad2abb-236f-4610-bf0e-1e4724df843a.tmp

Filesize
904B

MD5
ed9651b3cc2d91f0a2903b25cc783868

SHA1
b43290e59f0659ab7947a17aef741529cedd8196

SHA256
1af55539e24c04f802074270af9fdbfa120f65b6e00172c6e48d56a3303da350

SHA512
2d3ae1d6a15ffc71bba337705a043088c9989bd4d778f5244972c89ed20291ba2abf41ffa16e5a91aedf4085448028a41f7aa09c19db8dd27ff0d1ca34935677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
cd584276b16bb9d1b92a55a36d9768f9

SHA1
cadfec9967e72dc45592f7b1e8e783c0d61af84e

SHA256
d19f14612dfd192441810b7a32a8aabccea8cc33de7b66d8ab1007ac514d64d9

SHA512
3aa8cb7a79322ccb6226187a42c061e969cd91ff96746620bb10af156cd35c0a3b5512fc7b346c37f808815b968ffd9851c313b133a182a2fd383b974f30d65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
ff506dfc4f6ee3224dedd0f138c5b6a7

SHA1
b570b0e1dfe1c29d8e969bc4e4cc297586f6c8e1

SHA256
0cdc8c89c1ba0aa6c1601b76f28b76eb2a2d8f2621db80445447511d496b4fcf

SHA512
8bf404756f9cef787823a1c20d405a4913d0ba0a6be84f41650f68f1514cf5c253cb46e9d7417261238354fdf94a8c519163c0cae75359ccc53a0c4897e5bd3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6400d27b385fd0518436641f85abfbc3

SHA1
aa858b96d47b9a5a9a5ac63994d9e997cc03a2da

SHA256
808e480d3b6ae3c997e702075edbd1893140aa87ac0266f8ac5ecb9aa30ce16b

SHA512
0d3c1dfcc4c608b01daeded93c4fbdf495acec7ae940de1f87ea9099f0477104fc68c6587e603410fcebe279ef001adc03e5b90134dab9e1800c20436d77d894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
6fe109cc8f1a10a7106b06e8568a480b

SHA1
36f026a79527f59564f2084a99926b05d30beec9

SHA256
5d75f69d35d19ce093df803f73c2c45a2fe01855da7823d0c56beb63b9cba3e4

SHA512
43af37000163cb80a0b127f5ce53228c9e562edd4b5ef011328a472a965db27a3b6f18b5a77a5e81e8634ca41639f4da4692584b219f49c2ee278ebbd8444fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
ca73d053241a5a869a14f1abb94976e5

SHA1
c11d3f9f881f4df661d52c9e3229e9417e02ab89

SHA256
5d35a599e902bfdf8d74266cdd428ee859d8ea0c548d8802776cc77e24e3932e

SHA512
3f63a9edac05e5a3b92dcf85c7464105578569610bc95c18c9054bc20b56c54ab5cb96f711af3841daa76dab6854129546a73dcde95c7c1ae531d5af0e0a7a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
4ba339e20d3effe802ae6402791c3f90

SHA1
1c8d91228c2bb5cdc5047708c67c22b7e3514f56

SHA256
85c52faf4a733c104995a85095d3ef085d152f08042b6b8ddcb378cabcda32ec

SHA512
320eba695f0e91075fcb0167e237a6e6402f0b7f336e08f3e4f5342a1af7fb1f998dc9fa7a50485e88037b8158ce17b82e2e079e8127b6e039c5d95a7a425702

Download Submit