hxxps://rb[.]gy/03c236

Analysis

max time kernel
130s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
21/03/2025, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/03c236

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_182521944\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_182521944\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_182521944\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870374281579429"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{BA950682-AFAA-4809-88C2-AB302E5302A6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1640	2072	msedge.exe	78
PID 2072 wrote to memory of 1640	2072	msedge.exe	78
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 5536	2072	msedge.exe	79
PID 2072 wrote to memory of 5536	2072	msedge.exe	79
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 3952	2072	msedge.exe	80
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82
PID 2072 wrote to memory of 4448	2072	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rb.gy/03c236
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffdb138f208,0x7ffdb138f214,0x7ffdb138f220
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1400,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4704,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3388,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5132,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5236,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5496,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6584,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5440,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6784,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6900,i,15162237975831358454,3542165492732026422,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
  2⤵
  PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a2a6ca86584f6ed4fa5fdd3409e81544

SHA1
9dd9e94b4a7c9cd218b140b7b668a64013f1c4b2

SHA256
ba31f24d5625a9fbc1338ce7a23fca1a5d46315884fbe4324202fb67016c315b

SHA512
dd0ad419924a62b91afb410bec6e1dad4c30d3f067417f76472b6aad86348b18820333326d590b3046e8dbd59e98d8d0a0f41129d5e8d24ab13deb0b96087eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
0db0baebf11e9b9214fd0e11c09c395a

SHA1
ae946e14b6a107504e9132ceb22f167856e95410

SHA256
4fd480277fdab298f1f35d90ad0547a8ca33ecb21b6f4057081a358de56e6100

SHA512
323296652f96b6ae8d14dd61b90af9e43b054562ed4af22ee3be94e5200fd2256be93cc70bae3cbc4fbcc3fc2a052c6bd757ab1a2aad36ecb37a4d6dfe08080f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
568711f5216c4f8c2c9562eddedcb5b7

SHA1
1b566734b4534d878af161f8b3fbcca31b60416f

SHA256
fe4fa6ee454324fe8c93d6c780523abab5d2829a9917c1426536266fc050f909

SHA512
26bac443bf592728fe850d04e9856441c8fc4c76c66558aab7519840b4d1611bf9f43a88ba5a461507b8f7a0eea5be6e119d943227fe0116d85b1fb20422790a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
bcf2abe8f8f4d3d4e8944b84f1371a42

SHA1
8c8b985c4aa0dc779fbe77adb7775f54d5632c9d

SHA256
a2805f2c17a8889bcfa442a12270cd9afba8890caf2a612dcf79347fa6eb6f7e

SHA512
19d364e7432f6f24b6af47575903669d6e2859a78d9fef42f9cc183b0fed08f28869f123e72549e626959307adc1b2206ea9c71011200edad5c220a1d5bbf6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
bb84873e06ffc4032475a57d32e03e8a

SHA1
9ee2cacb1d8deb687f8adfa068f538abc9f76d12

SHA256
78cb09f8edbdf77d6d0e57e18a0de13d8b89811b20451c1b33aec825b89eb93d

SHA512
506fe5ffb1ad885f8ba713f85b562887047f237a538b8583eea552da252a67f8b6780f08d076f32d07e1ce7b8fd4e5ae22fa97d6c75427117edaa0aa032a2f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4856fe4187e9018086c3d4c10310fb67

SHA1
f5ef486e06b39b9a459b5062e10a6752878dafd7

SHA256
fbfad6a469198df0c4a077d92936965eb0c556cf04fcd319cb487a7fb74dae19

SHA512
fc7c4cc0d71e1be84bfd02af3395054fbc0e1881778fa1c85c1a6f11035508f0a7d6e8a4cd366414251515ddc38235504d9bbe02e11248d492a1d033d0355289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d263.TMP

Filesize
48B

MD5
686ac167d6a084f6da5f6ec8519d0085

SHA1
ad9b6dd461a5908827b8a6407af56dca8ef4a9bb

SHA256
662e4020e8f6cc6d82db82fcd2429acdb1d5c40785a2a7748d92af5b1a964379

SHA512
26206037b66016fad29305342a37cf4c4d2cd69edc3615edd2eec270a5c00a429e5d360400a397b1a440ae0391d651605acb899ec9f1d588b601b5316e6addb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
f9c7f8c6e49de3c79a4d6a5659ee9e4b

SHA1
4ab8ea85321cd72197552192440d41de6cb1e8d8

SHA256
319ff8167cf08df21ac24a08d13dfd4fec3d380db660f8a168ca48280cd7d955

SHA512
ba90c8903d322c529bbd1008c4b5090abd7b468ac08acf1a34837feacc9431b8afd5b2a764c062a49d7d5af71fb5b40a5b1bfe2eb3bcf8c0894c678df4d079a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
80cd050dff0a91caaf2780c55a43b280

SHA1
697aaf1348039f4c9ea680b37fadd3ea638c13e8

SHA256
3744e42b15b2df1bfc959efd45b7a7f5ec10f0f649f87926d2ec22818e9e7ceb

SHA512
e23265549d59d4274f4c46b953ac3feb867c455c6224829fda94060fc299f2a1e895fd30271a5a8695e7ff39d5cf957fd8a7fe9145ac8b937075f87f8009bb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
1b62c025e2dffee698089e98eadb18f3

SHA1
9e5e3f0d0daac647732c63c087d0e4992d596115

SHA256
04251731389116e21dcb9f88ae01318aa53f7ce8fc704984b4fc3ba2995898cb

SHA512
35f3f16ea6af5c7d04232656d58f9306b31f2b8370c1dc052d858ced46c7fdd2c0a107652e945b9a69996c013b4eb7ee1c385bb9defc3e28ae4a8bcf6bf242d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
96599a05866111907b9bcd5bc9be5964

SHA1
e6413d6464b7edca534950f310411d7771892fba

SHA256
5cf769fdb40caf3fe0f4c7ce470f608dd29d8deae7291fbda69c9e29b36da6cc

SHA512
64cc8b83b9e9a59719ca5e62260079b5b00fbe4470cb4652b832fcdbf19ff54d2a8439aee7cfb782df7673875d4b687b3150b33db5827fb9b2eac8aaebbcf366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
09a6e06269b0891b6da4e2e57e04c705

SHA1
9e36032a158f0d0bd673506c32242dec9dcffca7

SHA256
fdc532ddcac12bc00eb1dcb38f3510daf68d2b17280d6e8a61fc6f3c57ab7963

SHA512
32c6fbcccbdcddbdb7bb4d84bec0793eed60186cbfdac9469ee6fb9c109f1bbdfa783818713b0e65ef207fbf5dc820ab350f552c001640fa23ff9ced9c218ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
3f80511799613e397181bb04c8b49b5f

SHA1
306299fcd220db003e6b267ce63b0b792b72dcc5

SHA256
a4bfaed2de5589fa3a4100580a452e0b3b0d90333d4b65a8aa29414cc4cfe308

SHA512
5b120bddfb41dc90f85698bdf1ae2c261cfedfb24a20f7905f758e43445486bca70f98e30ac39254c3d449663db6184af7ba8a376a53cc4f403f19d639333134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
1cdd5d5cb132b8976f203cb1a01c1072

SHA1
a089429c2b16b82413c6a486ae0bde04266552e4

SHA256
7eb005a4360c4f56237ebfddf7dfaff9b5e23d25baaff40fa74e5fea4f6e3e90

SHA512
a7c5333c89df7f4f424b9e71993d95349e286673bdde8268a135a035c0b3201a3d9d3703d7bb3e49c9755ae9299e3760424af880e851a52a276ccbdc6ffd8112

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1218127300\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_182521944\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit