7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e624f48a849ad8a70e09f6d4e75f02b.exe
Size

78KB
MD5

3e624f48a849ad8a70e09f6d4e75f02b
SHA1

bafda32b69d0f3f342d1d404b82825f4593215de
SHA256

fb792ce78c7eee26dfb39a9394a2993a3799b896f66ee903f4ebfd75580828a9
SHA512

f95f9f0879127ae691e41eb1bea3a84bbeb8453cec57a21394fc37a96f74149a14a588cdec7a8775d70628a8e7828dc94f84f68fa3ebb88909c0b86245c9ad8c
SSDEEP

1536:6Njum7Ynydw8KwHpF73i6EBXlLOUpGO7VHKgFtJjTD0K3gI4:6Njum0ydDKqX0LOUpjZbttTDiI

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870977250811875"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{DE8E4662-1383-4FFD-908E-0FAA3B6FCEF3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2768	2636	3e624f48a849ad8a70e09f6d4e75f02b.exe	90
PID 2636 wrote to memory of 2768	2636	3e624f48a849ad8a70e09f6d4e75f02b.exe	90
PID 2768 wrote to memory of 5300	2768	msedge.exe	91
PID 2768 wrote to memory of 5300	2768	msedge.exe	91
PID 2768 wrote to memory of 4800	2768	msedge.exe	92
PID 2768 wrote to memory of 4800	2768	msedge.exe	92
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4836	2768	msedge.exe	93
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94
PID 2768 wrote to memory of 4968	2768	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\3e624f48a849ad8a70e09f6d4e75f02b.exe
"C:\Users\Admin\AppData\Local\Temp\3e624f48a849ad8a70e09f6d4e75f02b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3e624f48a849ad8a70e09f6d4e75f02b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2e4,0x7ff9af46f208,0x7ff9af46f214,0x7ff9af46f220
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2244,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4820,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3640,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6316,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6016,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,9604013284047558605,17370150158695911983,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:8
    3⤵
    PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3e624f48a849ad8a70e09f6d4e75f02b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2768_496905896\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2768_770532058\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ba022efcd42b471bafabb32b866277fa

SHA1
020f48eac060ec17a9aa479b1f9d9a7b06637ef8

SHA256
3a2e4b5c7de655592b7fdf929a25a138632336036ebce5f79ceeca7f7a7424f5

SHA512
f4fb9339da7aaae65a7ef494699df9e0d9032873f9e1115daf0675f2fc272d0c063412e3308175769f29ac32d3f5fe025821274c1e82e6559a8b3075e5e23722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58170d.TMP

Filesize
3KB

MD5
ba61f23754219f986dcc9d94ca46f86f

SHA1
9aa558a4d65ba33f42f6acabcad5a953993d3b1b

SHA256
8d266a3ac96dab604eeafc09ad2a1324fa2a9fe2047287afc47704f4319d0df2

SHA512
314a2f2995daf3622c5cfaabeacb55af717fccaa75af37dad5659fbbb72b2dbdcc99b29f7df4298c3d0ed17a2e5dadff184ffed20e66b6d08d8540dee6e44245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
072e741899a624170f78954a7c82d375

SHA1
9823b03c647787916cb980d4bc5b4e5a23399603

SHA256
f587c76adf01c994175b19b06a26f1c2dac78bd3e543906a518a727258ee2a52

SHA512
3102571b36b60b02894b94af35be69c7387f364d2787a9af5e7829c34f7e1b26bd0f108cb77eca5891046634574ea8b390ca62229c78bb8a6782d14a52447b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ea4d904ce5a785753910661b5733d0a3

SHA1
f1a11b5e2a71207bf5cf6baa87a49927cebdf7c7

SHA256
ecc07c5f819256ed6dc0b202b9c2980bff6dfbd02e0c0f3409bb4f6f9235e94d

SHA512
41ab4f3cc61f005c93a5e38bd0dae26669d013d148ba0e42f39bb7cf2447e19e6d6a2bbc4a4db2cbf2d5e4b256dc4ac1fab2ac1ab0033913eb70f6709e77b526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
c94bbe3abcb01f09537b45d53c6ac948

SHA1
6d7948a0163a30d21e9b1743f9d954d43ce62640

SHA256
6bb6d33b447093c6a4336b45c9c6c2beb32a0fe7b66bc28ce750d8380672fcc3

SHA512
79e48e28f773fe427c19a83a241a6cc614087ad2ccf451d52b88fe6f2889693cf0fc1055b089d8bd38d8a5c9a43acdfbdab05ed693967b89e041fbb833d82eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
27bf716d974f04203f6bb09df4e55ce9

SHA1
afaf25ad37e5b35c6d5fcbd6ca8a735963456e1c

SHA256
05c15d81f9c74b6ebc9558a3ccbc82a95f58e0fff00f54b5a9fb0b3530065749

SHA512
a2ee805d6ede30115ca7c12cce078083be7e4dc10adcd7d8c67825c79593a2a1e3adb8264229aa5598468cff9de424e3b15eb71cbbcf4929c64f1c4cdfe007a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
6a19f51bdad49e47889f225ca3d4f8bc

SHA1
ebd92e5b37cc88140af07a0fa6d440afcaa1bfc7

SHA256
6c75723ef69ec79a56c7df4f8ef0f31de727c854f3f6ea021a4efa2aa2033470

SHA512
63abebbf30b35747b23d466ac99ca620d6653093c2259063f908cc4a435dbe297df13b9fb2dfdef7097fbaa78dc3e8b6082065ba862d3ab569cf319bcfc42798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
cc7d5ab53089b40c68a2d2287354079e

SHA1
a824194812532a1d2d9c8a027254668774e8695b

SHA256
b3a560b2581029fece7d9a945c254b18c073efc10759d7df67381977d720e59f

SHA512
b45dbb8111f8aa269425e6275a7724200404f9387f36d76e221be49591503577a2a16eb8939f09c664f57c38340c54077bac81f1acad79d2ce0dfdf2f55067e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e5dd511-5101-4c57-bacf-dc72ea979650.tmp

Filesize
467B

MD5
52fcef057fc82dcd908c2bb9439eef46

SHA1
e89086caed845806600ff81b93d9bd07cacc2d6f

SHA256
99410515a2434042f62ede1b3a1a4c3196cd1cb53fec640255e1e5721a28538b

SHA512
d877de71ba12db60f4cba5b11a7541c46e2bf4f81cd1c6242c3315807b42b63a61ded84761a6af0974221f2c5baf6a1160998e1bd85ca38993659724ebfbb599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
07b00865746d8ca32da032de81455ea1

SHA1
a09d86e4ccbfea768673d9b79acc13b4bc33178c

SHA256
c9c015edc1e0bfa1b33e443c67c8f875554d11238a7b7b9ce30848858555b22d

SHA512
40a3052d74fc5b59f9834851c748182296b8ca9ee002647dd7ce98d4b087cb9d9c43f19e3d06764bd479fcbe80e82af4fc217a7d2e3b1ba81ee0a051d5e53c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
7f32127b4b4f1555512e0adcc68f5e0a

SHA1
c90f47ed877bf75eba72106cd6fae564b3493ea4

SHA256
3e77df22dace855fca5ae6ebcdd747b54f0bf90cd9ab6688bd524e8a71de34ac

SHA512
27daa9f55eb0a78e55a643275fd3e55bcc874ed02040a260f8310cabcad44d593eece781483d81269ef3c73efbb61b261f0900c722f80ee84648f1d7ed9d6280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
47cea3aa9a4dfd1c84ddc279fb134b3b

SHA1
d6e7b6583ed9d405cb81937b79207675291fdfef

SHA256
4d773e1c7f0a27254e358b12aee8d13bceed0f060349e73af4f191428fd38c90

SHA512
603f14b3561cda5b4b366bcff92597a83ebc0bf4c5bfb428b222b5395682a10c2d8dfc1529d8e29e2565d1d30059a55e91f84ab2070fdc8d82416bec69f94106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
51b5d991f5a83aeba9568ae2507dbc19

SHA1
a39ce8a8fec9651c312c79aac1168c018e5d7b2e

SHA256
cdb66e8da8edf4b25fdfa470fcf7c227ab857ad66722d99a4278da4e2e78cbdf

SHA512
eb30848abf9aa6199b6fcf984bb8b148ef39458e7a6dbc3f6184e69fea6cede738a5019f5f4174515da60710e0b146a270befd45c45d314346de5a454a6261b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
7fac85d89e940d4bcbcf1c977e8c9a08

SHA1
642ca4fd51c3f38cff442c10fb5b66295ef0f619

SHA256
d7838c2000f4e783d180ea85d2e048078ab41e5d04229218c08d4df609db29c2

SHA512
d261e541d327b1a20c1f5a38dbd5a03f26cf3ce13cb2a9ccb65af04e6215e5eaf73b8f3bf00576bf33eb2a6a54374fb520365136c2433f9c129b398419e52bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
4d5ec855bf336a6c3d26b5f54261159f

SHA1
29da633799aeb3d14f92a667b26d760accecade5

SHA256
5ee6dc258746abeed5cb3eb9b4a80866128de7df2fa2d57022365d151b827b04

SHA512
9a167465dd2de396b6ad62bf925072d99e72e49b0e6845e6207f5f93322cec0c1dee92469b2545a68aa522f8ddd7e6f491fb3f68bdaa0857e602c3403db9ccd5

Download Submit