hxxp://itemsidguest[.]com

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2025, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://itemsidguest.com

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_2112006686\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_246543501\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_246543501\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_2112006686\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_246543501\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_2112006686\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871864608365209"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{A67C4195-14A5-4A68-BC79-44BA60D1EE35}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4248	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 5376	5676	msedge.exe	85
PID 5676 wrote to memory of 5376	5676	msedge.exe	85
PID 5676 wrote to memory of 3544	5676	msedge.exe	86
PID 5676 wrote to memory of 3544	5676	msedge.exe	86
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 3652	5676	msedge.exe	87
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88
PID 5676 wrote to memory of 4184	5676	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://itemsidguest.com
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffe7670f208,0x7ffe7670f214,0x7ffe7670f220
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1924,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2448,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2632,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4832,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3704,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3584,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6008,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5248,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3516,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6284,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4220,i,12177697031361625306,7117466760895222932,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
  2⤵
  PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1706191407\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5676_1810734327\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5676_2112006686\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5676_246543501\manifest.json

Filesize
118B

MD5
3eaf87405bb6f4c2f66a0fa1e4683d3f

SHA1
2ddb6e2e3bacf7bfc4c807dfc328dc30a003896a

SHA256
94623a5a71617638408e7cbeaa3c23bf109e3c7f787717a625f24f7377b732cb

SHA512
d35568778a0bc22b4dd254145debd1f202474145ff7a9c9c372ffc22466c2fbca32cc7ffc5d6781c3f86076fc9d5df28f7278dbe2e406d0364a06368c6fc8a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f55521b40c8014f36c3b858c2b6e6cc6

SHA1
8450a5bd2b06c46b9e163634e0964bd198a50283

SHA256
75b1f9288aeefadfc80656601483a8c9de98cce088d5cd8160a2e83ad7695c32

SHA512
f2bb92eb9ded93e1f1e16b603a832a1646278fdfd2d89d0aba6216bdc1c6c61e28eda2c6c79c3760d57a298c7606b4d6e5097200b4dad8cb063f75cc52d0c7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e697.TMP

Filesize
3KB

MD5
2be448697ceb9bb9e6d3b5d5e5efbd5b

SHA1
ac30bcd4128bdd6f07fe4474e363adf5285e174d

SHA256
1e41007c61e2f8f822236372a4df0ea4ddbda40d86e9c74021e23979ecc0c0e0

SHA512
f8b2b3c86ac830657fc05c8ec0be9a83bd46e3f6d4d94a6e81e09fa3078a22907d2d921c5e0a155526ad8ea9f47200780cbcfd5b4fb3e227e280249024c168e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
ed8f8dd211221a0f744348ef93733ef0

SHA1
1b977dcfd5f957e154aa34da894ac8bbea128b72

SHA256
d15066a442cef318966bd04e8df1cf882e14b9ce263347f97dc57484e34eb803

SHA512
47e6307aa2f93b640a7a726dc5173d0973d900c7fa5cec117fd05c80f4c605cac9e8c15d6b27ac11320dd83f064fa161262defc3f70955e80dadffdbc9a31e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b5969b8505bcbbff82a2d8191d3d36dd

SHA1
c310a1f01a9fe65ca8aff201ef98850b5b120b58

SHA256
2748744b73e85242bb53e7de79a477faf35d450bca57ede20e8a10c6e447955d

SHA512
84dd27134a6be81ca4cbba2cbdc7b7a8ed5d7c307eb9f6468a1032135d8bb0cc483e9c7e74643c9f9f84ad01db77bf2928d2dbfd7d21227f8b77acfb7a20054c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0b1559b300bc87a0c9d7ab37edce5189

SHA1
1fa19ec28ced6fab273d7e9de1760f753d8e2d8e

SHA256
5adb81c0ccd4fc9e13086be093386deebec3c8e22eb44480b4770c1d8926fab3

SHA512
691a9c8e4dd8ff2a230b1874b677455ec5fcc474aed90b5d21fb8b8d9b2c7cbf5a4c03dc5f160f79d2bc1f8c90be83e2c282efdba104dbdda5a2d82b339652b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b713f2ab9637e2a2727c0eab3fe927c2

SHA1
c4343dfc79c5a9f27ea281b372a440b05a5e9c0f

SHA256
9ff3a29044a410decb5592d2e9ab5c738d2217b86fc81bf7995df90e5f2f9766

SHA512
876b5d395d79cacf4b238b29eaf64b31f216043b62dfb0d1943b9cd749db09658356516199e2af04852863e65f77fa400284db90dad407390a2ea6eff2d2ada8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
da96c86a25e52ca98d2877d1752b56cd

SHA1
801ee1f4e018ba54539a4cd2b6121f7a5bfa9d48

SHA256
b5dc85c016e7e81855a97001b8a98ae9f72c58ef6064c3375b19981e767f6788

SHA512
64c57fea24b1dc4ce0afbf35beac4baa98912b9caf0f01e3846b942a104802cfbb75a4fa8a1e3e8e86405cd854f12d3e95dc91b23df2f8211168083190d013bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
7bd53bc0f40b7c35777c5985fc642fde

SHA1
4a1999f3f1299d635538ab608d3156ad2c23ebe2

SHA256
610248723b575d16d5e89a0d94dc4e256521077121c96668f4ae9644d7b5f008

SHA512
6fbdf588ba5bfe5d56ffd94f3592ae2a95f0318e20f66093a6c1c100e6ded72b15e71cbc4f5e0f819ffe4e7066e4840c8f6a8d2f21c04c30a843ba397298d9d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
178f3d509612d082b0be3454d22dc402

SHA1
1d8aa5a0cddffa4d25625787bba04d94b9498dc1

SHA256
83b0762bc52a86c5b4a27ff4ae0308419942a989ca8aa754e98e43ccc0c900b2

SHA512
a675be192a04929bfef920d5908558d6f3cd097666c04260c2f34e5330e38af8b55e96f5a07a6342f8bf9f56844d8d40bddc9b8b7b349439ad1ee37a13641e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
2ec7cbe72789d7cb43b8a5541401ae51

SHA1
253ea4a7e8a8d785e54ccbbea213566f46955213

SHA256
f4da46cb3a323e0829f9b3cdecf91ab3fcb5970f9d1300d088e1fd38922421bc

SHA512
f2b1de320857620880729aaf38ec323b6981b267692846522b4e902d33949ffb458dbf8bdd6d852c25e8f686044f70588e70fbd900b795d87fcb419698ae6e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
839a4c02d232dedc90d3d22785a60204

SHA1
b9c386ce990897ffdb4cde10eca025e62f8d2e06

SHA256
f0b0c0c8b6a81ac782fcd2f7edd6c6fd67d2aafd12b007f4a392996b3f6e4e50

SHA512
a70b69440919a9a86a0bffee2e5f4a018853b1ab35e8f3307bbf8eddb900b377f06a857d1282b4ea5d46cfb13d8a37ebb4d7ad8b3fbe78efe06c635dc9ba4ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
5ba2934b9e72cea991f32146bd6075fc

SHA1
d0c35816d4df02b2dba2999486113fe7990fa093

SHA256
56567d7a076d865708f55d6d64f7c34e41c92c63672f29e819d575da98d82d37

SHA512
71133da918fe9eb6f9f553319ac56e1d317fce9396d7d53e20bc67fcf0d4b4a82dde004c094db027cb87a273a71d1eb57bbc7906477534be74c9cf0b9c02b8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
4925f9e79b077f65cbd276c245635546

SHA1
cf821e1b6a0eb2475b3c50fe94a0661d18f8d91e

SHA256
c6b652f6508d7591be60de4a8fccbd06df36739b70b38b352951b8fa4089f1c5

SHA512
47cb72707e959569e9d50b465144c0d3f703f43a7947f5ed53f5e57d854b24a59ab3c758e54eb297bce26d2b900c980f3c8cbb94381021d098bbaef832843c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ca60ab7f5eea2ba305c59c654732b6ab

SHA1
35886c59c676ba5d83b013ba94c33bc79875653e

SHA256
a01d135624de82048e4919434c903fdf3a4209da1e41659ec55f0911b67e96ef

SHA512
9a68717e48f3056f07213fc128519e8c315cc5d88dcabbb377638e8302cea4864c8f7cbee163eed32336e75c06d3291fcfda59cd9d2878f172bf0e10588cbf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
9174daaa7896d236bfc53add9d9a77e5

SHA1
99f96fd913a830f5351aa2c8ecd2cd65a8fdee60

SHA256
e0afd05b728a1cb723586b6dc413e4b2ce9223bd8d07a44f2599879627046330

SHA512
3a30e14974b5218beb82d317c405eb46a4c0a25d93b9037c7c82b140249b450ee41fd751077eab4a978a97b5d005a1987291e0506a126d7a1caee2bd631717d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
1d9e9c798f361af8f36ad97dcd82188f

SHA1
63435e15dd51b477bf8fe35d0d009b2fedd83dd9

SHA256
b7eb57066392954d83ec010bac520dbd7d05d04a326bc0f770db0cfc681d4e5a

SHA512
2e0fcea147a88f687bc7b58304343bc446b58c4b08bd20aa6368665a075f69599fa6863d3a78be9a44c1e046c1221ec1b131bea98e9eb70a4aaae124915bc038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.22.1\typosquatting_list.pb

Filesize
638KB

MD5
1990075c3abcb86ed86f835866bc3530

SHA1
0a5ef83c48a1b313ae145d47fcef24ac9f903394

SHA256
436c76ecaac7055725852c8112888d6c161698525a56bd2b5ed47ee1c5b2a0ee

SHA512
27cd8b9b5ac90ea02f6dac0a75eacd966e59a5420d0628c942680f512b18138b53488616b8f38792d3c2d22cf94bd46f5fc22d09e4d1e9576c7b4d09ddcc36b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
e515b423bd7d923a7972f62ea8f53539

SHA1
bd344c6a0f3e88ff5b6534444fb6b81df720ef3f

SHA256
d4dccb0f259ae92928637935edc22c7f3f1119553bf9bf6e6ff9d0af900faa96

SHA512
643c02b8eb4b1d4db118e4c962acd10d7d6cf86810b993dab73d6c533a1711fece6baf553fffb7457986a05820131d4b1362f7ce1062924907e7a2897dc4446c

Download Submit
memory/4248-323-0x0000023DD2AB0000-0x0000023DD2AB1000-memory.dmp

Filesize
4KB

Download
memory/4248-324-0x0000023DD2BC0000-0x0000023DD2BC1000-memory.dmp

Filesize
4KB

Download
memory/4248-322-0x0000023DD2AB0000-0x0000023DD2AB1000-memory.dmp

Filesize
4KB

Download
memory/4248-320-0x0000023DD2A80000-0x0000023DD2A81000-memory.dmp

Filesize
4KB

Download
memory/4248-304-0x0000023DCA740000-0x0000023DCA750000-memory.dmp

Filesize
64KB

Download
memory/4248-288-0x0000023DCA640000-0x0000023DCA650000-memory.dmp

Filesize
64KB

Download