c348540e9281c92b3a1994bb343611bf271820cec4a8dde444ae5f60c062be0c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
27/03/2025, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source.url
Size

115B
MD5

2b45bd80d269fd181816573d97a00460
SHA1

dca505fc36abdd7bd6ca07ff4f9132491b09c198
SHA256

64bbc55cbf85d92016024beb5a594cbae42a1cf3a24d84eb2ddd260af5722b0c
SHA512

9db858aebb8bf202ce277ad271d5326cab5e53cd4003774774a2eac820ba8107c2c9e8e5b2e422f805dcde90dfc9698e715b0a4f65a6fe0027817cb29c00c530

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_980512290\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_980512290\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1320_1793161201\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2068514557\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2068514557\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1902544876\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2132419813\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1902544876\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2132419813\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_980512290\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2132419813\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1902544876\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1765196511\_locales\sk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875703389402735"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{6085AF93-EA0B-4AA1-BD15-DDE8F93DE409}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 1320	5648	rundll32.exe	84
PID 5648 wrote to memory of 1320	5648	rundll32.exe	84
PID 1320 wrote to memory of 736	1320	msedge.exe	86
PID 1320 wrote to memory of 736	1320	msedge.exe	86
PID 1320 wrote to memory of 4688	1320	msedge.exe	88
PID 1320 wrote to memory of 4688	1320	msedge.exe	88
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 4596	1320	msedge.exe	90
PID 1320 wrote to memory of 4596	1320	msedge.exe	90
PID 1320 wrote to memory of 5384	1320	msedge.exe	91
PID 1320 wrote to memory of 5384	1320	msedge.exe	91
PID 1320 wrote to memory of 4712	1320	msedge.exe	92
PID 1320 wrote to memory of 4712	1320	msedge.exe	92
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 3600	1320	msedge.exe	89
PID 1320 wrote to memory of 4596	1320	msedge.exe	90

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\source.url
1⤵
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vsthemes.org/
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc5606f208,0x7ffc5606f214,0x7ffc5606f220
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:3
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3224,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:2
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2052,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3116,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3108,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5032,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4852,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6080,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5208,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6368,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6216,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3056,i,12766830359090624539,1394217289558460530,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7da492a02c29529dc0ca538b502e3379

SHA1
cee6a1b81936f6a20f1c9c4f35c29394338ff54b

SHA256
553164a83cb91c4905a86373c61bd899bc1007e7719791878bb95290f1f27f36

SHA512
3a1aaff3da507ce35c4e06ff9fd2516c65780849b24fab33417da2e799e20bda3594e5f2f32b1326dd1d3da560c76dbff1f626c147e99c7a990fe09ab0a2e89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
623602bfb2668822ace1456a0f015731

SHA1
5db2c56b309e97dd75b9c9a4f8f389ec3e9a9ea5

SHA256
06616fcdcc83729c35ead71c979221efe8ce3ff13b4ca90ae2638ef0f8cf2dba

SHA512
a15635e20cc98bdedf452f89a58a22bc5bc0584784564c2ac1eac2c7dbc4b3aa98c3925990c16438a6dba427f3a52fa820fa7675529b01f022778d68799952c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57bdc2.TMP

Filesize
3KB

MD5
de11f8e1d0b3b91fd793296d4976ce5a

SHA1
e2b80c0b83358081ca2c42a33a501390632df627

SHA256
7b389238885da91895878a35876c7829f158da570badaafb57e77dad39b60477

SHA512
7afc21537f07650bc10cad4700bace62715e1139829c3eed3fa4ecce06991514d9af650433ca299b5ebc0325c1c0eee7d48cfe70b88887e84d56e956bae4b943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
bd2360aafaf2e9f64ae3fe5dbb447a6b

SHA1
8a9074647ba7e876f4d6051d6dfbd6e4c64291f1

SHA256
a7b3ea8a38073e5bcfe23232666d1d0b1ec6ff3e751cb397cdcdb710e82bc3f0

SHA512
8b157823795d7130d81ce8ab72c55af2ea44d5d05543b44a86abf7920c39b51a94d72a477aae9eb8b3484bfc84cf578ebd1154b6b962737633d68112e1413bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
ea4bada5c70a9d1cf2598a23e45103c7

SHA1
255024b23c838a29b484d3e968bb86996dd31517

SHA256
3f6dccd31fd7a14f8f34b6b852a113c528f192867846410ae04f6e5c26387e2a

SHA512
7fbaeaf4ec3253e8bd6a430e03c6814a05bd202f2e9857e223b0b296a70537bde203b9262db496c92ad4d1c298066938137020dc706b115694728d8d9486f420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
6c52286712cf8e740c4f8236f30c4dc9

SHA1
538f0c8289358493b6284d7002029f90e5196dbc

SHA256
6af8ecb72ce075a21744ed1eefbcab2ed3c6e3f8619824cd42896691d65998af

SHA512
1ef0cb450a8c190068ffdbec761e9dbeb8f3e10c41e3bb0aa157eb19f5cec835f49f085f9f5e4ca209c96effcbd4bea02d80cd14d15ed7cbe86a38476a6435b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a800ceadeffc3dbd734dac04e61e7b72

SHA1
1064de134ce44c50a39fc13e7e3e239585a3e5af

SHA256
9cc4363ceefeff9c965ca0215b1d1855c9fd1c3d65cbc2f75996bae0d0be14d0

SHA512
85118db89b8fd00441b0ace684f0fe4861b5e8b1f7cd74228f879b3ae956bb5a88250d8610178ab02bbd1f066661709a4bb94ae4baa1be2db4f2e40fcbf75d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b0e3f7a427c27d2fc2502604bcbde6b2

SHA1
b76c73b2e28f81f49968a75d7ac746aa99b13f50

SHA256
4fe2d2e9b4e39aeeb249556e1ed4136f160873fe3b0e97d4de08ef8bf03db3d3

SHA512
655302469e11daefbb1623ccea045a70520ba8928b89c51fb3f170e232f223f9b34e1b4d91686b1fe57dfcde6dc42005100614fe3ff5b26d0528cb8b04cb709a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
1a64cd4e690609b72ab8f6db13ae32d7

SHA1
bf4c126ab60f6ed37fa478f25c46398e314501df

SHA256
8856fe3a4d7bc221c20f91600361bb3e5fb0488cb909e523c8157c81af245e16

SHA512
0d0565b6451c404832a00f6480eddc535b269680d6eb1ee18dd2ba97cfdc780a9caddccaca1e1011c029943b80ce79b499c4a0ee75dac059561e9ebf0be826f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
1a08de190289d0c99a997add8b852185

SHA1
c29b4fad8ae940ad079cbd7060866839f3028ac8

SHA256
24d98ebe4fc9210ae8bd59ed54470e5730854d66b654b7c30bc271c91910dad3

SHA512
30acd7c6957b9e186be6d8eb337324d0511061367ba3bc5221a75f0327ada7f3839f15af5e104a7e6173f8ac6376bcb7e70ae29c667cdb98393de04813119a50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
b368a30f58c4d3e7380e5ed2e729d73f

SHA1
5e259072fedad7e7ff864e2e4761e0bc02385855

SHA256
ad4ff6f39ef442776318739b7076f5d0860c0e38d20aa29f94fc639f40d7f75c

SHA512
5ca122d1ce27713687efe8f4a49919411a9992dd186562c504bd969896263e1e496fd2789b756923ad7f1af9ca983bcb918de96aae2024020e482d8d1416405f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f7d806a3da9d625aa28db04d1a2c032b

SHA1
81d11dd256880520f504b722d6019cb06fe8636e

SHA256
aba386b271da6e1de5cc0fad69685837aea8e240a44c19c93f795e26dc9d68a2

SHA512
a15b5c2dcf5762c9f51ff3cd89b1f3b99d7f63d57478d9eb183caf72cce72aa2a85a06a68703ebe42409253f71c7577cd2da9750a7f6c3b61478d275a1361258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5058eddbf9d55c9669e193efb69f1dd2

SHA1
503f367483a553215a65ac0cad3ec02774e81655

SHA256
aafc3295bc7d2c1a759aeedff5dad47423ea99a3374de040bc5adc6342dad15b

SHA512
e590f0be18a5ee8765c888d1802467f84bf35e957a1283273ae449e4b23211017a6a4ca1c7d8809178309c3612a1a78aeb54caa9ba973582856a95ae62b14cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
4875b1df4bf91a1a0945753217154cdf

SHA1
284992ab7fa7289bced60c0362a81d8f294c9ec4

SHA256
98fa07b8b6809286892cd4027f1fd17a582e157056bd06695a77246b4ebd5d8c

SHA512
bd4b2f337624ed6b72ee5493971c3f46fe415738816dc121634fbabc4727050d7acbdbab355a0ee09161c7ee487d1e76329dda672085abb11af23baf79d460b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
448e8d12cafe8c8a277e9b4ba1220907

SHA1
c6fe6539e07c349e0345eb0bdb74e7564f7b8e30

SHA256
b29da23aced7a5fcff9713b29dc2dbb6a6de632fb537a14be8189cb2df57b466

SHA512
34af95b7366e4f397635adbbeb96fce22b3df4ecd42993e819cdf894cdc0a924cc31d5e8ceb67d5b2c1830d2aca1a28bf3b9a57b42ec893793c75182d8b15b16

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_2068514557\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit