ae56b160203721d6920ba3ab7224fecb24ee6ba0857559a7867e05cdc364ae05

Resubmissions

28/03/2025, 02:18

250328-crhdbssqz4 8

28/03/2025, 01:45

250328-b6dg9az1bx 8

Analysis

max time kernel
145s
max time network
158s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.8MB
MD5

2675b30d524b6c79b6cee41af86fc619
SHA1

407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256

6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512

3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP

24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1106281742\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1499743723\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1499743723\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1934855014\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_556396010\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1499743723\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_2061752233\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1934855014\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_556396010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_556396010\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1499743723\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1934855014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1499743723\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_2061752233\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1106281742\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1106281742\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_1106281742\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876020717957562"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3174447216-2582055397-1659630574-1000\{BFCE1999-AE83-4D89-B8B0-35C7B7350AB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 780	3936	msedge.exe	81
PID 3936 wrote to memory of 780	3936	msedge.exe	81
PID 3936 wrote to memory of 4608	3936	msedge.exe	82
PID 3936 wrote to memory of 4608	3936	msedge.exe	82
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 3104	3936	msedge.exe	83
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84
PID 3936 wrote to memory of 1016	3936	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7ffa5e75f208,0x7ffa5e75f214,0x7ffa5e75f220
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1956,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4220,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4256,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3676,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3652,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4416,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3680,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6480,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6628,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6240,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6652,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4948,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4732,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6924,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=784,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4252,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=788,i,2394637551055780084,5432167307449880840,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2828

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a46a324553367dc0b13a007305e4f102

SHA1
005a700ac0bf4429024f9e857e2281f82f370aed

SHA256
a718f2fe90be4422382450b4959840a13d6d18dea09d3da5394624198a126063

SHA512
d3b9fcde15be13451aa441070d9143fc53faa6a2725adea7fb9c340bcb9d7ea183dc1b36c0f8ec21c1748c80bc8fa03a14f198c2fc914c9f8e81702bd8e18399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
29f13140c50c2394177caf96baf3a5c0

SHA1
680e35060382a846752eb208b62de077d31fd1eb

SHA256
f4554eb3e1e133edb5f5f01e19539ffc52adc0b346e19c4742a815e7a92b2dcb

SHA512
d964d066a2913d3b6eb73925160d7e9d79a94ae5c6e3956cd361b54fe53833b311990a91346917bc90b227301d864939f6a5a417ff52ef9fe8e21971b1a661fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2fab8cf8f217159ca504aa00734febe5

SHA1
b51379a52f1aea478ac4cd1534b3edb8ff94026c

SHA256
0125751a9ca66d3d112a3c05d0acd62a3535803c7216828610b008100a958c26

SHA512
899c80c0619c850a66694e128463374dcf7745fcdb8663d38572dbc00fcdac18472ad3835d43462bb0700107bb68bfcd380a7411925dcd8bc8e61903837f67f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57f405.TMP

Filesize
3KB

MD5
f7d0d20eebaa0dfbdd5bb693c290ba6a

SHA1
8343b217d6d2d26be063af27e23b48d971924421

SHA256
53e5f3478b166a7ebe39677f5dcb1283d74fa96673d0bd154d24432a171eb901

SHA512
2efe3fb9499857515aa99bb2b46b0d24f96dea32b4b9b47e9b43a8202a0190b655f0c8372eab91e22f2321092b79bebd9f44cf9a3b3deac0d568b198081db3dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cb576fe6d7e9ce761a280caea1243103

SHA1
688423f27df48f63dc019b70bb4b574bf23dc6cf

SHA256
0c91b2ab148c5608f519df4d3b356a05e26ce39f59505e3cc85e4d337a1a95a9

SHA512
eb5df78727ecf83d3a4ae70cd710beca722297631a0a1c2e11951d2678d4bd87e164725afb307fa0ca43d5cafb47460d9ccba49ef0a73bf85b6c92eab955b04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
b78d2153b1d36c2ba5799b3770fa61a7

SHA1
7ff51ec6d55cf25f1b4b1e4f93d3de7d6d04e908

SHA256
020fdfb61d1b354dd76546fc6c20b1d8b37af7cd81d2e57f2bff8960aa5cbd6e

SHA512
ac254e5c5e1015b435c17072d2c5fc326bb6522a7478ca61f0e0d3512d7cef24c416cf2148896280c7fd63144ecdeaceae4d087e5a213812897a153f7a63a720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
dfbc217f55304ec5df9744a8858b4b13

SHA1
12da06642c831c0aa23888375fa3038e80f68d8c

SHA256
a8030751f81397f19533e37e2f31a3ed5d6c7440f5be301fe45c33489a1da0b3

SHA512
ea563951b90c0e5e0438a2c84a18b74efd32918b7d55719418ad537589a0d41a528ed9bf1779a1cd539e1481a674e82ef8940334d936b6e1aac30195cf61c99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
926db814fba2f29541df480d71d53bc6

SHA1
4b49ade90703fd0757cf1b84798c4d41b1da6f32

SHA256
5dbe07c8ef79e19fe0ce73027f4f5c0efc082b47fd685aef70de1e03bbc87ad6

SHA512
b73c5716374cecba532124088ae687789ac1df4457061e01efc5d83cd194358d2d6229d2f3b398a928206d95be471254150905aebb72f0dfbba987e5350ae4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
48a6e4696b87211e8097bcae79ddf44d

SHA1
7f573afd7f69b0a814a40cda9e5ff0304642afde

SHA256
0f058f1dc35685d994535ff79497f1e75d2ca65cf0bb21a747075ac69f6b214d

SHA512
bcf3fe1d41e3aa22f438ad4bb027927226504d027eaa8c403cac4384a20eee4a189632437d9358030cdbb3666ff4cd70208cdc0c96ba9a276e6a71faba6b09a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
872B

MD5
49b53b63a823514c03b5a6df6db96960

SHA1
a68eb64059c167cd8e110421def810be54a85e07

SHA256
4a369d562124c0512dac476889e7da76de3e261d7bae0c4d6cfb60743648c9be

SHA512
9ca4b3ddd72d6884674f74ffc81c0e8eb2e1c01338a5bceabe256541f6b8abb03f442ce6bb3198c4f2f50d38121bcb9c9bbbd16b731da7f7df9b87e548133f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
58d578d86935a3ee45e8adc4ffd6e54a

SHA1
aab00cc60a8695ae02a0e19012423b63730ae397

SHA256
c5b98b5c56209dbaef945d8735111b67f717fae48e863c7a796f038091c37b63

SHA512
dd8b130c28f2854a9007032ac00227594cba5cf91fdc338578f70231957540cbb828d939d980490101631f9a851a20526cd3714128d6072130b3ff4e5bf00517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe588e9f.TMP

Filesize
465B

MD5
aed93f75480019dcda411dcc0c87ef71

SHA1
ad00c4457b1f27bcaf8ca0a1c9d2e1f879de4211

SHA256
0790f02a24b17ef80bccc140dfd1e6ec28c0c1e646df6778fdfed9cce8299c40

SHA512
f2df0949c88c1d48a056e85680f9d5d07c5e1e9603e13ee9dec10eef15ebc0f12344b40ab63a0d4b90146c847e1ffe580c64517260b52c509f61080713b69024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
06592b86d8ab6309c77426804f7b590e

SHA1
d63f876ab8d1dcbd92e052769cbf13f9a983534f

SHA256
43920eeafa84fd526a2e7c9bbe5de63b5306fdc17595bbc4e8ad1370f53d225d

SHA512
f2e4e7e937cdb486fa9d524b46d3a97a02624e4f612325da590fbc46ad337e063b771c8370cd389e581f1b16450c410850bf1979a46a118ded4a491fddb56ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe588f79.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
5ae580cb7eb6c999ca909945a471ca19

SHA1
96d28be219376b15d83e28f83737fb2c89168163

SHA256
81f31f36dbde0dafb4b6c04a217f55b069b3435f56bb6d194faa3c7e7ee74333

SHA512
d40bf470ff463810b2a1450295893980e088ec7b4bb6afc6e1ed9077fb0d6f3437ccd7e6044a222f85cebab22280329375ce456564ef7230dd459af72b62f0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
506e5e952769ec341e3154e57eecc506

SHA1
a308e103d5c75d1a923e55e6b199871cdab75643

SHA256
57cd10142b03cfa9a218f5773e3cb7609b8033c2eece1527d7532bd394fa9832

SHA512
3a0dcc5e405be06d898599d4372be7f86330074ce400d1866c0edc98315249146a5d1adf5a02ae798376e404c5e0d2789c4de3cdea1459fd1a878f5bff2af9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
34KB

MD5
c256207d2bc7c5211b0c9826b525b4e5

SHA1
3072d127a7c0d4dc1f27b4fb2967f12990882105

SHA256
cf825a8d41681ec03e158496324ef22f5e3bbd2ce36dd69b0102c3e307f38a40

SHA512
426ae414c4318795ff6da6287a6b2d83c38cf6d57ad6ccea86983ddec3189b3dbe2c1f1b2bdf119f00d56892361182b115ffd3942db45fa73e75b0679f9bb432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
7477be1fc43b9e40ed197500961566c7

SHA1
9886eb82bb303f093247461eb583b54bebb41614

SHA256
8108ca9639e38893966ee5b4ffcfdeaef24b28b014e860b2ca32f54e593ab594

SHA512
53b6cff6f2af0883702c8a2f2e1a9969bfbb66f6688d500dc7e73bd39d792c9082312d3476b5532c7265138468d623eb86b4c1227cc73e4326d2f6671235900d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0d21272efa59323596aca83aed8b83e6

SHA1
e5e65b4d40ec607e11de58260265aa40a714fffc

SHA256
608d062d296912229a868f55b50a93bd1d39b41866e36212f45538c287e61c70

SHA512
df7168fa281271dff600791bf2c3c50aabf1737f2caff8299f5ea3b1bca7e82e27d1ea2c5f12c958b019c93b7ddd3466047b6f7196442f09c0f1dfcfaac333af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac93e8b9-4ae9-45e4-9ff8-e172c1fcaa0f.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit