a4d49f0687639aab8115e190e2284857e4a0f7541f79dc215fc1c9c2b1ecde2c

Resubmissions

28/03/2025, 16:42

250328-t7vr2ayvhv 7

28/03/2025, 16:40

250328-t61lwszrs5 7

Analysis

max time kernel
144s
max time network
139s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/progress.html
Size

20KB
MD5

3cf16292a3b2b0a8e8be4d5dec3fe7fe
SHA1

aea7bb7dcd69e29bfd176e4eb13e820ce3a6f008
SHA256

9a074fc3a4e2b98ee4855e9ae491d0c004659bc2db623f90fdacf3f2e4b07761
SHA512

0464aab09429e9c5c09b757a4d588fa1714cc9fe100e41559659a2aea1afeb5a10c292182e1784c40a09557222200a2dc2010007f64678e5de7178616a38086c
SSDEEP

192:ha/cVDYmPkhHmY74deqmtRCtmK8WQI9gHcMlxh8Bi9LJFHab4rmgJnc5t/93j1uv:h+XaMr9n2u53UA5ia6w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_1906571702\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_2137915652\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_1522958740\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_374707068\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_2137915652\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_374707068\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_2137915652\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_374707068\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5212_35474815\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_2137915652\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_1522958740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_1906571702\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_1522958740\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5212_223828610\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876537599947538"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{967BB3E2-9B47-4621-94D3-9C1AED5999D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 2012	5212	msedge.exe	85
PID 5212 wrote to memory of 2012	5212	msedge.exe	85
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 1332	5212	msedge.exe	87
PID 5212 wrote to memory of 1332	5212	msedge.exe	87
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 3508	5212	msedge.exe	86
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88
PID 5212 wrote to memory of 2156	5212	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\progress.html
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x30c,0x7ff9b1daf208,0x7ff9b1daf214,0x7ff9b1daf220
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4812,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6172,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5344,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5444,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2720,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5636,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,10537034103418706725,842887907267801386,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7da492a02c29529dc0ca538b502e3379

SHA1
cee6a1b81936f6a20f1c9c4f35c29394338ff54b

SHA256
553164a83cb91c4905a86373c61bd899bc1007e7719791878bb95290f1f27f36

SHA512
3a1aaff3da507ce35c4e06ff9fd2516c65780849b24fab33417da2e799e20bda3594e5f2f32b1326dd1d3da560c76dbff1f626c147e99c7a990fe09ab0a2e89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2d1071a182e5bdba1aa291e80e0a87d6

SHA1
b70bfb4c4703a01b75ea88d2539e4e9393c113e7

SHA256
9fe692b3064cc0e9d254bbe94a4584b348eedcf6c7e14a0c7e45f61057f72ce8

SHA512
293cecb8acb79e4e047c7d469151df247e03ed5e97a604e1536a2c1343bc5b47892fd28ea505d0eb44af22deb152eaf53a9058e4262b53de97fb7fa5feadb656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
307463e57ba7310abf1ec3ee8fa3df5a

SHA1
7299bf2d6583084d65ecef7561412fe986d68c44

SHA256
2d06ce279f9f2556d9d2df5072d80a4e14dcf2f370d36b7575bd860af716ba04

SHA512
b955f4c8e162d5c8f3312a8b34aeb4bc003bc28ff1af09af2655b3c18dacc6bbf2d4f6731cdd64ad75ae3d957847971902b0c35f87ad2898b57703a0cb2b3aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
09936c0ed6843f1e13faf07d446e8ac8

SHA1
b9be777c0c0de83cd2f048896af60e41b9c99fda

SHA256
874a67e94d3385b8424654f7f393495395aed7c2cc44c75d19fe063f4d7ced98

SHA512
e83f2716ffad5ac65bf31db9664724ff53360f3044b22e9d07333365f12ab68f6c5abcf28c10c40c22dd212c429d4ae844caf6bcc890f1d6e3ef62786ba158bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0a47f86a4b0e7236c51a26874008c67a

SHA1
846b28d84f2eaf076a14b9a7d3a5cda178f5ca89

SHA256
7942ca2a72b4a838a25eaabeae7a09206da68d1d359674c64af5d091cbba7b9d

SHA512
76fea4510e62e551e63121b8686a17dc304ca437294f3f17a4fa1e7f5f7005701cc883fc34b8cf5e3ff0cc244ce6c53d3a98650696c78f75fc98e1335d7abaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
855995ec26fd7c2ed65bbeb44e8a49af

SHA1
ca2ff0a2d87fd342117218347b112efe1ccf63bc

SHA256
67fa2d8ffccb6826f40981cd50f36982ff8d997f0c98247a4cd97fd3deacffbe

SHA512
f205bd4dd984524d1637c5bfb915984fe6ee28c675372d25d2f7602897a1c9a17c5e4fd600156819f5b1ccb229d40f8f69074ecb7fa89d9cf5522566800f8a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d5017adf5f18d1242242e91575acb9bb

SHA1
eaf2fad8cf46adbf355ba128d53d18928b50f047

SHA256
4ea6083728f84177abf6f727995a90e60216fa0c7cfd2b5fd47ba55db04dd783

SHA512
5529d598214bc6b875f11290bf18e268db632153d97c457d5661c9c84b165ab9a0746bf7d564f0da70116a399184de756dc5b60b51732939412409f3bae510c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
7d5a85685c039292f8596492ee59d465

SHA1
b74497f61f7ef4195b4410b9e7e6f6ed7066d653

SHA256
365eb06ce8ee36adb93f35e3693ad6fd4118015fdfd7ea3cdd8baa1b12fd0b91

SHA512
11010ba6efd1afc368a1dd7ff0c22bc5d9ad60926a3c4aa96456eb45087fda584f16c14daf4ffa69b0ec30317675d5e2f9505058e923962b4df19643dfb19af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
902B

MD5
f79f1d305b72de628b45bf7ffe8aa006

SHA1
e70ed17bbefa206608c1e813b6761abdbadb3367

SHA256
a2910da57442ff47cd146ac1c0e2c7499e3d258a1947fa5c42605e13ea2f2331

SHA512
1e85520719791bad113ef68d2399c8a10904bfdfd78a48446cc9781f0ea7f479a597472cfc881aab7437338538707bd1aa9e4404585637f172b51beeb1395921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
95a8a3fd98353e1892afbf648a0cc4f1

SHA1
45f7a7477afebbc8d1c020c020fc94775acd78d7

SHA256
5e4ebe22adc8bced065335029445e4742b88e590498a36b50698e504b144b3ff

SHA512
edcd4ed38eb84680d467996284617037183522f3cdd2432a8904f1c8f0f46ca7f15c505c7a2bf3d05b6c7070274c8af4bd0fbb56876890c352e66c9c54279908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d7ccc162c49ecf7361c5af388ef15df0

SHA1
8b6390fcf0c8dc6b870a113dcd5cd2749bfaf175

SHA256
b7215924025c9cef323bcd7312b03c6d3eae3df5f013cb90768c7ad20ce93477

SHA512
a1742ddd4009fd2f1d334c40ae2ed46694e5aa3ddad25a11cd3fe3a7a0b753a0da72f92fd9f3eb8c0488d30cb75d934590439ce666425c943fe11d87c7efa5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b904895f3e206eaf06e5d8bdf6aa139a

SHA1
f7d8d6f181669e59a156b6dea5f639b4563a20f5

SHA256
ceb0ff8cd4c460a83017e23d5f931d7e4be53a4edf18fd92b59f3cfd0c56bc90

SHA512
f7a5fa852da71d7eaa49826bf8f5556a67170e49fa2c723daeb70465239ba9e77fe5b70812a4830f635b5563d33b915b576ccb22b42dc84b218ac3664b59a74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e8b510953410eb2e5960bf45438a274e

SHA1
12fa40770a4e1b84473974447272a6ec1479f94e

SHA256
eee49af0d3242837868ca6bf088a821ccad401420ed24c033d741dbbb1c7fe21

SHA512
d4234c73910921ae49ae9ff0c474b2d1c664bc006aa2f169acb88216a4c1ca32a61543ce0d3dd580c45c6f85d2887fccc11671292a117c2ab7dc0133c2d431ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ed671884913e14de115b3204ebb74145

SHA1
4189d7ff4d6ab575a7bc2c71231a78dac273e8d7

SHA256
5c82c54c84ae9d2648e10d578c36ceb043772c3b598409144ba42f453996e204

SHA512
5e2009f27ce3da4334e3e5c2fc4d97b65b0ed07188440ad5250e75e9b3357b7ac8b02d4a3e7a5cd02c2f50211d3f28bb6c09b91ad452907baca4e53c5d8654f6

Download Submit