39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
100s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.DmfSqlClrWrapper.xml
Size

1KB
MD5

cc99959805117ad3f6c38a7cd91d7779
SHA1

f4a49c09588cc0a0b0618fcb76f47cd082f0b59f
SHA256

a85e832209133d641ea1d4ab163a7e1e4d98af4bfeb2f87b8a1887835e3ec7c3
SHA512

c77f6ca0fb434f977099d9a5aad97ad60c533a2a03bb12057fce559375f28e34bb016baa746fc6cc0781ff3350bbb219c59cf2ad0e6ff38ba9dd63986989f156

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_600992982\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_600992982\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_600992982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_600992982\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_600992982\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2089002846"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175351"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013904589741"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3582532709-2637047242-3508314386-1000\{3E458178-E922-4259-B74F-DE6C3AF2213F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2600	1872	MSOXMLED.EXE	78
PID 1872 wrote to memory of 2600	1872	MSOXMLED.EXE	78
PID 2600 wrote to memory of 5328	2600	iexplore.exe	81
PID 2600 wrote to memory of 5328	2600	iexplore.exe	81
PID 5328 wrote to memory of 4788	5328	msedge.exe	82
PID 5328 wrote to memory of 4788	5328	msedge.exe	82
PID 5328 wrote to memory of 5016	5328	msedge.exe	83
PID 5328 wrote to memory of 5016	5328	msedge.exe	83
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 3108	5328	msedge.exe	84
PID 5328 wrote to memory of 4456	5328	msedge.exe	85
PID 5328 wrote to memory of 4456	5328	msedge.exe	85
PID 5328 wrote to memory of 4456	5328	msedge.exe	85
PID 5328 wrote to memory of 4456	5328	msedge.exe	85
PID 5328 wrote to memory of 4456	5328	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.DmfSqlClrWrapper.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.DmfSqlClrWrapper.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.DmfSqlClrWrapper.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7fff2dc3f208,0x7fff2dc3f214,0x7fff2dc3f220
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2184,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3376,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3384,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3352,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3380,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5908,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6272,i,6009472272788982664,6868782867746378651,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
978d790ea9bbd3b3113b1d32773304fa

SHA1
61c9b3724e684c2a0507d7c9ae294e668e6c6e58

SHA256
36c686a276e904607d2a18c2a2fc54467fb8dc1698607f5d5a6cefb75aa513c8

SHA512
d50740255d20d2a5e6abdc78f4fe9ef6e832f2ffe9ecc200916a73db1e0dd37d67d88996b315e128bf5b77bb110e4e8c29905aa5d90b83019be2cc8127d0dfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4bda99eacc7940f10a535a50448094f6

SHA1
86375de5b59298a9434877ae4073b55b7347d635

SHA256
fd327f987054aa2abfc2d40fa2f39de95a773771558963919f6de306cf528daa

SHA512
eb62f52798a2e47a9fb609f275d4a6d4e95b103725ca7791d6b39acebcab92d27c5b1e111e63b015c6c0b914d9f16f3eb34e10956a1f53cbf63f99f657c0cb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
059972acc48ef5f76d3a3ed52cc10fc1

SHA1
3f2fedd49d6a7a68c84800df18f1a91d9677b784

SHA256
b5767e9a08a35b4a16ad3c9b7a4e7f960b7240c11fce05035d45dbe456f42a77

SHA512
e8427a79b52cdb297abc03cc86845db0c33ea63a04ef3c00cec9fdad8cd2c0d62863330b3f86485460ff1a34ef3364b29527a124963710471393365e30cf3a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
53825a8ec65b1ae9500fbad5a9ba625a

SHA1
2859727c024ef294a56740baf7a38fd48b4473e3

SHA256
fbc54a31a0eebed7a7a1fca3dbe6ef49f8c33c2c7988819b942a7d2e4c96d860

SHA512
1cfda62b3c9dea1abce1b47a2472793b5658a0fd0a25119c3a4db5dd2bb945a910be13295d5149e18d60e2dee7139fa25ac0f60204fd3ce926143d9030c66707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
520f7183a8b60f6b1342ea567d46f514

SHA1
286521855fd5ee940e3a9d52fd8fc53eae846b45

SHA256
6730b3d753d9a4e3d93e6ee330aa1b22092182efe984de56ebff14bf3ff5f6ab

SHA512
da05732c0ba370fe772203fa670883e1a78b421622b428f023aab69da1f3a0a88a6500576df9f93b4f61e41aedeae68891d0302f373169edd49dbba9638fb793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
7762e417ff2f43bad1f7bd5e7e2a2749

SHA1
6b4ba69953f7280ce4aefd0a7ee94a736a051342

SHA256
5b9f6cfcfb04bf241895742f294a5a571a7213f3315daf2a8f4e00abba46ef0d

SHA512
9c3b80d7f25e9cc323546a846588746f7d3533b06636508818a88ee65de9314797708c1cfbac53e4bf9aa4575bec0bec0df16f130973f1733181b4baf122bbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
00bcc5b583ad09f5b7b50781f2264442

SHA1
aa31025a9374fd07bfb5c10a5873bdcdd6599ed6

SHA256
2fe8216ab0658ec0a71309586961edc9afab595410cb17a0050043bfc2a0ec3a

SHA512
0fc647f05f68c8ca056f3fca0d064ef043a906b942f0c205d98582811308f0a203e0108fbb694d6b53f8c4f40145fd4690d154a1c16954b9aedcedeaa90d11f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
51256729202dca76bdec3cd49e2a15c0

SHA1
9178c765a086504fcfc5370aa8bba6071474da9d

SHA256
fcecb56d21bd4680cf0030c18968b0cb9a45e5e77247d37717b072ba6707695d

SHA512
4b97c286011cb21477095796e7c47bfa917ce2f927998d6dc594ff6173294934c7022087a5c934d5255b29003dd99cc84a2a4517ebf3ca2910b90217d2676b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f768c5efc8d7c78bb796fa13f8677f4e

SHA1
400bfdc4e5705064c240d3d0d2ce3b79d26716c2

SHA256
a57bfafacc6f800063c4d303c2cb8f4c2b6761c3e21e560b7861f9959621932b

SHA512
bc83b51fb629948fe68e7beb8e59a45d83d5465e2a1eb7e349058e4b1dc85eb04b3194be1683bff1810b35f8d50c4865c2b4fc93c0e5bcdac188c7592b0195c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
97773a1a8df7d56963482a307a3c4684

SHA1
690fa18c01cc8531f42b4e5eebdb42f26b980606

SHA256
75725fc7155d168e8632b44b460e522f64df5227fdf4413c1f70276cc4554e08

SHA512
951905dbb4a901726f26c0743e6b4d3978eeb5c5284933a5c87639292e51a83a048e4ec2405bd51fd964c68efd3809e9fddb7ba0b8a3d3fec240d5707e7e0a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
06aa41723fddf6ebeee98acaa132d085

SHA1
fac4c9b670dc0e81723b6c0e7cd9c25fdd7a847c

SHA256
0f1a95cbf29939e9d7688a4cc7595736ebd50ad8bfab69a07ec1de32f42806b1

SHA512
9876101af6c9f245b663911df35a4be9a26393e00aece4d6adc880aaf9cfb6795ca20e36b108ac0030b4553febec0c25d762f068891c9737094112d5338c15c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
69541e0c72957da094239db78716a0e9

SHA1
08109f6180c85abbc4a63ecd89251da405ac24e1

SHA256
9a43132e9325f1d150ee05802c521eba5979e2f5d49f0134c81a8de14375e75a

SHA512
6308f50145182ea0d2ceee3936d399a07fbb530a407d41401783f15199c608b41eb82b563ddb83fb4917c697239c7e29f3bc1a8d2efea54c15c5eef7fea4307a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_75490627\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/1872-11-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-13-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-23-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-19-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-21-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-22-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-20-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-18-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-17-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-16-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-15-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-14-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-12-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-24-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-1-0x00007FFF3E883000-0x00007FFF3E884000-memory.dmp

Filesize
4KB

Download
memory/1872-10-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-9-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-0-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-8-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-6-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-7-0x00007FFF3E7E0000-0x00007FFF3E9E9000-memory.dmp

Filesize
2.0MB

Download
memory/1872-4-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-5-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-3-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download
memory/1872-2-0x00007FFEFE870000-0x00007FFEFE880000-memory.dmp

Filesize
64KB

Download