39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
121s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.ConnectionInfoExtended.xml
Size

69KB
MD5

dc0173e14682196f8efc27b79074affd
SHA1

2080e6275e6b8700659c4e5b706f9e57713d2aa0
SHA256

af62e11a7e65b0d168a36bf350f05d8ba19f583f97f8730f7e10b59fe20ef54b
SHA512

babb90d03ec8d41fb4b5214dcee1d4d7b894e76b407b1b8da6e9ca418ab0b3e0ee6d896635da39378c8387a24812a7e098b816b8fbe5ee51bbe2b5cf6de0dfc1
SSDEEP

768:qASe5+5G5K5m6kczsW/V6WBTWfxdLXtY9xAErt8jF2ZnNjqa/LO1p+UulmGqGMzc:+HkM6WhWihBj8Xo

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_425399128\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_425399128\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_425399128\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3646702088"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013866747589"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{5E1AA33B-E9C4-476C-8413-6C4537466C4D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1640	2524	MSOXMLED.EXE	78
PID 2524 wrote to memory of 1640	2524	MSOXMLED.EXE	78
PID 1640 wrote to memory of 4204	1640	iexplore.exe	81
PID 1640 wrote to memory of 4204	1640	iexplore.exe	81
PID 4204 wrote to memory of 3220	4204	msedge.exe	82
PID 4204 wrote to memory of 3220	4204	msedge.exe	82
PID 4204 wrote to memory of 3692	4204	msedge.exe	83
PID 4204 wrote to memory of 3692	4204	msedge.exe	83
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 5092	4204	msedge.exe	84
PID 4204 wrote to memory of 2920	4204	msedge.exe	85
PID 4204 wrote to memory of 2920	4204	msedge.exe	85
PID 4204 wrote to memory of 2920	4204	msedge.exe	85
PID 4204 wrote to memory of 2920	4204	msedge.exe	85
PID 4204 wrote to memory of 2920	4204	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.ConnectionInfoExtended.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.ConnectionInfoExtended.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.ConnectionInfoExtended.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x350,0x7ffc1d3ff208,0x7ffc1d3ff214,0x7ffc1d3ff220
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4932,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5616,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:2632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5748,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5000,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4172,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6132,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4956,i,2203788735187636746,8667803594694470452,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
821049ff6f1b0345f75b02d93cc6aa40

SHA1
a554dc151ea5bb9cd77e906a03afd4cbf2fcedd6

SHA256
4d6a5a82630826d541e2abe88a49938bc2bd88857c0fd24b90ae06d0b0d47558

SHA512
2c3ee47c08ada05eabf0bea86a63f559da738f0f70b5213d0c91debac8ad6f8c7b15b6c6ca87105cb2baa9493c6dec92ab3ebf336f596d0ae7fb60bc82bc85b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
60818c8dff8d3f25f8902a3ce67ceddb

SHA1
db52a1a0e0df66020ee1b8b5c2b3c22220b8eb39

SHA256
59ee3350b118f4c146337b3b2bcacb699ac903c654fa76418e1e897c665e6081

SHA512
0cd5168f445a80297a190d27d1ac0ee8e3bb651fb339e392ab7235235b813c3980888ee6710f89650358578f3947e6397e478aaecefe8d022e25cd6487b1ba4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
02a5e883ecbec6f479216750aa3ec297

SHA1
106f5412a3aa49b350b071a61711b098d95a4da5

SHA256
e6c6e31ec5ddb754668531ec52f26724f378e55b2caa03428b11ad6def953537

SHA512
d95213ba7ec1deefc38c9c7624f15a3eea4cc7ea6073af0193a0f37c9f667c95352cec6365af415873db16e2f784e0b5e1ce9b6fc8ddfd827a7299f6718130ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d086dc66022a6b8cd84ee21aa2974a03

SHA1
a0c79ca265a84b7a4625f120af298266c8408356

SHA256
446101b2a4908b5757a54693ea1e6a0a5457ab18e22dc4ba47447b98117da8c6

SHA512
f676ba638389e7cc779efe2b75bbaee46b6e861c76f7eb8eac0bc151acc7bca3d929ee81545ab10c0048c718d80313f3212de78a011b6942e7b5a5bd4f2c1215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
60a8d77f67d31001b57f0bec65624443

SHA1
6dace88f551823d46be340384f600e9c51abe15a

SHA256
894ed5138bf2779359b7a49607aff4ab29fb5578478b7050e3d421b9535a5edc

SHA512
6fb72485fce3fe06474a8a0ef9daa5f0b1e7779b2704c8cbd90c83379d89052b45f169bbd7db949bac06f695b919c116a614b63f099483dbfd8bd90955822411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
451e1b205f5319b605aa0123f872174d

SHA1
3563af45015e3a3f33ceb3c92e913fe17d573a3f

SHA256
6f1d3594f66defdaa662956cc0718dcf3a8d35f736f8dd26e901352900fc46be

SHA512
b537e1f30efdc7f2def9cf4335a9202769ba038102232720dc434e25235ccbed781efa8f8afd312f3db258cde6aaff1322908ea44da1abbbe257a5f59c7a2cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
0a8f5883c74c6c7a76859c3cea5c16cc

SHA1
6b1b18a63ec77bd535666ba378f73c39f6bdee20

SHA256
2c3408e1b8621254547f464e1bd219120438d3443ebb24a5b656530052bb8485

SHA512
48469651018b43d91315fd9652b35a17372fe96e4fd6c9b72e647a82db9585a2346f864d806d564e209017ad230cfbf0d6d67e2d2708530ebb289b308200d327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
56c6fe6143e9f6a3fdf6484e012b6fcd

SHA1
22791a0cdac1f135330f696946d5e5815c1917b7

SHA256
81fcdf7f5864a8fe9045a63299ecd6cdaecbcf7df992b3d87373af0ce638cf50

SHA512
f03023c804f756b1747f5c01da711ea957cb01f137d0601d539545a9cbb90e0f773c9cfa88fac126ea8e40b9d18b922275a65ae1baceff0b3b399cdc1811c958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
07919aa4d9bb7d278613bdb9046100ef

SHA1
ae58a2906cca6e500e240446626cde973f012a9d

SHA256
b10b0e27fe256341b75c20930d44f76f527610912161cb03668c4a8457df3efc

SHA512
7662679b4138433d4518246ddf6ab560d8655a6a6afa4c894ff078b3bcd9f211b6f365dead2fc0b48648978542655b7d4524c3de428e92adedf30881d2cd9009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
9eab62f541d3060da6cdfdb84618e068

SHA1
2c2f20074afd9408474b9f99f3b32b03f6c179ea

SHA256
40d9291c2bd2b0ed76591041f2993e796de9bf1ace3312c203b8bc1edea128ad

SHA512
1daa57c3ba36bbd418bd5186770bf1c2d48194d21883bfacdb3c23de038ff885708cdd54f53bd9e924cf13bb0555d20294b267ae68e6f1d7ead2b644ae7d5c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
4ac3f7ce4e12e01d3d8722e4b3657916

SHA1
5cf178716a4965e9899723f47c6b192a2d783f76

SHA256
d32f15fb266340e7570f170b5a1afae055798f8dca2c87637381d444eeb49528

SHA512
bae0e0d8536e46dd894d3c49df7bd7f108b891fc8c06123756925085aaab9df5e7b80e90da7af04724c35397dc7ab4cdfb34ab3cf871cb45d97a942b1ac46d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_174584779\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_425399128\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_633265237\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/2524-3-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-15-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-2-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-10-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-7-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-6-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-14-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-4-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-5-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-9-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-1-0x00007FFC2C683000-0x00007FFC2C684000-memory.dmp

Filesize
4KB

Download
memory/2524-8-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-13-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-12-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-11-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-0-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-16-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-17-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-18-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download
memory/2524-20-0x00007FFC2C5E0000-0x00007FFC2C7E9000-memory.dmp

Filesize
2.0MB

Download
memory/2524-19-0x00007FFBEC670000-0x00007FFBEC680000-memory.dmp

Filesize
64KB

Download