39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
104s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.Dmf.xml
Size

651KB
MD5

d46ab0c0c89152b70920c989fc3bc55e
SHA1

7e24bc256d6cf76d391e62af0246017095322aa4
SHA256

696e051ef2ce74216db8dc6c4f02781e282d9b468afa466904f331134d0305f6
SHA512

fa695bcc1b2ca0e8df53642eb946773b327e13e52f364af8a3558928aaa8cd39187d0b36cd893c7c682327a4d4c2ef2b099a7eaae747996049f4fae7159a3fae
SSDEEP

12288:o6uXsPsLsEorNGg0nyGGIdTZnv56RXMmDOqVRjg266aAu:+b

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1183564585\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1127862734\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1183564585\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1127862734\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1183564585\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1183564585\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1912699037\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1183564585\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1912699037\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1912699037\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1127862734\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175355"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2528367235"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897014012190921"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4239789418-2672923313-1754393631-1000\{A91910BE-790C-4703-A581-30A03BF42572}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 3152	6020	MSOXMLED.EXE	79
PID 6020 wrote to memory of 3152	6020	MSOXMLED.EXE	79
PID 3152 wrote to memory of 840	3152	iexplore.exe	82
PID 3152 wrote to memory of 840	3152	iexplore.exe	82
PID 840 wrote to memory of 440	840	msedge.exe	83
PID 840 wrote to memory of 440	840	msedge.exe	83
PID 840 wrote to memory of 4276	840	msedge.exe	84
PID 840 wrote to memory of 4276	840	msedge.exe	84
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 2348	840	msedge.exe	85
PID 840 wrote to memory of 4916	840	msedge.exe	86
PID 840 wrote to memory of 4916	840	msedge.exe	86
PID 840 wrote to memory of 4916	840	msedge.exe	86
PID 840 wrote to memory of 4916	840	msedge.exe	86
PID 840 wrote to memory of 4916	840	msedge.exe	86

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Dmf.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Dmf.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.Dmf.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffa005ff208,0x7ffa005ff214,0x7ffa005ff220
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1932,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4724,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5816,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:1796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2096,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5128,i,10834762536831696471,18425161281774622677,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e93f7a7e895750f95a2b42200b2f4406

SHA1
eb9edc7a2f5aff5ae1ef937ec351ae1adc59034f

SHA256
16af01493a8deae2d5884e7a0b4e4cf7f9b67a1c762e6479679500cda4ac928d

SHA512
de7167f6575862feec3e02150f1ac00ac9daed7528f3edb6dadb42266a27530ada41f7e2094ade3feb970ca8745e3c02a18e364c0e9ce04dee177472c1f5420a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a3a652316687d4e9d59b06bd3c2deb1e

SHA1
d503ca82796e676900b34db211e84f4ddd21c576

SHA256
3b68e438926d788344f86c66bf5de1c52e043044344208195260448c1a85acfa

SHA512
68a01eb86a1fe3b8c4657f4b8ef3978ce7b2f96d4b3c3a43f96643c10bb264e33091c9dfcd5ab7a7ed608f05f90204cedbdeb47c63a5aa3fdbdedd9b7822bd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ddb43dad6233dfe4d4c9b7024c24bd59

SHA1
1dbe76fcdbb6843801a39967d6b0c4d93eb8847b

SHA256
720eb934949973377ef0943e12dd083d93fcbcdec1287572be01898f7f437f1d

SHA512
57c71d60be859a15cab478ee55cfca620fa8832f0a600b8652a5a803c78cdd5df4132d5c2e5ff6ebe23610f93d411b10400b912e06ca9a55ca356624c7d506f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
7a85c2408237fac7be7108cc2201a0e3

SHA1
137490f93e7c463d7d673bd37ad2951b89d72c67

SHA256
27e4f5ac52a42aeac42de05d6f67ddb7c56f4ce6273f57063e4d2105123de98c

SHA512
6dd2eadc6b0050ed623d0e67dcc36dc52ac331e83fe06410e8369377c600e1079c07c973c20722841f8cb7727934879fcf3b9baa005d6f2eebe1a684b84361fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
324c75a5223fc682ca6d961f17fe7ce1

SHA1
1a51793b50458618defecc346fd35e4938d75ca2

SHA256
d85e76acc148eb9b109171b28ae0f48bc040558654e066062ade40f3fa7b9622

SHA512
34d9c0d1f89fd2f1bac3acf8ab732a0ab5e0f63d18b1eb0772dedb9fb24a98ecde2627c5d3fb64182bd45df512508293b063074626a108ce2ea829d84f91c70e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\21552f96-be1a-452d-85d9-44b0a405a0dc.tmp

Filesize
467B

MD5
a2bcbc22d93097ba106ebbcf598139cf

SHA1
39c4596a8c99a59c4f78763f35532809929af580

SHA256
62bcb96d9f5d5285df8f1dabbc89838f5f71ff4389bf6dd7944f6f62b3cc69a8

SHA512
939a9fa81e8bdd840fec0994db49ddc5ad78f2d282acedf9ba53fafa5484916f84643b391c1028ad5158f4519dd8e07dd47cb8d7793872e31a5122fd2f02066b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
7014831410e338d9a3c78aec1e05faa1

SHA1
f42cd7b08921cc3dfa90b3413c16205a28cc96d8

SHA256
51b70475974af5cede1a83ff481bcac2db69cbe070bafcc9907fa0d350a02ef1

SHA512
19c1b796f94bdb3cf1a5ccc20fba02002c587abc855b8797db2f90c741e0d1df0fe38a71e9e59449af34dee55149cbf841071e206b22f48f9cff8b28b4227e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
768bd27e5bf0c934866a63e52e6bcad2

SHA1
8a1872b25f2cf3d3a919f32726457f71b3e5b3f4

SHA256
b2b22bac40fa218ff391616a646e8cbb4cb99b938b644cb87721fbfe0adf44e1

SHA512
a31252fa78e8cf826117f355d5edf92ca1aa0087a0b230decf0a15e3adc674b7033c81f96ebe90a6bdb041db3f2051d662eddc9208344d59659e4fcbd989beec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
903835e1f9a7ce74a6b3412547daee47

SHA1
f9d9babd6a7fcf6b97bdf99361150f691c95e2d8

SHA256
f9dbd3e6e41bc845ed51765638c106b70307ce37ad1be9d388f0ed05f3dd3a8f

SHA512
3f436d52eba7c2d06ae296d47250529a2bb5da5b8f13c8e3155fee14bbe8fe9bfad8ddc4921aa84485ebde3447dcf36a48fd42a8ab37c9545b8a0533829fd171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
bd506aa030763380cff28410da409198

SHA1
f0d4ae5b5c1274a7f7a61e5915db74baea8666f8

SHA256
4b5c8d255820179dace89d8d6d9960329fce7adb407cbbbfd3faae6ab02c39f8

SHA512
22adfbc26a5d75fcf52163e54ee3e17903a43a87fa4045412f9ca856e03484f49396069b22c7cf06c808173012620bc87600d3503158ad93fa5b5191a0d747ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5872f841c6350ce0c9046471f191406f

SHA1
6265f067d5003da8065a747ceef52838c8fb2314

SHA256
fc875d66f9f92a5b7c06d0da5e31be7c9a389c44bd5c59618f681b347fb7b486

SHA512
fafc7348b6721be785ad4eeca93a305c5e58f36a7547f3cd3301784a193b41bb6b92a6cdb39e168e66abfe6e953540bee4c0a0e4157a427ca55316fbd8ad524c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a64daafb353981d003a8bfa7728579e2

SHA1
2aaede60dc2eba58ea1cd0c0c8cdeb68e8433bf5

SHA256
1ad9ed9ac86865dd5e50d5a6e4503b5abbbc6ebdd59929dd2e50bac4d7b3b37f

SHA512
94e40ec92abb2c7f1d5fd6413fa678c5966a1e7d9bc2bd1b346c24963d98bcb9af3d66ff5b6b794b85715cfd34f7ac9deacabf90eda9ae30a75fd588f850ba9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.21\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1127862734\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping840_1924745683\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/6020-11-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-12-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-21-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-24-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-23-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-20-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-19-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-18-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-17-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-15-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-16-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-14-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-13-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-22-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-0-0x00007FFA0F363000-0x00007FFA0F364000-memory.dmp

Filesize
4KB

Download
memory/6020-9-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-10-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-8-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-5-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-7-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-6-0x00007FFA0F2C0000-0x00007FFA0F4C9000-memory.dmp

Filesize
2.0MB

Download
memory/6020-1-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-2-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-4-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download
memory/6020-3-0x00007FF9CF350000-0x00007FF9CF360000-memory.dmp

Filesize
64KB

Download