hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master[.]zip

Resubmissions

27/04/2025, 17:31

250427-v34ptaynw64

22/04/2025, 01:57

22/04/2025, 01:52

22/04/2025, 01:43

22/04/2025, 01:29

22/04/2025, 01:28

21/04/2025, 16:14

Analysis

max time kernel
656s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master.zip
Sample250421-tptr1ssmy6

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_855567837\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_855567837\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_855567837\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897256789804857"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437575798-4173230203-4015467660-1000\{CFB8675A-617D-49BB-B970-874A30DCD63E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5940	3564	msedge.exe	78
PID 3564 wrote to memory of 5940	3564	msedge.exe	78
PID 3564 wrote to memory of 2916	3564	msedge.exe	79
PID 3564 wrote to memory of 2916	3564	msedge.exe	79
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 936	3564	msedge.exe	80
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81
PID 3564 wrote to memory of 4856	3564	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master.zip
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ff8b62df208,0x7ff8b62df214,0x7ff8b62df220
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2488,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3404,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4852,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4860,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5780,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4760,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4916,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6512,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6704,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5560,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4952,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6488,i,12361726387392885402,10432840206605415127,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7b57a37dd1bf12371382fb12cd8f0ebb8cbc86323a10903d62014195e3142dc
MD5 27d02a9170feb143c10bced3f0c7ad50
SHA1 0e807524dd428900bf3c6b91190740adb8e7e660
SHA512 80723887c4cd5aa3847d68d3bbbfbaa29e1858ee08bfa2c51369c31e44eee1b627a2ae8cb1f2a5ce75a5a91d7ddfe4ce8f3dcc5da818e4f2dcbc2f746bbe9589
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954
MD5 2b66d93c82a06797cdfd9df96a09e74a
SHA1 5f7eb526ee8a0c519b5d86c845fea8afd15b0c28
SHA512 95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5
SSDEEP 1536:IRWH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 034caa01ba6b615e3fc5b10b642f4398f12d6130c18845b4cc9c07eab5bc1b3b
MD5 9b0d7882e0975e46aefba9cf60b8b754
SHA1 786e9f8f1c9046c27db1130e60644d9d9b84e382
SHA512 bec8ab918b694aa22c7737f46dc9e479e6a7019a2eb9a7a70037873f9984fd0a7fc0ad9e8f708f59cd6d488bfd17064cd0b7ef73508481a876d3ceeaf4e37b13
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad3a71bd6dcf3dc2c4713e53dd074a09217d3b52c2722cac776ee7bae5930d59
MD5 8e6a7bce02fcaf80ca7c6005a187ce98
SHA1 6992ce4dbaccf1dfdfd25be8dd71d6c0f18cfd56
SHA512 1f73136dfc0d8d8329f855d1d1a4491f8668aee86f0def185249eae275adc6dd090e8ef01bd0c010cec3db5bcec5a98acb6244d5fdebb103b115661706ffdc9d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc1139a609a4fc2b2f4aa7bbfcd7dc14d0b4f8a4caad96c0b6d2b34d1d0e9fc4
MD5 66f5495cb91737e89a2d4b2999285343
SHA1 c433f6fca809273a19cab7f9e93e9e068a5f5b24
SHA512 270804a26d5d73a9bbd360b0601f857a416bcbe1a9724c1b0ba89bd45651dee0e7d1699e3c8caf66e76b97f3bf38aba6ee27e1efb97b4048c96fe708b27ff535
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad0e0b58c35cf4fd87de9df49d6a35533507f54b31cdb212ad8d5f82382cfcab
MD5 d5a85298c61e2cb49aa0af0b94d9f05d
SHA1 36182d19e1fcbe895da549495cdda121cc49924f
SHA512 76c34a38abb7b388be46986972929f576f3688d6587d88b66e798d7559f6c55cbf255f75da909a217c0a6399ab35d78689d23cc6e27ae84cad2dca4c803dfacb
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e2c75f0cf00a2cd9dd93d2e853f8eabb85612e5a293d181043be34c248dbf674
MD5 846f6df0c4acf299be3ffeb4d77f3a3d
SHA1 6a08671f3a4152bf130103acc818782d145c5e3a
SHA512 9001c7cd97e585fe3a1d310b7eeaeb026c2822b0bd41481a588f21550b55342277cae6b345e945e5ee3e7fa4e16bad2ccaf3ee54d35811f54de7f847f544e037
SSDEEP 384:sV4qpPpdsIGXdcZT1uiH+/Sr5eC8SvBWK:sSGtmdKxZe/Sr5eC8SvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2edbf1ee38903f702077d11e9d2f1a3dd81bde78bc6d96ff40305c9e7530a191
MD5 1c3b567b029a9a5efc1a94415ee33487
SHA1 d6f677d9b36d81e0a884e626f62ddaea5ed381d7
SHA512 fb61a8bfb7b63e7aa73de513a6d73b3047f87ac53efb92a6199ac140d795e4eb7df52b6750e144ddacecafcfa3c6c00a97e03f5fb662d5bccb9758add8cc3306
SSDEEP 384:sV4qpPsdsIGXdcST1uiH+/Sr5FC8SvBW/:sS3tmdpxZe/Sr5FC8Svu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 30f9875c98fc2c910e71364a1bf5dc415fa38c0c977ca764dd13e6a8b0b19c41
MD5 f96fca1cc7206c825ab3cabc36c3c75c
SHA1 68d2457b42bb1db064cd34be82108df597ab6639
SHA512 81170e67d28ff8360bdc6a10b466ffa3786252f2146b8244338e502738ab1efa749392a33a62639b18e1d1ac69953733175a703d7a01eb1daffe5040b384be55
SSDEEP 384:sV4qpqusdsIGXdcST1uiH+/Sr5FC8SvBW/:sS9dtmdpxZe/Sr5FC8Svu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 663c62f42fe366242589fb5d6af6301d17a62a50c935ba1eb486211b92a9bc9d
MD5 dce722bba460914d0cd5c5b15920b005
SHA1 a664b37ce930c085e55b487361872703d2bbd105
SHA512 61872fd3a2b16721a8c3ebd2a5a1c887c28358d47365249992a50ad9a0ff15d047c69f2f1a67e3634329d873a76880cc6a33cda2ca92c7d96025051081b4e1b3
SSDEEP 768:6Vyve8FG21VNP7pLuL6rxWRWlfQJn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3xvmE0:6Vyve8FG2vXE6rxWRWlfQJnu1jaKxvmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a0e0eae0648637ebbb33fc7564e35e5e7bf6098e6ab9af727e32de33051ce2b4
MD5 3294f23c65efb478b448a70f7d34bcda
SHA1 9a7e5d2ce0e70582f23d0affcba3a5213243f46d
SHA512 93eeebbbaa08851144510c2f53be2e7f69ebc537dbb237e6fb7c1544067f69d6f2f109720151ca15bd85eb8c09a2505999511ae9800de102571de1639e0ec313
SSDEEP 192:/CcMuGxCGUssbcH2mGwgmvQf2PArDnhU7uakK23uNaycyAU1e3mEg:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 20KB
SHA256 a635139ee75f86561489f9f8dae65e95251a9a1547583f950037505df7fa290c
MD5 25445d3ae00036844dd907e2f5f04a6b
SHA1 84542a5b735072fcbc4ce9da5fcf5161a9c6f556
SHA512 82ba1e3d4d11cd31a0ee913cb73671aa65bf66519203c6b9efd9cb01b4306eec58909388529a741509368f263df18bca3680cfa64da31f4357d19293233f0bcb
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uI:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 904B
SHA256 de99b654e267814cbb6386b472ba4cf6fd5b02d6ea8740921df13cbf0557e93f
MD5 e28c4fcebb57b4b8f49279631613e93c
SHA1 f58a053831b78ba850b08b5cd87008214a1b0edf
SHA512 ea96a2954865d03b5bd802d2d9e78ab3cca720e60f07e0d25861eeadd0ae138ee814fc3c9f0315442767b597b0ff83752aed04afaf65bfad474db6fa8b22a009
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 469B
SHA256 26723329e0be8ef7f262b6ee3c0be12a730c08837da03e4b13ae88005c1e8bba
MD5 0d582c9224bd51fa017da21be940ce3b
SHA1 64052e3d9f93618b196ae30a96b6898e33b42097
SHA512 cbf0847e7c82ac9050a8ba99e2211f9ff0804880142eaa986712d44724fda1e3f3d689854493a7e51429e9a9073cf7cc379fd07d6ee9b031e6fd6a1d00ee8ddd
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2
MD5 3f8927c365639daa9b2c270898e3cf9d
SHA1 c8da31c97c56671c910d28010f754319f1d90fa6
SHA512 d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6PQpGMgSVlkFIum1z4tfLTvq/uL:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 99299a1e11f49e92f5e895339f9f83b741fa82812754043b37bfa67091187c9d
MD5 fe9dc6cad7f41cb2b40dde26bc6cdedc
SHA1 5cfbfa57c033476ab9de84407b0d9775d58c17ed
SHA512 8ee047654b146a963fd7dec40b1168bd2135b9826ca81dbc464d8acc1b77858da9cb9b49217b367d3e57942d67cc122241d12c9f53b8cb2c80f28ad825c50dfd
SSDEEP 768:GTPE6esE8lDldUGH3/Hg+P0Jq9JezBnlC7GzuNOEfpTIC8zyOW6n8kKui3IyIbGJ:8eB85d/3upC7tBYTW6nUZ3VQGKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2eec9e684a8e4fd82a855c14f3a02293e65f234bdf6bd143ad822b29c090d1bf
MD5 88fa0d90b1575de9ff082f3572dc5465
SHA1 f17accc8d0b49001d219b52412bd3bd7edbff659
SHA512 44b15ef1702773f2c8d04aa9c0fe0422e94eaf9ca0ddf885b576db03640cfbe7be90a032a70d352dfd42671e6692df354b72886b955b6770583ade73dc4f06cc
SSDEEP 768:zTiE6esE8lDldUG83/HgzPtJq9JezBnlC7JzuZkKui3IyIbGKeOW6q2R:weB85dE3EpC7YpZ3VQGKzW6NR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 c778d005fd8b976c7b1df1e458895e3e990e65f69f0c9440994f4054a0420e39
MD5 af23deda6259bb49938756f97eca5822
SHA1 fd16ea8f6c4e7c4c5cf993bf241006d84a553830
SHA512 0bd0d25beae0d71dba0897a6794f55a8f449f27fc16c24ddbb992d96d277bfb69fd73b86a8d9cca781dfc8d5efcf6544164a648268d6c4f296b7eb76f6d6bd19
SSDEEP 768:zTPE6esE8lDldUG83/Hg+PXJq9JezBnlC7WzuNOEfpTIC8zyOW6n8kKui3IyIbGJ:beB85dk33pC79BYTW6nUZ3VQGKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ceb6027d7cbdcab47fc93c409e5fcf9004cc31a259c5381c6284ebd77daa906a
MD5 984d9c2db191ad34f3ca5e27fa6b8b79
SHA1 a6c17ebdf2791e50f9427ffbfe6342243d2b10c4
SHA512 05d4c222ff5c6bce43bf5985936adb1159ab8a724b152799078313489d17750dbaaec59ac0dbf8625c4ad0cac77cd81b24d4f0d8aaff536639a4c3b6457965a4
SSDEEP 768:1TiE6esE8lDldUGz3UHgqPBRcq9JezBnlYgC1FfbikKui3IyIbGKeOW6/R:ieB85d73UGpTyFD+Z3VQGKzW6/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb
Size 623KB
SHA256 f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1
MD5 b5467605f1d5600fe6d540ebbad3c3a7
SHA1 4c52cfde3375a6fee3c1bafc6deecf77015ab154
SHA512 0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5
SSDEEP 6144:gumjr25Phow2Gqdx8UrXFMm46pJId20oJf:L6r254RdWoFNEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_262101499\manifest.json
Size 176B
SHA256 37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
MD5 6607494855f7b5c0348eecd49ef7ce46
SHA1 2c844dd9ea648efec08776757bc376b5a6f9eb71
SHA512 8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_715203654\manifest.json
Size 85B
SHA256 db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
MD5 c3419069a1c30140b77045aba38f12cf
SHA1 11920f0c1e55cadc7d2893d1eebb268b3459762a
SHA512 c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3564_855567837\manifest.json
Size 118B
SHA256 afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a
MD5 03e6b705075692ba847a04282c612238
SHA1 c49e349819bc7d2ce591fbae49377d11baebc943
SHA512 28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04
MD5 SHA1 SHA512

Submit Download