hxxps://medium[.]com/m/global-identity-2?redirectUrl=[//]amm[.]us19[.]list-manage[.]com%2Ftrack%2Fclick%3Fu%3D6d8c67a4b6d8ac086c4494f03%26id%3D715a279bd1%26e%3Dc0cf396de5

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2025, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://medium.com/m/global-identity-2?redirectUrl=//amm.us19.list-manage.com%2Ftrack%2Fclick%3Fu%3D6d8c67a4b6d8ac086c4494f03%26id%3D715a279bd1%26e%3Dc0cf396de5
Sample250613-n4f7ksek21

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4600	msedge.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1574912863\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1913907737\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1913907737\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1574912863\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1913907737\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1913907737\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1913907737\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1574912863\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133942894190569753"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3822040449-2909481938-587817105-1000\{D1A00D88-526B-4AD5-B98B-6A32C1FE3B05}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5300	msedge.exe
5300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1808	4600	msedge.exe	86
PID 4600 wrote to memory of 1808	4600	msedge.exe	86
PID 4600 wrote to memory of 1240	4600	msedge.exe	87
PID 4600 wrote to memory of 1240	4600	msedge.exe	87
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 1048	4600	msedge.exe	88
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89
PID 4600 wrote to memory of 976	4600	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://medium.com/m/global-identity-2?redirectUrl=//amm.us19.list-manage.com%2Ftrack%2Fclick%3Fu%3D6d8c67a4b6d8ac086c4494f03%26id%3D715a279bd1%26e%3Dc0cf396de5
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7fff4b58f208,0x7fff4b58f214,0x7fff4b58f220
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2424,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2272,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4916,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4808,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4828,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5664,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5872,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5872,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5856,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5312,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3384,i,1902736783759159314,17566879147266598688,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1348670594\manifest.json
Size 102B
SHA256 b2c8ee75956c3bb7ea6865137c441b916badfb99c922c17785875e784c96e29a
MD5 b0e549dcc425951a670808d628ab5181
SHA1 63c37e4fd9193836f0100cee2bf76585787ae94b
SHA512 d6dc7c7ddd5ad8ca06a831faa6bd399c8af77e0b21cfd039c608f366fb54b8d4553fc8f947a070544f472966190cf1ca5a236d1084be824b06684b6c6e8de0dc
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4600_1574912863\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4600_393504098\manifest.json
Size 176B
SHA256 7bd96fc0239229d64cc38693c64f2524d95711534c606b2b39957af8411d870a
MD5 e7314184e67b4501f5048c2e5f181d96
SHA1 f741a8a1b8c18c8d4974f937ef589b134dde5419
SHA512 773ff8228cc87677e3f74667b61db59decfccb6ca4da80a5ac5e0aff0e3102e08e6c1561df35b9ed64c8b7db8dc8ed27210c2ca0139ec85d17f9e3f57018a086
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 813783d5190d6256ccb51b6306ea34fc787f23bf883a915a6c4578989aa5daa8
MD5 0a579fb42b77341073da2124cba799b2
SHA1 cd89ec48b43fec652171372f256987e9a7319e28
SHA512 024f490e7374a5326579519fa23d33acbe5a17417ab64d02fe95a36e0166240a2b60f89fad14299cbd5bc4e97312eda0df1200613726e7bb8d91709b7e22be42
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ed4d15f20ffcb9cb4c8f41e70896a11fa73ec4e0b2e17f57310ede245c7c5a21
MD5 55b8384cf861e7e87806a92c83194548
SHA1 0f8d18cd450456228c4e9716fd4c4fb68e2b0872
SHA512 934244c4f4f5e1ec3df1619c213f75f1ca012563e12c609f4dec0e07e72a85882d47cb28b494cb819735e1964b27f39eee13426889b30e72eb6fd29850747487
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 021046dec6872129946cb938ba0cdf0df9837ed0161fba64525439b50605d096
MD5 093e8112b7931f4595ca3d31bb8832b6
SHA1 6cc17827b002e84c830c53191bcd11f82c8585f6
SHA512 7d6245b6559b7d02307834b05e9488e84f72f50898a5102490a821aa502cc7fd45b51e4909e3a627709fe29b44aaae6c13f0d7f1f81887b46ab977c0de296be9
SSDEEP 192:sVHRByMqv/Ky0Ml8UQz5C9sHcwDwI28c7sbzUlzoZ8peHY+WNC2wYcQ45WcIgCZJ:sVHwLqNC9s8IZzcyUZeHSJwnwAk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a759e9785c90480b7670725c32746234ee43244e98ccdb733001d324cb4fa810
MD5 074250649f8c94c112c85f049e24c57c
SHA1 4813cf745316cbbc8515d787941f6535533702d6
SHA512 123d7c205ac7ad489421a457b4efa3df8dbddfb2747331ee886b05dbe9fac67042a2891e873a07a47ba57119d821eb4ad9965331493fce45478645d5666e210f
SSDEEP 192:sVHRByMqv/Ky0Ml8M5C9sHcwDwI18c7sbzUlzoZ8peHY+WNC2wYcW45WcIgLJ:sVHwLRC9s8IZmcyUZeHSJw9wAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f2880a0e029ad6bbb062ec9c12bf59448b5fa7c49e918f6a46bc5f025805a2ef
MD5 281f449742ab4b42231218ff146eda1b
SHA1 8887af5798275cac851700519e6ead01460c0707
SHA512 c1ad93d2fcf2434e20c5ae0d875ef929e29e83e54cd06b7fbda47022e962a738fa6ee5d0de9e332deadadbd17ed746ba00013ecfc0c64733ea981675e575d371
SSDEEP 768:XuVwKN97pLuLNN7WF3FH58F1+UoAYDCx9Tuqh0VfUC9xbog/OVRxNqLlouPWMro+:XuVwKNrENN7WF3FH5u1jauxNqLmYWXWf
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 823aa9c338244fa1530321ae07d1ea375facb395427e7c57eda5d3fae1103110
MD5 3fa9ef0a3f4cf97a69bf545448589cc6
SHA1 e996793f8c9bdae30b86f7fbcb2b1d136908f728
SHA512 6a89464b60d75ccaf8e0d6c7bace5acf2bad3684cd09a57db8c9fd1a43437367be5936da8b2f510469cc57ebaa5e1e1342a26c6a5c1c1bf096b115d9ebc621b5
SSDEEP 192:+bBD9o3EY26+5qNcw8a+YNGpRZANJ/7XS7+1BV73Je/Cp5DkATSOIKan296WsuY4:SATSOIKan296WsuYol2bC
MD5 SHA1 SHA512 SSDEEP

Submit Download

9dc40209-c26f-4e2c-809f-775da0aa24bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9dc40209-c26f-4e2c-809f-775da0aa24bf.tmp
Size 464B
SHA256 0677041140a6ce1dec7763200457d8fe5128223df33ecb458e1c380e32b2989d
MD5 7f704f31fbfe1db2a3dba32f10135209
SHA1 0f09bd9edcf0f8d699c4eecd0b8a9b97a101066d
SHA512 b6fcc7c2ab629e6ad14c7afcde504c22be78adfa1158cc8969b3e1038a5c36910f4431dc183378a63bae02c4e5388866fa31190d31cb9eea5655b0dc05e1485a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3d8c9f2a79a56e4c546a42deccc281b018bcdff687de7ab9c7b79d6605c82c58
MD5 7bc05e068480c1322e425f3cd46c0631
SHA1 4e5fe39c14e86fe67abaae0626d390234ba9f6cf
SHA512 668e5898af9a98cc31fb8ff83b4a554249626bea426bb3fb6e0d246913bc1090fd61417ef53504f822b3f9f5667be785d2b1005906eeca3942788138cf963ea8
SSDEEP 768:cFiE6esE8lDldUGK3uCgL0hm5XSZdHCgjTIsZC5ntVuZgCbxp1PZ4k:FeB85dy36ZPgjMPJtVuN9p1T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7722c571e06ca2c99147e035fbb475dc69ea8a7966a2fa2f125898809b1387d2
MD5 d4414e408a89c7a28649347551c0843c
SHA1 eb7393e85666234f4021617420ebfea376202cd1
SHA512 1b22a359a323dfae80c74d2aea88e4fd5765026cab19aa81646010112776f3a7854bb81081a6b6edcd22baca0289c1383873047b784adda96eda1bc89e6577e6
SSDEEP 768:2FiE6esE8lDldUGz3rCglYhm5XSZdHA3NK/Kas9pUNZC5ntVuZgCbxp1V4k:/eB85d733Zi/K1UWJtVuN9p1P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 bc66fe9cb4a03215a2ae2c5a438669a8224aad9688b4ca291a99a00eacf1b11e
MD5 bd5ee77dc2f7114a0f7e60fd5ddc1e69
SHA1 4e367c7e833a9e69f9fd106ea2c7aa3b70328eef
SHA512 0230b12b3036933cdf5986fed547733a2ec6aadf551b0b0c59638b9aaa70c33759c268009d1838cc03157753377688c98070775b023e35c4708ebd91e06054dc
SSDEEP 768:oFiE6esE8lDldUGeW3uCga0hm5XSZdHCgjcIEyq7ZRgRjp1w4KZC5ntVuZgCbiD:ZeB85d33jZPgj9Pqvsjp1hJtVuNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\crs.pb
Size 291KB
SHA256 8ba4acc8582041e5caa5dc4c73ade421b52a8b018e70f12b7a1437f74c6a955e
MD5 916f38644626b7201f29c01bc659525b
SHA1 c259bfd1ccbf1347b6a0bac43e7aead100ca7092
SHA512 33539525ec8bf13ee832365994dd6b3bc2162ef64e032baa1ab6e45d701125d08009504c254e85b763b69abd93f10366a4b44e5e62f7705c988c089aea447d19
SSDEEP 6144:Ky4Ljibb7iVpROS11P1VW+J2i/7ea66k8LyST+uUT:KHOfWVpEg2GaKQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\ct_config.pb
Size 11KB
SHA256 6a350094ab9a19b758f6660a58afdecc44e83b3ce8c3521fe3b831d5945a3911
MD5 4fdf7c8ca48768f459c97b25fdd10d9b
SHA1 d1f0ac34a53294875dd7bc03dfbdf5c7ae65a4d0
SHA512 7322c942946b83ed8cf8875613f72ab5fa5fcb4ca1671bba22bd02404546f8ce099b2941cb0897b3209aecb85b6ac2f1b98f2d11678e5304b55ae3974192042d
SSDEEP 192:svQhSmjvBneXkNRwlP2wvGx+tJv1Vm99JQSzvg1bGamdiE1g3VCr+BHC4YQkYTka:s4ouJEmWxpvtJvzm9DQyvgE2VFsioTX2
MD5 SHA1 SHA512 SSDEEP

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\kp_pinslist.pb
Size 11KB
SHA256 2efcd280779456d767025a4f2915012cb9b11af2b8e199d3f32152232bf09460
MD5 563bdb2192acf2c106832f696df5d84c
SHA1 898eee38d08e09254c39dd0d1707c98f95cb2fa6
SHA512 550e3dbaa0a5d74763465318b6f14035e16e1d70602ca36a5636d159875b527fae51f0c7f81e380797b4871283dbddb964017e7a16857228a621284d7aef00f5
SSDEEP 96:jDqHz+kvK5lgT44Zuxk+yBMVnzowGbMAy5z5tBT6c5MUfFwnIXq6g/8RBmVLm:vqTZvK5ykfVngQ5jlMUfFwnIl3ULm
MD5 SHA1 SHA512 SSDEEP

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9b4f5666d51f792cf6da3041583681cd10f0feb10a75947541e3222471ecf1a
MD5 4fe1c2a8f1101f7bc87e4b6c5dbef25f
SHA1 373fe3bbc7ecabd322f1aa1e8f02cb68fda015b0
SHA512 9b91788a36d1366a870ff23231cf5fb811ae42eafe5701fec8e39b8d62ad50eb9e3dadf6643249316262322ce277f2bde81232905ee0da6859e27240d0da8296
MD5 SHA1 SHA512

Submit Download