Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2025, 05:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://chandrudemo-my.sharepoint.com/:v:/g/personal/mohan_chandrudemo_onmicrosoft_com/EaTRv_9Sp4tMlu4dj45bBG8B8EbTwfH977DbgngKKhA6pg?e=bf7nJW
Resource
win10v2004-20250619-en
General
-
Target
https://chandrudemo-my.sharepoint.com/:v:/g/personal/mohan_chandrudemo_onmicrosoft_com/EaTRv_9Sp4tMlu4dj45bBG8B8EbTwfH977DbgngKKhA6pg?e=bf7nJW
Malware Config
Signatures
-
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1406784332\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1501975298\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_850683249\nav_config.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1490693727\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1490693727\smart_switch_list.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1490693727\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1406784332\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1501975298\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1501975298\protocols.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_850683249\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_850683249\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1490693727\office_endpoints_list.json msedge.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133959957926884091" msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4097847965-469305640-2969917343-1000\{BA7D4A95-70EB-4805-AACE-2F61FF1D8200} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3500 4460 msedge.exe 86 PID 4460 wrote to memory of 3500 4460 msedge.exe 86 PID 4460 wrote to memory of 2784 4460 msedge.exe 87 PID 4460 wrote to memory of 2784 4460 msedge.exe 87 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 3896 4460 msedge.exe 89 PID 4460 wrote to memory of 1888 4460 msedge.exe 88 PID 4460 wrote to memory of 1888 4460 msedge.exe 88 PID 4460 wrote to memory of 1888 4460 msedge.exe 88 PID 4460 wrote to memory of 1888 4460 msedge.exe 88 PID 4460 wrote to memory of 1888 4460 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chandrudemo-my.sharepoint.com/:v:/g/personal/mohan_chandrudemo_onmicrosoft_com/EaTRv_9Sp4tMlu4dj45bBG8B8EbTwfH977DbgngKKhA6pg?e=bf7nJW1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x31c,0x7ffd5b93f208,0x7ffd5b93f214,0x7ffd5b93f2202⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:32⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:82⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4160,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4236,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:22⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:82⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:5304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:5288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6084,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6256,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:82⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:82⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6424,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:82⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6556,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:82⤵PID:5528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:82⤵PID:5924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:82⤵PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6468,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:82⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:82⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:82⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3596,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:82⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4300,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2788,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5180,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:82⤵PID:6132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=860,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:5820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6472,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5092,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:82⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:4736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD5af3a9104ca46f35bb5f6123d89c25966
SHA11ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA25681bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA5126a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
-
Filesize
160B
MD5a24a1941bbb8d90784f5ef76712002f5
SHA15c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA2562a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
SHA512fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
-
Filesize
134B
MD5049c307f30407da557545d34db8ced16
SHA1f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA51214f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
-
Filesize
160B
MD5c3911ceb35539db42e5654bdd60ac956
SHA171be0751e5fc583b119730dbceb2c723f2389f6c
SHA25631952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
SHA512d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Filesize3KB
MD5f9fd82b572ef4ce41a3d1075acc52d22
SHA1fdded5eef95391be440cc15f84ded0480c0141e3
SHA2565f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA51217084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
-
Filesize
280B
MD50fd4a0e92c8a1897aab600ab92275489
SHA1857ac84f0fbcf53dd9eb0f49d34258ed0d559476
SHA256d1235f9f2c9d3af7e9b1db3aa48a2ef252e0b763879024da51f12da3829a9251
SHA51245954b0954e5b382af0dd8bf420511347e661efc6497eca474f54683066209d88cedd20031539cb7de15bc306e18e6aa6ef9892023a82a567b6d2633a039a831
-
Filesize
280B
MD56481d4385cab00f18e19f815bea6fe7c
SHA1b8df1e58539491f552cca0a2735bf1834ef6c3e8
SHA2566c5841beb22d999d61f7b58e0197b1edc24649a0f7eb202e7b46173df29f009b
SHA51271d09192d4400afaab1545854d61bbcbf994a9f3d764fa6e8c697b6eb974837e511cbd45fd69d43d713ee8960dd9b8d22759a1eecb664ba087e91807046a4fe6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5dc2f9714cf83ab601e0fb4eed4c55f52
SHA1a03cec3a6449c001ffb414f2010b760bab88cb10
SHA2562b7be1f6988016f43b06168a306a62a259aae4ac4344efe799640d5fff40a56a
SHA512b3751b7478c652d542eab5838d2473dd11833c9ca1e225833972a21d2d26154fec5f37b11f6c92c2f19e9b8ea78d5cdd1b8b67fb12606904512263abc5c59141
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d08e.TMP
Filesize2KB
MD5cc6b2b09437b557e912ddb1607c0416b
SHA1b6d6d3564effb867176914177a9c39305ee930fd
SHA2567ce149b3c513d81bf4e36bae21f5b41515daf8a4fd12c7f5221da66d8831c97d
SHA5124da7bc5255d42485e2e54ef0be32f3e2a26870be69452cd9085b7e2b9cb1e7f60e0fcccef2b9e9bd6134a795f160877246f2e9864aed546e80739df2352ac6ab
-
Filesize
69KB
MD5164a788f50529fc93a6077e50675c617
SHA1c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Filesize9KB
MD53d20584f7f6c8eac79e17cca4207fb79
SHA13c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA2560d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
-
Filesize
108KB
MD506d55006c2dec078a94558b85ae01aef
SHA16a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
-
Filesize
2KB
MD57e31d0b3c396e400eb92f3e8a6ec7a1c
SHA199d2d114b8ccd364e4a8a77195c3df3d8dc4acc8
SHA256c63538b20b724313e06e736cd89d6ee30210c058513e7dcde8ddc81203671667
SHA512981ff7a43d50ab4d0e6ee8b782c19e84378a013b8f5b30dc247d690c470adc06b6738b92fbc0fa46608101f45ae1b3f4889436ae373cdd144f3718bdbd7729cc
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
13KB
MD5033a48477bc9fd8705d9ffaa20e0025f
SHA1f7202e3209f7d1f67e5583dc788b6a561fcc32b1
SHA2562849309d148e8e80a7d625fda7e2d4a1a2f9dd995f6d4f9f98960776ad006a00
SHA5124bad1dc558d0bd716019783d47cae530e9d9e3fe1b535793beea7549e92711583095344350fd8db3723c47e898f00fb89646061cebc883942fcf6fa3f1a05aa6
-
Filesize
14KB
MD59b5ac539ad9a28a98c24072d7221e270
SHA1242f1c2dbf97976d8d7c056f9bcab204c8cbe25c
SHA25627b5c0945cd4df94d96877fe60b9e153a1b387d2659e519d3edfd03a28afb487
SHA512f9aff2e65b33a3e5fade37554052d4393a63cb635ef803cfbac4230492f4515c4a675b4642e7e96d09c42f90876473df8959e2d92420e0459ef53183c28cfc8b
-
Filesize
36KB
MD5d68660af180c59c417749397d2666a46
SHA13ff836742d4a86a0069617d8ba98bad93f6d61ce
SHA25601e1df713de897ce3531d8d9af7c992201916b30f8fe3b7a4e9267a4bb42ac17
SHA51219dbc372e3873386c74d6e1b189a2597b6b1b59aae03084b348b15a0f38f6a4998237e559464d2c93523174fbe0e0f2f574f3fd21379fd7848c7ddf09fc6ea6a
-
Filesize
4KB
MD5a59b04a466ca677b9293e4d9535c972b
SHA19b0d126688f6d72d5732cd39ff49a8fffe721dfa
SHA2560458ed779eea715a5deb20e53b83cefb845f4690499c1fd7e1964504790152f3
SHA5126b42e4c449475eacfc525ed4a8747ac4d63c4a6a2399fcd0c0ab09fcdc63d92a4bfd134ed408462faf347fa6a25c3fe328ec6bbf3fc1531aafb0671c90b9ec73
-
Filesize
872B
MD56876b057c31deb7d9aa6f9b862468776
SHA139737be3276f770c18886c4ab92381e776b12d0e
SHA25695be12d689fa87c6ce0533526a1b2701d24169940eb8ab7c62e1ee9159bee834
SHA512e4a8117786b69af88fc808620a0b896ca24f1b4963f9d48c6ae71d6f17df91c52d716ceb79af57f84b52119bf46aca2b77db0ab430e4066422407cd55f7503d9
-
Filesize
24KB
MD51eb56313e875ad89dffae3a15b9f3ba3
SHA1f2a213f4e6e2f4c182dcc12f2907ce426f7d09b8
SHA2562bc1ea215878bb92254916a252a69a0c82dd343e1b2eb8f4c36d434e7cc977ae
SHA5122df86e139168c55d1e05967919072cf18018ff405e7c4472dc17fd63e28c17d587d811e1dfe4110980f73fe9859b603dcd92f6ad93d18731a0709133c96d8dab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58537a.TMP
Filesize465B
MD5429c6e9dcab1dd15d46c5b3dc99abe69
SHA1cc4583e7d4d3046b37adcabdeb452018566480aa
SHA256777c791f52ac1bdce995f7cf8ec20ba3ed1088cab5e5bfd855ca692e9a92d175
SHA512cc1a22774262063ea34fbfd8e6edc7467c4035bd113ffa0f1d7c21421dc783e9bf1ce12d71706e1dddcd1ff219dbcf32effa66f44bf97c04507ea61090258b0d
-
Filesize
22KB
MD5f768bcb451a187c18099961c484eef8b
SHA199472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA256d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
SHA512a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5857ef.TMP
Filesize3KB
MD5904e6e94a1d46374c8630cfd86cc729f
SHA1e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA2568b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
SHA512081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Filesize3KB
MD594406cdd51b55c0f006cfea05745effb
SHA1a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA2568480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
SHA512d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
-
Filesize
18KB
MD50554d1dbf528989f5bac057cfb0bc8df
SHA1602e06af5d2766c005588e7da5d2226b99b6cd9c
SHA256aa9c19dac5551763da8e92c315b37247f0565ba5ba8a6b4131d8854319f7a6a0
SHA512bdd28fe96c30134656f29e022074ffcbab7a1a0a247dd16801168e0833fb6fdb70c8265b7d825cb83b66524bd7950f85bd4b04f9c114e6194b759522a24f29f1
-
Filesize
7KB
MD5f7e0fe5b3c2b7bb47c789bd91ba1a21e
SHA1c6eb9d6f457270c33965f69bdcab56c77c510b5f
SHA2565af73f6c8e403f34296008f24df7b26340edabafd4624e8dd8df434695fb220f
SHA512984489db82a0c3678982f5302e308e840cc0a0b181fcce4e8bce9e856e4fa15b6cfd8e22d6cf0fc0171d26dd2475b3cdb1592d895133d532c1fb6493ab8e4afb
-
Filesize
37KB
MD594c91a5b83148a32e0c2b38e2502e1b2
SHA1c6bb635102defd34d8b7a1d5a92ed67f52fb4e3b
SHA25626ab51be27694cba2e4701864927a8a23eec9d9c84d06745e8f1db6f14e276f2
SHA51243eaa52c978ad9fbdd36f021b6aa2c58225e99c8a48034ca51fa11538dc82029bfe6c4ec806fc0655b0344a866ebc987ca16eb74a5bcb120d7cfdc8e456de04f
-
Filesize
28KB
MD5b15081162370c4d1a562f1a83cbffee8
SHA1f8e5c7b193ceacce0ba5429966cc5e1f16ee59ba
SHA256f89cf2704b62a6909f38815a72cc38a829244aaabd18a18b44e21fc35df61f78
SHA512e0827246d532b5237be8dfa33f5864c28fef1b2c7218e5e5254d35ffc5a1288d9e22cfac7bc403efcfdd713aa80a475624dbd014687cc614f95769132bfef88d
-
Filesize
7KB
MD57d51a3c8d1f5bd169c07fcba3dfa49b0
SHA181bb38db26262f82fb7c53217346dd50f36f058c
SHA256feb87eadddf4cccc8f3afcb8e54d0dcf2f51dc19fffea7aa373d4dc2a7cd0960
SHA512695fd517706b8211b3712a94253186e1e1dcad657f13da69f9ab61933b95dcbc773ed7ef3ce2df74e1872f82b3def6ac95b04ac4620245fb373b1a5ca28523b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Filesize2KB
MD5499d9e568b96e759959dc69635470211
SHA12462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA25698252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
SHA5123a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5f4f751a4bb0d2cebeaad4f3c297b46c9
SHA15e587571acc49a589c20e2108a86d0e2c10b0c3d
SHA256ac413a7eb73bb33613396b205801508c9c10ae2c265b52f731571b30de74255e
SHA5128a118ea55a3b5bfa454821e1b650e2324a7337bb712a4e7ec85c51d87d4d0335d48f5c4836c0a3f22f08d65058ab891681740a5fbb9e722444970de99db70fec
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
10KB
MD578e47dda17341bed7be45dccfd89ac87
SHA11afde30e46997452d11e4a2adbbf35cce7a1404f
SHA25667d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA5129574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir4460_1569078651\1424e1fa-d0e2-4669-8be2-38d2dec0ddd5.tmp
Filesize156KB
MD5b384b2c8acf11d0ca778ea05a710bc01
SHA14d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA2560a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
SHA512272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be