f6cc0f77262feca3dc6efe46d69557dc072e5197f31182c71bdc099fdf1b4af5

Resubmissions

09/06/2026, 16:13

260609-tpchqsew9q

05/07/2025, 13:22

250705-ql79fszls410

05/07/2025, 13:16

250705-qh6w8ayxcw10

05/07/2025, 13:15

250705-qg8dnazky710

Analysis

max time kernel
63s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2025, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rpd/OculusHelper.exe
Size 17KB
Sample250705-ql79fszls4
SHA256 8fed1915baea76b43e8d75bc49309fc2ab5b19ec6ee6bd86bbb7d5e7d5baeab9
MD5 f8db10a4fe83f160df693b88c8ac0d94
SHA1 8fb7dfe016d60d20b20c2e50fbec33fac80aa986
SHA512 5776bcbfc5094be137234b7d84c54530d68a8663fb3644a3827cbdb7733494f46c96d4dfe5862a87d5d3d0e624ee3cf1bf99c847d9e7dc4222745f04e915a251
SSDEEP 192:nzVOpVcd/bWWR9LY2+/T9adrMAFbA9m99u+HKEFxd+4vnmyTqiVlR8eNJZ/j:nBOGYnb9d59mzu/EFxFmypzZ/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3772	3180	msedge.exe	127
PID 3180 wrote to memory of 3772	3180	msedge.exe	127
PID 3772 wrote to memory of 4916	3772	msedge.exe	128
PID 3772 wrote to memory of 4916	3772	msedge.exe	128
PID 3772 wrote to memory of 728	3772	msedge.exe	129
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 728	3772	msedge.exe	129
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 4932	3772	msedge.exe	130
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131
PID 3772 wrote to memory of 372	3772	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\rpd\OculusHelper.exe
"C:\Users\Admin\AppData\Local\Temp\rpd\OculusHelper.exe"
1⤵
PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1565668fh25b5h4c15h9aa2hdfa0046df1f8
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1565668fh25b5h4c15h9aa2hdfa0046df1f8 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9d621f208,0x7ff9d621f214,0x7ff9d621f220
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1828,i,2611327099834725564,13102907667465102615,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2384,i,2611327099834725564,13102907667465102615,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2308,i,2611327099834725564,13102907667465102615,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3492,i,2611327099834725564,13102907667465102615,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:2
    3⤵
    PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1235f9f2c9d3af7e9b1db3aa48a2ef252e0b763879024da51f12da3829a9251
MD5 0fd4a0e92c8a1897aab600ab92275489
SHA1 857ac84f0fbcf53dd9eb0f49d34258ed0d559476
SHA512 45954b0954e5b382af0dd8bf420511347e661efc6497eca474f54683066209d88cedd20031539cb7de15bc306e18e6aa6ef9892023a82a567b6d2633a039a831
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6c5841beb22d999d61f7b58e0197b1edc24649a0f7eb202e7b46173df29f009b
MD5 6481d4385cab00f18e19f815bea6fe7c
SHA1 b8df1e58539491f552cca0a2735bf1834ef6c3e8
SHA512 71d09192d4400afaab1545854d61bbcbf994a9f3d764fa6e8c697b6eb974837e511cbd45fd69d43d713ee8960dd9b8d22759a1eecb664ba087e91807046a4fe6
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1317deae2279884cd2c5ec7a5d2b04de2a6ca68e783a22f9356ea15e8661e56d
MD5 9dcdfd811e1cf1389be9f700dc2e5561
SHA1 7cd1feb8e743b1375f6653e11495692157c4d0e9
SHA512 34b956add66abb97157284eecffda295b8b5442a6058f2c9dde4fa260f787b292f991d2fbf5228961d32aa5952767a0df9f4238036c4c05bc99ae59df065d870
SSDEEP 96:sfiEVWbFrscEHb9Pk2XdW8i046W6ZlmH9qx+WVoMpm+uecaYQjneXjbd4UhgYVDu:sfUbFrsNG2NW8p+HY+WNrYsmjbdphg3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 5fffeb37b5f684a5f1528a402dd0ffa56a8c91766e89cbc28032b22eaf925a7f
MD5 509890151568fab14ff6c13f753cf21a
SHA1 039f464982f7fdb2003f67d91b14ee2921bb5b75
SHA512 de6c7fef5dc1156aed46e2bc423ecf488d80cbfb1e41627724cbe5c30a3b5a8c48195ba9cd2adc09acf581445426f24dc4ba7d6b59920d596dcecb0b0eda1137
SSDEEP 768:kF2b458WF+CA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVXZLljpmnPro2R5MCt:kF2b458WF+CA6u1ja2ZLBwncaWCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 0827df385a4b72b7a59efa32581cec523ec326a19aee43c0fbeda1967e123322
MD5 b2152bcd765a3915706ed22d9d330a2d
SHA1 7b6510ae1afd511a3d88e2b7138f715e1a40afab
SHA512 31727dd7142cd9d9e46e6079658785bdff8544b40e1eb7f5d389c13f2b2915c5a959798beecc9e9abe92a672695ca6091c90df38f478f30cfa4021a0054c995a
SSDEEP 96:4qONkCyUf4tF5ih/cIVURLl8RotopDs2pBLP8v0lPxjpn+SN6rHe4mJykqk/SDSz:jONbyhQWiRUcbtVn+SN6rSyBkbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 eb45ee353dba63b748e2ff47f42595b478e1cceda705d42f9d3e2184ac985eee
MD5 f58f192a7e378a5d7ceebb3eaea351ed
SHA1 cece6bb256f790c500ea3920521e58f82d13c150
SHA512 26e6f5f95b2fc6543b50051055ce423515930bf157221ae25f4fed447851b70fa024d5be15689afe6ef7da5d8c03f0b66dadc9d8ea72ba49756a714505378ea1
SSDEEP 96:4qONkCyUf4dF5ih/cIVURLl8RotopDdZpB7P8v0lPxjpn1Px/7CZ+igM6rHe4mJO:jONbyhgWiRUmrtVnL/7CNgM6rSOYaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91957d8822a8171405b2045e537ef1ba4eb3c426a172dff7568d81852f8d4387
MD5 ccfeda215c1f070f4099ea12167f822d
SHA1 49f68feca34515993086e0f95fb153b8a00c021f
SHA512 09a615dd3bc482f2b0eec7548d512d1746d0e8cc271c4290c5a8612b886c37a4ac4ab1a4aca76f88cd95a0577cf20f411e6c7e4e5519405be56716bb6048233b
SSDEEP 96:zuNqsNkGSaUf4dF5ih/cIVURLl8RotopDd3ZgB7PACv0lPxjpn1Px/7CZ+igxTeO:zpsNBSahgWiRURrMVnL/7CNgxGOYaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34db5ec055fc05bbadb3bc05db4d49a84f00d9ba42460d180feb64acea6817cd
MD5 2560369a2ddbca63ff1dbbe5d95fd632
SHA1 e9b5b6c61638b8bcfa054131e6db2ff81eb021fe
SHA512 9f8f628abe0f9790b05b012e70b3b0b035b1a772429136561ef33cd26fff0308b17544c182fe2a5648d85f2c09ae295c97d13363fcac901aa8d6be196ff4279f
SSDEEP 96:zuNqsNkGSaUf4dF5ih/cIVURLl8RotopD6ZgB7PACv0lPxjpn1Px/7CZ+igxTe4x:zpsNBSahgWiRUQrMVnL/7CNgxGOYaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4668-0-0x0000026EA4480000-0x0000026EA4488000-memory.dmp

Download

memory/4668-1-0x0000026EBE980000-0x0000026EBF3A5000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads