hxxps://cdn[.]discordapp[.]com/attachments/1548229741897719848/1553170857051029514/MrmCoreR[.]cpl?ex=6ab84694&is=6ab6f514&hm=9eeb2b6a9777b48bff2cd43646c44601e650f1f9ad814ba2bac096d37897c836&

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1548229741897719848/1553170857051029514/MrmCoreR.cpl?ex=6ab84694&is=6ab6f514&hm=9eeb2b6a9777b48bff2cd43646c44601e650f1f9ad814ba2bac096d37897c836&
Sample260925-2cvsjs1tdy

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
55	4300	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	3828	msedge.exe

Loads dropped DLL 3 IoCs

pid	Process
4300	rundll32.exe
4300	rundll32.exe
4300	rundll32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
53	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{09057BDB-13DC-47EC-ADE8-1BB3247E32FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4300	rundll32.exe
4300	rundll32.exe
1932	msedge.exe
1932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	rundll32.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1372	4472	msedge.exe	88
PID 4472 wrote to memory of 3828	4472	msedge.exe	89
PID 4472 wrote to memory of 3636	4472	msedge.exe	90
PID 4472 wrote to memory of 3636	4472	msedge.exe	90
PID 4472 wrote to memory of 3636	4472	msedge.exe	90
PID 4472 wrote to memory of 4216	4472	msedge.exe	91
PID 4472 wrote to memory of 4216	4472	msedge.exe	91
PID 4472 wrote to memory of 2504	4472	msedge.exe	93
PID 4472 wrote to memory of 3144	4472	msedge.exe	94
PID 4472 wrote to memory of 2504	4472	msedge.exe	93
PID 4472 wrote to memory of 2504	4472	msedge.exe	93
PID 4472 wrote to memory of 3144	4472	msedge.exe	94
PID 4472 wrote to memory of 3144	4472	msedge.exe	94
PID 4472 wrote to memory of 3468	4472	msedge.exe	95
PID 4472 wrote to memory of 4872	4472	msedge.exe	96
PID 4472 wrote to memory of 4872	4472	msedge.exe	96
PID 4472 wrote to memory of 4872	4472	msedge.exe	96
PID 4472 wrote to memory of 3468	4472	msedge.exe	95
PID 4472 wrote to memory of 3468	4472	msedge.exe	95
PID 4472 wrote to memory of 1740	4472	msedge.exe	99
PID 4472 wrote to memory of 1076	4472	msedge.exe	100
PID 4472 wrote to memory of 1740	4472	msedge.exe	99
PID 4472 wrote to memory of 1076	4472	msedge.exe	100
PID 4472 wrote to memory of 1524	4472	msedge.exe	101
PID 4472 wrote to memory of 1524	4472	msedge.exe	101
PID 4472 wrote to memory of 3044	4472	msedge.exe	102
PID 4472 wrote to memory of 3044	4472	msedge.exe	102
PID 4472 wrote to memory of 3044	4472	msedge.exe	102
PID 4472 wrote to memory of 2688	4472	msedge.exe	103
PID 4472 wrote to memory of 4408	4472	msedge.exe	107
PID 4448 wrote to memory of 4300	4448	control.exe	117
PID 4472 wrote to memory of 5108	4472	msedge.exe	134
PID 4472 wrote to memory of 4520	4472	msedge.exe	135
PID 4472 wrote to memory of 1744	4472	msedge.exe	136
PID 4472 wrote to memory of 5220	4472	msedge.exe	139
PID 4472 wrote to memory of 5220	4472	msedge.exe	139
PID 4472 wrote to memory of 1932	4472	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1548229741897719848/1553170857051029514/MrmCoreR.cpl?ex=6ab84694&is=6ab6f514&hm=9eeb2b6a9777b48bff2cd43646c44601e650f1f9ad814ba2bac096d37897c836&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ff9c411c188,0x7ff9c411c194,0x7ff9c411c1a0
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,4262512317800939202,12081171100322590942,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,10254432759244699392,12545818650909819634,262144 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,17165685635158882304,2924163340000266756,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,4137787218678164256,14137176931742536099,2097152 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11310656560685754680,3607198541522809959,2097152 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,18110195170548293704,7770044289468113706,2097152 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,11997895151665562548,15374959370287873586,2097152 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,10315182633741274225,1864701902496491496,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,627368267908193992,17322052255981891125,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,624422987788514842,1698093421155684625,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5752,i,1575635767902601386,13653191460847061925,2097152 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,726692894712152620,4209450772143410507,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,2852376757962278720,17885457045524349443,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,2852376757962278720,17885457045524349443,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,8124840568135060990,9191903032258814332,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,7961546275605349089,4207225291038027467,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,4464008472065449100,2767589358700732775,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10843163718353703610,11646619714247122576,524288 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,2155090064105564505,3673505249365380655,262144 --field-trial-handle=2352,i,17768474643704062510,14834731204166584892,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4508

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\Downloads\MrmCoreR.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\Downloads\MrmCoreR.cpl",
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 41a0f881a96c0e3d5ec4553815b8877e73026483e97350f267a838e7991a75bb
MD5 8623e1901cba22ae8f44cb04982db63e
SHA1 0cb935d73b3bfaa0d5ee508a19ff6c8360da0feb
SHA512 2fb4646f016622d30c8083ac0506f4813e63b470e168cf5020c6e192e269c4018edcbba5d4d19d82c084f54598f4b67cc69be9c6e92b60930fc411a7a43e4cd9
TLSH
T1F4415442CA5028A6FF9485BDC9D41D9B3B709C91ADC3CE1703A7C4BEEE76F724604258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5909f9.TMP
Size 2KB
SHA256 8448a925adbb891aec25597e14b5cb8191ec86efb407d0db76d75948812e3301
MD5 ded28e2aadb8bbf97ea1d4e7c3824ff1
SHA1 17d0026ea848d0fd7a2784aa02fdb4d865fb2909
SHA512 326ec60d61c0a328afef2a4bfb03e84d3186693683d555fde07b4b56a49ad5f268d098ea4d559fed5d0b8615ff7abc1d932dd7c875b208494600da073bdff319
TLSH
T1B0414342CA5028A6FF9485BDC9D41E8B3B709C91ADC3CD1707A7C4BDEE76F725604258
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 452090762ee89984f3a9edc83fc2c267f51df9a2c2c050d44180faf6d799d7d0
MD5 e3d92767a1e080663acb96cf5310f7fb
SHA1 04e561e68b891275a601372c99fb0d3df760bde7
SHA512 a226a3c0929a8c282eb970283127b7d8bc820d755914a5c2b92fdd6272fb2930e2e2b6e380b9d74d6dd63001f11d3b0a5f54fe1a56739e92cdaae2525fbc1bf2
TLSH
T16A21CEF3C3D5856EC90556F06A14AE1BCE1D052542283C1AC9D4EF6BE7E3076E001A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9c9c671f4be8b0fe095a1448c2591297daaecd417a81d48f73038848e8a89345
MD5 96c4be24ea723f8ed9807b7937a7629a
SHA1 c951982b702f06c9da15a7b968d8b2649687b9ee
SHA512 bac907c1c4af0d977bf89a5b5fb38d729d7aa8173e4a5cb601e5eafbb772f178c746eba1f2caa66d60d8b9ce93dd6fcde1ceaf461b3cff11b377e0151f2adf5c
SSDEEP 192:sxZoRJnm/fLsFSIdpJHW6+WNGYYB8xMIgrJ:sxZojm/fLsFbJHbGf19
TLSH
T17D12B5156E28A57B8CCBE20DBB257F53E5FD5032A1911E98EAFCC61C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b16df4eb676e1cd7d449a7e6031a48c62e5102302a44a1dbaf21ad95b71b01f8
MD5 e8024faabe81ed516e6ecb942147bce8
SHA1 c1846175119eed263cfdd58a0764ad1edd07c15a
SHA512 c198d7ec88d6aff38d14f3ff97fd15faff01190f997ce9e57c299d0aa9f329942ae56e44ccea689f0b8c2df1355c213d0f89acd8188aa4a5c3836fe9bc921a3b
SSDEEP 192:sxZoRJnm/fLseSIdpJHW6+WNGYYBuxMIg5HJ:sxZojm/fLsebJHbGfjL
TLSH
T19322B5556E28657B8CCBE20DBB557F53E6FD5032A1911E88AAFCC71C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 050576aef6b1ceac18a775e895ea114b4f322cac1d18f0133668755183e55ef4
MD5 98208ebed22efc3ddf8ce0d33e8f5919
SHA1 989ed908a57758f042f4366cae9bbdab381c69aa
SHA512 a6a501b5034798195c660bfbf174177d0265ee4b9ee19b2cbc901accf36f0639d9723cd2ac024dc84d8a81d518fdeadd113dd5524012d7c4872c1d11e6d69e67
SSDEEP 192:sxZoRJnm/fLs1SIdpJHW6+WNGYYB8xMIg5tJ:sxZojm/fLs1bJHbGf1l
TLSH
T1AD22C6156E28657B8CCBE20DBB557F53E6FD5032A1D11E88EAFC861C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e1f5cd49ec1b69cb56d799d54b5a798b23deee49b8e9f29a1ab63160bf6ed37
MD5 6dec37a28c2dac87badfb7c55e380316
SHA1 37d8e0ec06629c64bb697dbf6a057479f68e333c
SHA512 914c28cdce4b424863783ada2a83d2e8ebed425461e7b23a99f44a586f4e60e3f9bf73cbc5b69eb2ebac8b59200183d90f16e39c1bdfd9f68f6453c7dfb8cbdb
SSDEEP 192:sxZoRJnm/fLseSIdpLHW6+WNGYYBWxMIg5HJ:sxZojm/fLsebLHbGfbL
TLSH
T12E22B6566E28657B8CCBE20DBB557F53E6FD5032A1911E88AAFCC71C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df94ba6738769d45fa0ffefe35d8e23e6534689648c860b17f347895c8571e8e
MD5 70584a180478290fd25e622338cae0db
SHA1 e0fbf6e14777b61ba74d7d8c4a48ec7f7feeca2d
SHA512 07d72f147b93ef83876f63d983865f52b06e4b29999ae378f010cc3549daf452a2086a3040253322ad7fd51e75d8def0fe9e66588d0d3d9824d713d722307343
SSDEEP 768:WvyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXpropPIW:WvyYR7jWv3NpBu1ja/CL8OXCl
TLSH
T1F6C2E92F640DCB7E4FC01A9DDC5A6FDB3E9802C7A6548D4047FA954C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33f48a18cbb9c012816b1399dfaa01b0cad62db03f7b3747f0812949c489194e
MD5 1936df93e2c457d4911cff004f79a3db
SHA1 80a031e3c3c6a58b86c263edf42039c254b7986e
SHA512 4d02f32844aa5d83d0a94d957f63fe0a81531fddd07662cc2f34ebf0b20b6e7cc1c39f0634a0be549e059cfda7b3e0b0714ab594e829ec81b664d6d256b3eefa
SSDEEP 48:KgjGnDtFVWbFIdISDWK9z1hWxrGYQxjHyLxgNBLPTsbfq3ISZsK95HfI9KA8gzy1:KoUYKxayaSwKrHf6KA8+m3SKJ
TLSH
T1AF917904327F0200797E259885A49A1F964132B73158E77B7F6844A28E1BE1D9DFFDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

810efd69-a069-4115-b584-81b5f1fc9d23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\810efd69-a069-4115-b584-81b5f1fc9d23.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e4ce75fef912c784ee7fa8d05b371bd902fcd788f9157d1f44352b1596715c8f
MD5 efa0256c19188c8034c5a69ecf302c12
SHA1 272b30e563edc090df5ac1f671547fdf2addfda5
SHA512 bfe409c57701efe2c8fe182fcbef979427950e36334851106bb5776990b1050e1647ae574361d632594b74bc9c07c5778cfca60e78ea36a521bc5efc67fce4d9
SSDEEP 384:GZcIFsNkdbU4MiiBr/QX5+Dtv8XLFXPJrrWDtgOIwZOyDLQol:UFuwookDuRPhrWDXsMcy
TLSH
T1AB827D36A9B8AC7B5DFB9181B04A32139FBC5467E2C57BC0D5FC6B1D01E9698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 42af7d4028b2dba0b8ac5a55aac83e4305a072a01200fa978d9599fc0e9dbcfd
MD5 f7c5c368a3d4cb6344a2c48e22a8de8f
SHA1 419205d2c8169946a91ea8a3ad2b8832ade8fdbc
SHA512 74c00a16366747509fa96aedcd9509241ab42387e4e7948704dd2216aeebc091cc1374ac3cec32ce3ce76e7d40e1d0bfe26566474a77f8b861f78344b5443e69
SSDEEP 384:1iFDZcIs/sNs8TUNTUlIl4bU4MiiBr/QX5+Dtv8XLFXPJrFWDtgOIwZOyDLQol:8FbsBwgZwookDuRPhFWDXsMcy
TLSH
T130A26C3798A8DD7BADFB9A85B54A32138EB85077D585BBC0E7EC5B1D00D65D8030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 84e31e5c0d3fd06496f1e35367ee9fbc63dadbeb3259d8650ed109de519d3f2d
MD5 5cc407c814d095fcf5fbcd0779d01865
SHA1 a00b9085f5525beaddcced7579cbb98337da2be1
SHA512 cd5bdf83aa553378f83274797a70d208e5069f92b4a56b46a22a5cbd6b16764f0322e7437b47c64b7849aa852e3088f247f5704960b6f3faa748c41ef53dbfa6
SSDEEP 384:EZcIFsNk4bU4MiiBr/QX5+Dtv8XLFXPJrrWDtgOIwZOyDLQol:iF7wookDuRPhrWDXsMcy
TLSH
T15F828D36A8B89C775DFB9185B04A32139FBC5427E2C56BC0D5FC5B1E01E9A98130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9f1333a4160e5353aaf16567946f199bc16fa5d2a40b79bf0e539bbb5aa2443
MD5 9317af390abcbb4669ac5fb61c3703f2
SHA1 ee45015b93894112e724a8c5550bbc625a4f061d
SHA512 ca2fa81046b8beec22181e2d61571dea41dcd28f7c0ba71ad0e72857ca783c6c4a67fd985a2a055569a7d887877b8c39469b32e1df9baad2aaf498c267934d1c
SSDEEP 192:EONw6nnHGQmiUyYkQYcX5hQDP1HjzorMoLCMcwzU6:EONw6nCEQNX5+Dtv8XL6GU6
TLSH
T15902CA35BCB87C7B8EF36D46B48626139F95217BE5952B80DAF81B1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 030bafe3083188f7483a93fc416b405b24a3caa0237fd4782d3d7cce77605873
MD5 4447de4af4ed077eaa117333b33c6c1a
SHA1 f1071d7cf11aa353b9e9168fd1d5da0064c3f7c7
SHA512 7a8c484f40b53210a67979280ed008acdc8b207a89986b5adc6661f7aeaa13ed51ba761527e5cebd0b93ca4ce030f8543021a4a99e397e26297c851bc3d64ca7
SSDEEP 192:EONF6nnHFQmiUySkdYcX5hQDP1HjzorMoLFX4SJr2g3Qr/5DU6:EONF6nDUdNX5+Dtv8XLFXPJrRWDU6
TLSH
T13A120C35B9B4AC674EE36595B08731239EA81127E6897BC0D6FC1F1C01EEA6C530AC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e65a7294-fa77-4200-bd80-067f88ba840a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e65a7294-fa77-4200-bd80-067f88ba840a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eeaf8fbfc425d62f3aee05df6509a168765211d8b53bf4f1039d872989205f5e
MD5 2d784e845cf03936ea62addc49aadd69
SHA1 570a8e91d24eeb9195379290d70a780ffe8575c7
SHA512 35d3583b49fe13f3719e8c9565531076ac4db57e3e27f9485c52b1cd35760a74aab3167f338945063729c6089870b8b2e32b1329ee06a75f0b204679af523310
TLSH
T117410458B6E91148B3B76E5AAFF2A96E483F78772E06945E00110D8F0A66B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

MrmCoreR.cpl.crdownload

Path C:\Users\Admin\Downloads\MrmCoreR.cpl.crdownload
Size 65KB
SHA256 2df92223494c18ebd71e516b20342d3bb8ab623c1137e56fcf4bfb91be8a5955
MD5 c379e48537521718eb2975987ef393c6
SHA1 464ad9a48757f48c83ae1d0a4c44d2654c280c10
SHA512 73b87b64fa347634c0907489e2d8cb497da9845cea81af2cbeb32a52c7515703e83b394fa04330945898472c525d34dc7b5f98cf10bab524a2d9b3ef2070aecc
SSDEEP 1536:CcckZ8w/6lK9KjpFauqbMnqkbK5B8pgud8a6peMp:pP/yK9+ra7MnqY3ahaEeu
TLSH
T10153D20F76AE7925CB6C0672845C2FB0A6BA9307406A69CF04EEDD95DBDBC110EC9CC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-165-0x00000198773F0000-0x00000198774AD000-memory.dmp

Download

memory/4300-163-0x0000000000410000-0x0000000000428000-memory.dmp

Download

memory/4300-164-0x0000000059950000-0x0000000059968000-memory.dmp

Download