0846aca611e5cbf4ae112ed709abfd334c2e952c553786c4614dac1868ff5eb2

Resubmissions

23/04/2026, 21:57

260423-1tx4kagy6r3

23/04/2026, 21:54

260423-1sp2kagy3p3

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emuxernal2.0.exe
Size 185KB
Sample260423-1tx4kagy6r
SHA256 0846aca611e5cbf4ae112ed709abfd334c2e952c553786c4614dac1868ff5eb2
MD5 0049b74b3f526b076c74e5d5c777f957
SHA1 adc4be277749362feeab20c6fc528d6c3ea84275
SHA512 8391a65c8e49bd093b4240c691ab45e1c66faa6a9aaec2bdb45f404301898d917ff5a2d656423ce8febf5ebc4897a4052cd090f891c448dc2bd50ca88f07561c
SSDEEP 3072:EjOpc6jJ9B121Ri39Nw+pBOCS0yuElY9aKA3ax/Sc:EjOpc4JD1CR8w+pBOF0yuMYEJax/Sc
TLSH
T183044B197A1941B6C1A6C178CE828503F7B37C89476296DF17E19BB50F27AD0FA3FA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2988	helppane.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	helppane.exe
2988	helppane.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2480	2988	helppane.exe	103
PID 2480 wrote to memory of 4224	2480	msedge.exe	104
PID 2480 wrote to memory of 1844	2480	msedge.exe	106
PID 2480 wrote to memory of 2436	2480	msedge.exe	107
PID 2480 wrote to memory of 1844	2480	msedge.exe	106
PID 2480 wrote to memory of 1844	2480	msedge.exe	106
PID 2480 wrote to memory of 4920	2480	msedge.exe	108
PID 2480 wrote to memory of 4920	2480	msedge.exe	108
PID 2480 wrote to memory of 4468	2480	msedge.exe	109
PID 2480 wrote to memory of 5064	2480	msedge.exe	110
PID 2480 wrote to memory of 4468	2480	msedge.exe	109
PID 2480 wrote to memory of 4468	2480	msedge.exe	109
PID 2480 wrote to memory of 5064	2480	msedge.exe	110
PID 2480 wrote to memory of 5064	2480	msedge.exe	110
PID 2480 wrote to memory of 2316	2480	msedge.exe	111
PID 2480 wrote to memory of 2168	2480	msedge.exe	112
PID 2480 wrote to memory of 2316	2480	msedge.exe	111
PID 2480 wrote to memory of 2316	2480	msedge.exe	111
PID 2480 wrote to memory of 2168	2480	msedge.exe	112
PID 2480 wrote to memory of 2168	2480	msedge.exe	112
PID 2480 wrote to memory of 3260	2480	msedge.exe	115
PID 2480 wrote to memory of 3260	2480	msedge.exe	115
PID 2480 wrote to memory of 4196	2480	msedge.exe	117
PID 2480 wrote to memory of 4196	2480	msedge.exe	117
PID 2480 wrote to memory of 2660	2480	msedge.exe	119
PID 2480 wrote to memory of 5080	2480	msedge.exe	120
PID 2480 wrote to memory of 2660	2480	msedge.exe	119
PID 2480 wrote to memory of 5080	2480	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\emuxernal2.0.exe
"C:\Users\Admin\AppData\Local\Temp\emuxernal2.0.exe"
1⤵
PID:3864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\emuxernal2.0.exe
"C:\Users\Admin\AppData\Local\Temp\emuxernal2.0.exe"
1⤵
PID:1424

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fff86bcc188,0x7fff86bcc194,0x7fff86bcc1a0
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7574854757543318498,8399523348282999505,262144 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,2659854642041695498,14000103038341467140,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12629951610697337705,301936480714006854,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11050193027641763387,1120849616843953626,2097152 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13437341292649582342,16603558538430066566,2097152 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,15099566223921878120,6702653360357345347,2097152 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10174539599673973558,1275494299799118571,2097152 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,14849724252003876060,17753639841489212165,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8203826121963561892,3301922912978143320,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,6709091877464135026,13036301555043089817,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2220814516408576635,2234701580365633909,524288 --field-trial-handle=2220,i,13866411521802718898,4573578007288621397,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 499f1baf84ccad9aec7e713f14831c28ec8ef6c26551e081f63481da9e10b787
MD5 0b7b7a3907c43b76a43eea92605bfc69
SHA1 b3d127433999df0affab0fc41fa6d73226ec079b
SHA512 67d637e6bb845665c58d6f0a256303841a077e8a03562447569857bb2f980056eb08233e2e8f7e3c0c468adc11695b7c60631f1f3f77f122b5344c0ccc3b2c7c
TLSH
T1D3D0805C9371AC70C7CDC9B1585777453D1AC5629A4247252C732D7D1C4258174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a68569752b554830bdaeb1e8a10446a2bf48a5c40d9055644b0ff7d12eb909e
MD5 619aee87184943036a7fd0a470ee34f3
SHA1 f2e0d05b802871a84b6abab52ce17fbe477f2644
SHA512 618e8ac028bfff63cbfb3dc8165970fe8da37fa98ba9c72a9b4a3b3eb9d922078cf4371b48f699b16e64d0205ac715cb0a1b9fccd6953e5bda90f6d945b76ad1
TLSH
T157D0805C53B1AC70C7CDC9B1585677453D1AC5629A4287252C732D7D0C435C174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18c44fd870c4d51f0f7d25ff43f1febe36ef237625ebffd570013c3f14a88a00
MD5 d3304eb62700b14abd1c642d90c03811
SHA1 1085a7e0407fd2238843a07d904bee0fb3b23800
SHA512 b6b6a82067781ab299ebdb3d51866a77cd2cf2d92a7abbb91fd4ea2a6fb4ce3d95fdc480adbafaed9675402c6e18e30ef16d32bef24a4cf6be083384c84f9290
SSDEEP 192:YONR6TZ0qQmiUyFflab+jb+Fdxo4o8LnU6:YONR6TCmMlg+kd64zU6
TLSH
T1A002E9356C786CAB8EA2AE45F48736234FE8117BDAC53B58D6E85F1C00D775C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14cf3c925f17123b5930918091ed07daddeaa5643a319ac82f3de0044c05146b
MD5 98cc076a82dd811664f3e0380ecef8a8
SHA1 0981114a05adcd989cc9d8699618c72395fd5d4b
SHA512 2db5c3d922800fd8c429257bec28e3ccedb33ad4c266d7e1bfb2c0e7c6b66f68d3f81d47e8d34c8bfaa31dff1757a21f83b2e8ad9d77c8b6a3e0cf77cf943354
SSDEEP 192:KONa6TZ06QmiUysfmab+jb+FdxotvN8cX2qCXkU6:KONa6TC2vmg+kd67LxU6
TLSH
T1D712093168689C674E96B111F48736A39FE82177DDC67F58E6D88F0C00D77A8371B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 51eb48c7342f543f91b16362818fcde65ba9f95cbd3c1582e67b333d2f0cd63c
MD5 42fca46d889a87efd50af74f677b4015
SHA1 384a3f27eb1e397e004d16e62aea5c7c451312b7
SHA512 2df2cbcc4b09443dbc971de0676244b3720f8b6c245f0c38718c7feec2dbeda8d7410485da0b74f8a70b09d346cceadd19e448018409a979cdba81b2fe5ea0b4
TLSH
T124411A5CBAFD1148B3B77E56ABF6686E587FB8772F46D49E00110E4F0622A40C861B73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2692-0-0x0000026CFCFE0000-0x0000026CFD07B000-memory.dmp

Download

memory/4628-48-0x000001FD54600000-0x000001FD547A1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads