hxxps://www[.]sharedservicesforumuk[.]com/events/online-procure-to-pay-network-event

Analysis

user interaction
yes
max time kernel
42s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.sharedservicesforumuk.com/events/online-procure-to-pay-network-event
Sample260511-ny2akagy2x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5860_1538103174\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5860_911880364\_locales\fi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229737542020739"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-636600838-1632888396-3521553955-1000\{D4E61A9D-1975-4445-BC97-35A0A8BF4F72}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 3844	5860	msedge.exe	83
PID 5860 wrote to memory of 840	5860	msedge.exe	84
PID 5860 wrote to memory of 5752	5860	msedge.exe	85
PID 5860 wrote to memory of 5752	5860	msedge.exe	85
PID 5860 wrote to memory of 5752	5860	msedge.exe	85
PID 5860 wrote to memory of 1180	5860	msedge.exe	86
PID 5860 wrote to memory of 1180	5860	msedge.exe	86
PID 5860 wrote to memory of 2152	5860	msedge.exe	89
PID 5860 wrote to memory of 3820	5860	msedge.exe	88
PID 5860 wrote to memory of 2152	5860	msedge.exe	89
PID 5860 wrote to memory of 2152	5860	msedge.exe	89
PID 5860 wrote to memory of 3820	5860	msedge.exe	88
PID 5860 wrote to memory of 3820	5860	msedge.exe	88
PID 5860 wrote to memory of 5936	5860	msedge.exe	92
PID 5860 wrote to memory of 5936	5860	msedge.exe	92
PID 5860 wrote to memory of 400	5860	msedge.exe	93
PID 5860 wrote to memory of 400	5860	msedge.exe	93
PID 5860 wrote to memory of 2812	5860	msedge.exe	95
PID 5860 wrote to memory of 1620	5860	msedge.exe	96
PID 5860 wrote to memory of 1620	5860	msedge.exe	96
PID 5860 wrote to memory of 2512	5860	msedge.exe	107
PID 5860 wrote to memory of 2512	5860	msedge.exe	107
PID 5860 wrote to memory of 4580	5860	msedge.exe	108
PID 5860 wrote to memory of 4580	5860	msedge.exe	108
PID 5860 wrote to memory of 5308	5860	msedge.exe	110
PID 5860 wrote to memory of 3520	5860	msedge.exe	111
PID 5860 wrote to memory of 2284	5860	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.sharedservicesforumuk.com/events/online-procure-to-pay-network-event
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffb9fb1f208,0x7ffb9fb1f214,0x7ffb9fb1f220
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2388,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4948,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4956,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5652,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5652,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5804,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5876,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5960,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6072,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6220,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6196,i,18123653241673616769,3831703396041117398,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6847da93c0e8ba021039564b54e5b8340cfaebcc9903f353104c8db5eacedd99
MD5 57f6bebc822399bdddb50e79e5e43cce
SHA1 26bba59f93dcea4a564377885d4b44e85026706a
SHA512 c8f32f6c3d308532cb7953bfb3f9c63c9aee15eb26fd3f5104b23bbd976262872dd5f21342f2cd6757548b0e93d5779445f26edd82a2234a9f3c9577091b6330
TLSH
T12FD0A7D16B98C902F4415C31467AA5623F06E660A40A9361655005483815BDD6DD91BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f170d9be82275193c2bd179863f0cc5f6d785d09a5be65c807d7b840381ca0c
MD5 0df4648770d5b5028a76e9c74ecf5dd3
SHA1 477391ae188d794fb12fe21ade12f20604df48bb
SHA512 6a34ff468111cfd97225f8fc111406f8172c726b990d2de2b5f63708b78c77864126ce5ecce29c1311100a6846fda3306f5d53190eb7ab1c2e55da7961d651a1
TLSH
T1D071616374B671A2C73470BFB6F07A1EB27EAFA544E3EC5A509941F47D21322D234106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582759.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582759.TMP
Size 3KB
SHA256 91cacbd11eb528e280a9145b6651635d04b54bac978ec0eb5e43d0ed36e44884
MD5 cd206deed8d181779358f5ed9cb79894
SHA1 df2748b8e0df2c0fe8acf41c5333927641450d77
SHA512 7e562207ac47bb32f97d1f261a92e627af71e849dde9899e41d32aa9212cb251831d50d55c714d08df1f0d879e0bdcb52198b25c282ca2e30ec543ba2f43aecc
TLSH
T17E61F923747572A5C33474BFB9F0361EB2BEAF9940E7EC5A50A981F47E61322D234106
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e9bb0a621ace40981c78cb9b1a7f2a99b2e2789ddc92057e8ed5d84c43cb1777
MD5 59cf1da7b018105fabda60d942792d0f
SHA1 bde07d24936ae4eec25cd918d84ba6897bc8d254
SHA512 646430094f259bac6dcc8783a0bf8c65449ab3baf75b20a40630bdf5838df15cfc38ac0413a8e5513b3e7bf9c5c4265656259a8732dd0c558002fd915fca3541
SSDEEP 192:sVdR3yMqv/Ky0Ml8M7AdsUdq90ILWn5bzoZ8p2PHY+WN2fsoegdZxZHzr7JZAIgQ:sVdyLjAdsUdntCHSZoeeHb8Q
TLSH
T13772EA557A68897B8CD7D219F6427B53D7F91523A2905E48A9FCCE0C04E6BED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 de965558d7ef760e8a6850e89424bcc936ab69d198f36c74521dd35714b3ff34
MD5 1376a8f1930d7198f759ad1098106329
SHA1 eb6494eab6e56d93ea7554d9ecea86de83338732
SHA512 fd3dbf69510ed66bc5e1af6b27d374ad13b1d6675f03421fa83e7f18b416c7f0fe4c396a0ebdf7b948023086c526062f2e871b08873872b56f41a530653db3a0
SSDEEP 192:sVcR3yMqv/Ky0Ml8M7AdsUyq90ILWn5bzoZ8p2MHY+WN27HwegdZxtHzr7JZAIgm:sVcyLjAdsUyntZHS2weyHb8m
TLSH
T12372DA5579684D7B8CD7D219F9827B53D7F9152392905E48AAFCCF0C00E6AED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a7a7b561766f1b6c9b57915905906cacd47ace93d9b0f423bee88aabd319d8e9
MD5 58593122a208367dea2b89cc617d632d
SHA1 0de4aa7170c09c97a379a3d6d81b363d67aa8900
SHA512 e5863ff27317862f128779f72f17d301338cf07ac9d869ff7a57735ddf5eba10397a3c4e8a7892d24a24715bd51cc7dc40f63c227cb094c649dd2bfd7bc25cb1
SSDEEP 768:i+ZzfS17pLuLzdXWFC6SS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqyZBLlcSqI9rol:i+ZzfSDEzdXWFC6SSu1ja5yZBLa9I2lL
TLSH
T128F2FB3B6C0CCB7E4F844E9CED2E7E9A6DE8028F9698895447F9841C03C66EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 1c146b1b7b82b104957c6f8269794318466cf90faa8f9bc628e7b46d203d6cb1
MD5 8162f5964a6d3f225f5a4c25e33ad87d
SHA1 599517ef8fa0283952d41d68d8b016e028b9881e
SHA512 c096fe6b189b231b40ec0b1074d238a2fe20138d2b887a7e1b2768c8a5eacb5c3f1749461a2de02c4b8ecaa5fb3b07742e3cb74cab3b2cbc548f7949e3e19d4d
SSDEEP 192:rgUjO6cGG3y9GiQa88lSbkG0bEkcXi90giE0BwXEYOwSSvIV0KU:T
TLSH
T13AA25321717B664478BD655E21B8926EC28230B32011F57F79A834E68F67E306DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4bce2cd2321f6007db0ffa6854d1be264e26c4457ec02341d2458f03008cb2b8
MD5 3838632505a8d527bf5272bcadcd6a71
SHA1 0c446fb5d96cdda7852b631fb04714b52f2158a2
SHA512 15199b61a0ab81f37330bd9b726c3d6b8d5d9113abba9e0e7e6f540dae014b3b4956dcc8e871fee7f55c14f8c2d6ddfb68631d7246e507a07296b636949eacab
SSDEEP 768:iFiE6esE8lDldUGz3rCgOsZcj1Hw72NKA+E7QG1jRdE1M44:DeB85d73k2fEcmdE1I
TLSH
T104038D35E898CCE74C9ACAC4D30AB9176DE04277D64C5BC8D6E86D2E308F1BD634B859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ef135f1ae90fdaa07332b5840dc12803106dc0aade926c80fa98e3b14e80efde
MD5 6de281460baa4c5bdf172f21d423393b
SHA1 6b87edbdbcb0a7dee83f9df12db0691b68a1f839
SHA512 5cbb9d3f653d7cb527633488d9300a83c5dcba295f1e99a7500f9abc46d9f6a7f54648d2920aa37181180a5107229bf6741ec56924f027da49616ae58903f8f6
SSDEEP 768:qFiE6esE8lDldUG83uCgtf8NRcj1HwVOMkYKUE1/4z1jRuM:LeB85dU3Efrt9DUE12X
TLSH
T1AA13AE39ECA4CDB35CEA8A45E74E36976EE01263968C4BC4D5C85E0F21C61AD374BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e2926772f61872ca42c5d13486dd220548d7cb9d20ee3a8b766a74aa44ff7521
MD5 23cd1766b014d76f2d5694f48024df30
SHA1 853531df07e834ba40d7eab75963e56820750766
SHA512 a2caaac18ea45d0e734c579a200b85d029ede4063fcd3371938a5767761575c89762071af78ac34e40b59e042fa0435b6e43ad3c400aeb36a108a43ee11c43c5
SSDEEP 768:UFiE6esE8lDldUGz3rCgOuYcj1HwVOMkYKR1jRdE1M44:deB85d73tt9D5dE1I
TLSH
T1E8039E35E894CCB39C9BCA95E74E36A76EE01263D64C4BC4D9C85D0F21C61AD374BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f65c4ccbc100367ad0b9398ba4459aafcf1e4cf2817df7ff3f5c272403a9bbf
MD5 cc1b7b3a700452acad51c103bbbf276f
SHA1 fae5b460c2df73f8067469cd754250078872bf52
SHA512 edd26058064a2e6e39dded70fe29e4419c8fb27f2a310a141d15c0cbe5ecd598e40ae1e252ea5d0e04b6dc04e406a170ec2f234cf7fbcd4db1cb77cfce7ac9dc
TLSH
T16D41D658A6FA1148B3B76E5A5BF7A86D487FB9772F0BC45E10110E4E0A32B44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-186-0x0000015C341D0000-0x0000015C3423B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads