hxxps://sbhcld[.]s3[.]us-east-1[.]amazonaws[.]com/sbhcld[.]html

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sbhcld.s3.us-east-1.amazonaws.com/sbhcld.html
Sample260623-b2k2jaas3x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266524928178745"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{794C5018-EB00-42B9-ABE6-71EFA7422F01}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3540	4844	msedge.exe	86
PID 4844 wrote to memory of 4812	4844	msedge.exe	87
PID 4844 wrote to memory of 4468	4844	msedge.exe	88
PID 4844 wrote to memory of 4812	4844	msedge.exe	87
PID 4844 wrote to memory of 4812	4844	msedge.exe	87
PID 4844 wrote to memory of 1924	4844	msedge.exe	89
PID 4844 wrote to memory of 1924	4844	msedge.exe	89
PID 4844 wrote to memory of 1952	4844	msedge.exe	90
PID 4844 wrote to memory of 3332	4844	msedge.exe	91
PID 4844 wrote to memory of 1952	4844	msedge.exe	90
PID 4844 wrote to memory of 1952	4844	msedge.exe	90
PID 4844 wrote to memory of 3332	4844	msedge.exe	91
PID 4844 wrote to memory of 3332	4844	msedge.exe	91
PID 4844 wrote to memory of 4600	4844	msedge.exe	92
PID 4844 wrote to memory of 4256	4844	msedge.exe	93
PID 4844 wrote to memory of 4600	4844	msedge.exe	92
PID 4844 wrote to memory of 4600	4844	msedge.exe	92
PID 4844 wrote to memory of 4256	4844	msedge.exe	93
PID 4844 wrote to memory of 4256	4844	msedge.exe	93
PID 4844 wrote to memory of 4712	4844	msedge.exe	98
PID 4844 wrote to memory of 4712	4844	msedge.exe	98
PID 4844 wrote to memory of 4712	4844	msedge.exe	98
PID 4844 wrote to memory of 3796	4844	msedge.exe	101
PID 4844 wrote to memory of 2088	4844	msedge.exe	102
PID 4844 wrote to memory of 3796	4844	msedge.exe	101
PID 4844 wrote to memory of 2088	4844	msedge.exe	102
PID 4844 wrote to memory of 5012	4844	msedge.exe	104
PID 4844 wrote to memory of 4284	4844	msedge.exe	105
PID 4844 wrote to memory of 4284	4844	msedge.exe	105
PID 4844 wrote to memory of 4284	4844	msedge.exe	105
PID 4844 wrote to memory of 3696	4844	msedge.exe	106
PID 4844 wrote to memory of 3696	4844	msedge.exe	106
PID 4844 wrote to memory of 3696	4844	msedge.exe	106
PID 4844 wrote to memory of 4624	4844	msedge.exe	115
PID 4844 wrote to memory of 4624	4844	msedge.exe	115
PID 4844 wrote to memory of 4624	4844	msedge.exe	115
PID 4844 wrote to memory of 4600	4844	msedge.exe	116
PID 4844 wrote to memory of 2156	4844	msedge.exe	117
PID 4844 wrote to memory of 2676	4844	msedge.exe	118
PID 4844 wrote to memory of 2212	4844	msedge.exe	120
PID 4844 wrote to memory of 2212	4844	msedge.exe	120
PID 4844 wrote to memory of 2188	4844	msedge.exe	121
PID 4844 wrote to memory of 2188	4844	msedge.exe	121
PID 4844 wrote to memory of 2188	4844	msedge.exe	121
PID 4844 wrote to memory of 4268	4844	msedge.exe	123
PID 4844 wrote to memory of 3580	4844	msedge.exe	124
PID 4844 wrote to memory of 3580	4844	msedge.exe	124
PID 4844 wrote to memory of 3580	4844	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sbhcld.s3.us-east-1.amazonaws.com/sbhcld.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcbb65c188,0x7ffcbb65c194,0x7ffcbb65c1a0
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,9365063295142153670,8576564800571973091,262144 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4101589136060111048,7006735930794640889,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,9111106181060318904,16686864166821681940,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3069757403669054135,15642628336908364468,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1417213822248841246,6424619887889761680,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,697704410875662052,4783692822463824395,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,3091564849505056715,5767963341872896071,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,10938374574067751423,15355119867806337200,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11587907786556038498,7896267655375228989,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14100758514944147400,7469352868212529222,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,343560968825110394,3374222418728914862,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,343560968825110394,3374222418728914862,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6652,i,1854295496630210247,10727229365253612450,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3488,i,973948882751509826,7469623048949644020,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=748,i,4817357220722769893,2712295605057590304,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,10745140017871236548,14311823309995383755,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,14737920692934333130,10190916441340893539,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,1763450953413360623,522969283166523873,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,13153618310224749579,10686584152243984590,524288 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6636,i,11910309624476967838,15538603785263881873,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4360,i,10980074496631792995,17624447229856985927,262144 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1016,i,15901439089735151518,6352426269093948441,2097152 --field-trial-handle=2248,i,6192120740504691628,7974284391909141236,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:1
  2⤵
  PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2648b782fa44368c518d457e63cd1b2803737a4ad56ec2d9a8ef58feab9c44c7
MD5 321391ae1252175c72007c9f721c1217
SHA1 fcefc9b5dcd63a854af13318870cc3a6150dc347
SHA512 519fa2c341ac2673fa01f88a66941bbc2fd3c27bd6cacb768a5c0252f9695d76b5670c0dcccdfbf5138384ddcb6be09185dffaad94ea9ebd44f8143e8da02411
TLSH
T11C713C2912FE035EF3222232F1D90A1434F3679B0E937D4E10A88F7C2532B348DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5867ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5867ec.TMP
Size 3KB
SHA256 5d4646267003c62f91a1f26658f0ad10460e64e0c9b1b4ce210cbc870197b2a4
MD5 3c80ecec16ed83a3c9313c0dbfb604fc
SHA1 07f9f7c37c392ea2963e26291864210b089d44cc
SHA512 f252b8dc9ae44a84c1d9b4160b6c6dd880586855f897aff4d3cd9b369e82147bb678f13156f626afb0a79bba0700881112fbea87e922105f97aa7a941833ffc6
TLSH
T103712A2952FE079DF3262232F1D95A1834F3679B0E937D4E10A88FBC2936B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 815B
SHA256 a566953e6b02e0e81818fbd6501e2feedd05670d6deaef2cae9fd329f9304cd5
MD5 35d9cf4d88733f3904fef0e223e675a9
SHA1 0bf4cce5b0949050c9437ddbf95653966db32e77
SHA512 383c248e242e1b693875ee3601087a6325d7aa337a0c33b72b49fca352ba145007265b77a2c77af28d66e2999cbb83532dc9f71bc5cd83cd364f860e3c218ad0
TLSH
T1DA01B1B3C3D9C56EC90156F06A24AE2BCE2D090543183C15C5D4EF5B93F34B5E10145F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f91bacda3ee20146a551ad30e7cca5bbf24091f4455e38faa2a30feebb4cb042
MD5 c68c615bd8c7182ae6434262f41f642f
SHA1 da9fb09d951274e71388153f5568cf556beefbb0
SHA512 0da24b6eac1a460d1ad0540caf171ecf74007783fd9cc562d1196f4f19335f8b86f48eff485b61c7f21c19b6caaacd6f50aec7790203ba914b2e5a2d397d3258
SSDEEP 192:sxZrRQyM/jK1Ml8UQM0k6/fTIs4xV/Idp7QsHW6+WNyUb/Y4nCg+aIg5eJ:sxZrqqMP6/fTIs4xVwdHb5/hRc
TLSH
T17152C616AA345A778CDBD20DFA55BB53D6F50573E2900E44A9FCCA1C04E6EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 69a5cfeac1ad25c179a71b041881f140c384f3c4bbf829fb97859f65737bf5e0
MD5 7b92be841fe93f204e1e56ad8be56de1
SHA1 51fc0bf388bbf4ef923a5639ae7a8d27d8dabe24
SHA512 16d5bd5337140ad1137bcc189dd35e9edd143209457a4ed93f3b4ad999a8b2b1f62ad974499aff0d4a7d74bcf7fc2ad662970deb4c34cc3eef0cc6b54af4dc01
SSDEEP 192:sxZrRQyM/jK1Ml8Mk6/fTIsbfV/IdpdCHW6+WNyUb/Y409B+aIgrJ:sxZrqM6/fTIsbfVw0Hb5/aR9
TLSH
T12B52D716AB345A778CDBD209FA55BB53D6F90573E2900D44A9FCCA1C04E6EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 38f422818aed2c7387b49ca9cb7f2b95d8d6d2e30b8b37f49fd28fa17c846d7c
MD5 d8f4778f9d368f3437a59892caa5c6e6
SHA1 220734cd50a2776edb1f9a21021e1e61e0947a4f
SHA512 0c3f7966369aa3bd82e83f65d3f5fe383a6cfe0608efcf9b8fa07da0cda39fa03999652d255e776a26b3617555650d0adb87a01982775cab22cc60fe8e80d0a8
SSDEEP 768:eA8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdxrodku5UnM:eA8iJPNWvx76ru1jahALocdKn5UM
TLSH
T1BAD2FA3B680CCB7E4F844E9CEC266F966DD801CB5B944D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 45e2b76a02603c19c58ed5c39db82f1923c243136fd25fb37576a3d0fe590c4e
MD5 4d64ea4ddf02d52371b202877400a965
SHA1 4b0578f770f9099d990fd828fa3e22302856a75b
SHA512 78dda6616387bbad869a48e8d6652d9a57dde1c4cf6ac62388a12175f98be3c73f8ae3b657d7322a65906559972ab8a70e2830693f0f7520db3b883b64d950cb
SSDEEP 48:K0YIjKlqcbyRyIfKnqogtKzP9fL/+zwWIXX/KguoZ/c1vFojbUyuRu/zpD/T+vUh:K0YwKlqqCy8Knq4ioKjqqCOIKr6V
TLSH
T19AB1AC0A71FB13123D3E294CA2A2955A5B8376633009E42B37F814B11D6BE561DFD9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0d97152-a56b-4f54-939a-6fa664f22da6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0d97152-a56b-4f54-939a-6fa664f22da6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ec3a475e6b26c27bb45c9d2d8e86dbda027eb9d94e086c28794e25f4a291d4ce
MD5 5dbb058c0dd815754143fe7c84d53905
SHA1 53b052614f59c1eb5345d3bef7d3e1b38b98aec4
SHA512 e18aca549cfb01cb9d9cbcb0f963e9e9fef69cc1202f32b2d5d8d6eb3a7777c470b575d898d36e95fa8d177b272d36b9bfaa308fd056d8527aba01ad62d12690
SSDEEP 384:otNn/s3n9SfsNTUODWd5KkywmfxHJ/Pb9oR7Rzx9J:oj+9UNaXxHJ/A7RzvJ
TLSH
T177927D3259389C7A1EE3A649F4473A035FF48077E6C63F9599ECAB0C05CAADC1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 073d27b4083d2e415399c2d1743f2b712a78bce87431d157fc7ab725c1b43f89
MD5 3c2300030a5f488fbadc3b255e3eb642
SHA1 caa684353da981a1f9223e4599208453dc532a1a
SHA512 49f74c0deb7a6288046f380a30c384fd40e88cbeb4a2b54713519c4156ea7466390c3eaeda8fb67418b90810b17bef0ceaf7c625c152261ae7ee11d01fba02e8
SSDEEP 384:iQiF1tNn/s3n9SkzsNI8TUNTUlIltDWdOKkywmfxuJ/Pb9oR7Rzx9J:irF1j+9nRwgdaXxuJ/A7RzvJ
TLSH
T184C207F209D7883AD99E5B47B73E2E034EBCC067B5816A95B7D85A0CCC865BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57ae75b3d755008304c90a5f0db090555b792ad7e52145ac6c5adff008d55492
MD5 dbccbeeef85737dfeb3698f1eed4a688
SHA1 1e4221eb9a3d9e835c637b1d94e17cca7c3747bc
SHA512 c38570336176d68e7322d491d67fd7f00ab8679312654ee26df9ac0006d55373606f71517941bb6e5ce07b5b39827ebec1cbd942bdaae3424afb05436414225a
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5W5DABhPwivh50xy0SFYKNAxOYoh:gONw6kDfQmiUywkZ903iow+Qia90oU6
TLSH
T1D202E73569786CBB8EE3AE49F58737275FE4116BEAC52F84DAE81B1C00D765C1302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 95d6a2c6e5d841db247829b660cbe92df37c425d2e6948df942e5df6430fd842
MD5 cb3b83920cdeb417fe7c0b3cf26ea46f
SHA1 4036e4211c8f34397bdac7dee510efb2cbfa9b0e
SHA512 ad1c450b029ea00b762da647e7d5050f2d75531ccb864ecda9ad45704e021fa9325e2afd75c8039185a0f237be29f8fb16bb39976cc92465ad6420a7ff22939d
SSDEEP 192:MONZ6koQmiUywkW903iowmcEJXLcR+rqVU6:MONZ6pkW9ywmfxsJU6
TLSH
T1B8123A326868AC7B5EE3A855F48736134FB4816BEBC97F81D9E8271C05DB69C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 43e073883885a58db4b32c19336a9898b85b54ce46429263419d3d975c29823d
MD5 c66c64d14c5812b4cc874be1e622bc58
SHA1 2e6b12da7e441afcd164501dd1285c7a6eeef5c7
SHA512 dbc1f6ba89bc224b9dba066cdc704cb4aa4e84809d2c6fe3057d9d1d396dc12331b3037fb7e7fb90267f0585e4da6a53ac4ab0c05ab5b013ee96ea63a76dfd9f
SSDEEP 384:NtNn/s3n9SfsNTUtDWd5KkywmfxHJ/Pb9oR7Rzx9J:Nj+9UwaXxHJ/A7RzvJ
TLSH
T1FB927D3259389C3A1EE3AA59F4473A035EF44077E6C63F9599ECAB1C05CBADC1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0794c663277598070f94bd34f5cabdae3627387f25d14c38ecab0593efa13b6
MD5 4c47054687150a26ef1a6a33b907c9b4
SHA1 6e28e571b6fa08e1201c01c308e82bb550bee042
SHA512 4ee55cff7c744395287c8255e18b3ba8e9153c648d1b2ede3b86e44fd0d04fa69c5d4ab481b4d3e5bc0d456d162b719079ff67fa25ff0056d2031cfa4bc6714c
TLSH
T12541295DAAE90048B3B76E59AFF6A87D487FBD332F06D45E00510D4E0633A04C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads