hxxps://links[.]notification[.]intuit[.]com/ls/click?upn=u001[.]SkyGoo-2FemZT6Xc-2Fn1lGbnj-2FICaqI60oCKbx16j6rYSEoM6hQvAujyL-2F-2FC6xO5iShrvnr_zb7wV6j-2F21a2jJHEJfT-2FOcnQPGV4InRzZ67SoIMH09J6eN6hszpM3vh-2FJK4S4OCb8stHO-2BZJAzLaCbAVeBOS-2BmuSSSGWmeYEHx-2FPvv-2BIdS1U8yTqXTjPQEaMsEgYqKhKx1-2FThRiG-2F-2F9fq8BBkECIEfgxvhYAB8EAwsi6aYkkL-2F9hOc8UFH8-2Bn-2B6b-2BmuTnnwsLBZhs99ZWyJzyrDwHE-2BreGAtuoADm3GMmvNjpqBIquFCTwkYh-2BgOFpIbckquH0Jnr5vKIpqkOfmue-2By4MaYhnPn37KbC-2BxL29wF9dZGvHH3NEtGPpCy2346BbCmy7g5eYCTMV1im1DatTI-2FNn76g1qSmUKDADjikilgs2EOZMWksUQoZ8jH17ccasgzYTyXVnTl2hEyfAHg5rG8YU9xU-2FDFxAjMaaW-2Fs86mYLl0SacuQGA7ygSl4FUFHoVL2vu-2F5AR7nj7tuWgCAsTPfUdlL961b9aKVwisG-2FRfuO9VJgZD3NwucqAeSLVqPp5F4sPOsDSEKMY7Ev3djwRX3sqNIpr65CanUScAcI9GqRf2jnLM0hPeDEWLQIbQzrbyov5nkvcaJAbnSPY4-2BTwBK1fYjuSE9sZ-2FIflmjkGYy7wEyJwT-2F1BCjbqgL9uvyTLtTbDvs9xD4EF8AdHUrQQB21j1wVood39pXbhyctjLinB-2BNcL9xWd6kF-2F74wGk1y0kqWkN-2FhIQl430QAvrAywBBfjJRODea-2Bbl-2FNi8D0G9hlgdprHmqP9SWuLk0zkfM0nlTPnW49OgXcq0cKgKsRgVAukxRSF9xFB9w7JOImItnXi17DZfi1ORmVdTOjt8vFdeW45zC3u2Tf6grnXyqKI1YZIQVqd99O1u8jSDJm-2BO6l68eJe9RuVvmrj1CDCmMNr1KjI3JWznoIE-2FWs6sVlNk439vSbtUkdiTwzSPHlmk8vDybA69ljEUJ-2B7TxhieYZri2efBxhvQ8kAqh6q02745BdSyzTOC4LQM5H-2BYYUvDg9D82286LBJW6wkyIck3Rey-2FDu1fY6mcHToDXkRA-2FRk4Pqax4SL0Ra9IkkYKzalX3E55kWSay-2Bx2VUSLsEkrg1t5prmDcpP0iuNiouwWB0FhsAkM8W-2B4R-2FSrDtb3SMyg2tejqTaycR0KTaGEfHrxvMENMaFcawaphokCfZ8J-2BE6oKeyPqvt-2Fg-2FfgZv4D6CICqRsRXghPFjkc17T4bc4lJvkjyREiUCb0EAl5xD4w9zAYt0sNV9JJu9KXqriBItApk1nZRhv0aam2nEqOA10rcBG50KDm-2BN1mmeaTOsMBjmD1ObqAW3m0ZWtNYcUWy5ggJOppXBNMcfZo0mY4-2BWZzW8V-2FrZAs7bY0R9Zv8okUqtbH0srEqBQ-3D-3D

Resubmissions

23/06/2026, 08:25

260623-kbraasbs9l3

23/06/2026, 08:25

260623-ka911sbs8q3

Analysis

user interaction
yes
max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnj-2FICaqI60oCKbx16j6rYSEoM6hQvAujyL-2F-2FC6xO5iShrvnr_zb7wV6j-2F21a2jJHEJfT-2FOcnQPGV4InRzZ67SoIMH09J6eN6hszpM3vh-2FJK4S4OCb8stHO-2BZJAzLaCbAVeBOS-2BmuSSSGWmeYEHx-2FPvv-2BIdS1U8yTqXTjPQEaMsEgYqKhKx1-2FThRiG-2F-2F9fq8BBkECIEfgxvhYAB8EAwsi6aYkkL-2F9hOc8UFH8-2Bn-2B6b-2BmuTnnwsLBZhs99ZWyJzyrDwHE-2BreGAtuoADm3GMmvNjpqBIquFCTwkYh-2BgOFpIbckquH0Jnr5vKIpqkOfmue-2By4MaYhnPn37KbC-2BxL29wF9dZGvHH3NEtGPpCy2346BbCmy7g5eYCTMV1im1DatTI-2FNn76g1qSmUKDADjikilgs2EOZMWksUQoZ8jH17ccasgzYTyXVnTl2hEyfAHg5rG8YU9xU-2FDFxAjMaaW-2Fs86mYLl0SacuQGA7ygSl4FUFHoVL2vu-2F5AR7nj7tuWgCAsTPfUdlL961b9aKVwisG-2FRfuO9VJgZD3NwucqAeSLVqPp5F4sPOsDSEKMY7Ev3djwRX3sqNIpr65CanUScAcI9GqRf2jnLM0hPeDEWLQIbQzrbyov5nkvcaJAbnSPY4-2BTwBK1fYjuSE9sZ-2FIflmjkGYy7wEyJwT-2F1BCjbqgL9uvyTLtTbDvs9xD4EF8AdHUrQQB21j1wVood39pXbhyctjLinB-2BNcL9xWd6kF-2F74wGk1y0kqWkN-2FhIQl430QAvrAywBBfjJRODea-2Bbl-2FNi8D0G9hlgdprHmqP9SWuLk0zkfM0nlTPnW49OgXcq0cKgKsRgVAukxRSF9xFB9w7JOImItnXi17DZfi1ORmVdTOjt8vFdeW45zC3u2Tf6grnXyqKI1YZIQVqd99O1u8jSDJm-2BO6l68eJe9RuVvmrj1CDCmMNr1KjI3JWznoIE-2FWs6sVlNk439vSbtUkdiTwzSPHlmk8vDybA69ljEUJ-2B7TxhieYZri2efBxhvQ8kAqh6q02745BdSyzTOC4LQM5H-2BYYUvDg9D82286LBJW6wkyIck3Rey-2FDu1fY6mcHToDXkRA-2FRk4Pqax4SL0Ra9IkkYKzalX3E55kWSay-2Bx2VUSLsEkrg1t5prmDcpP0iuNiouwWB0FhsAkM8W-2B4R-2FSrDtb3SMyg2tejqTaycR0KTaGEfHrxvMENMaFcawaphokCfZ8J-2BE6oKeyPqvt-2Fg-2FfgZv4D6CICqRsRXghPFjkc17T4bc4lJvkjyREiUCb0EAl5xD4w9zAYt0sNV9JJu9KXqriBItApk1nZRhv0aam2nEqOA10rcBG50KDm-2BN1mmeaTOsMBjmD1ObqAW3m0ZWtNYcUWy5ggJOppXBNMcfZo0mY4-2BWZzW8V-2FrZAs7bY0R9Zv8okUqtbH0srEqBQ-3D-3D
Sample260623-ka911sbs8q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266767135828282"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E3E987F1-7874-4280-B9EC-81E627E7E22E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1400	4788	msedge.exe	86
PID 4788 wrote to memory of 412	4788	msedge.exe	87
PID 4788 wrote to memory of 432	4788	msedge.exe	89
PID 4788 wrote to memory of 432	4788	msedge.exe	89
PID 4788 wrote to memory of 3548	4788	msedge.exe	88
PID 4788 wrote to memory of 3548	4788	msedge.exe	88
PID 4788 wrote to memory of 3548	4788	msedge.exe	88
PID 4788 wrote to memory of 4740	4788	msedge.exe	90
PID 4788 wrote to memory of 4740	4788	msedge.exe	90
PID 4788 wrote to memory of 4740	4788	msedge.exe	90
PID 4788 wrote to memory of 3184	4788	msedge.exe	91
PID 4788 wrote to memory of 3184	4788	msedge.exe	91
PID 4788 wrote to memory of 3184	4788	msedge.exe	91
PID 4788 wrote to memory of 3656	4788	msedge.exe	94
PID 4788 wrote to memory of 3656	4788	msedge.exe	94
PID 4788 wrote to memory of 3656	4788	msedge.exe	94
PID 4788 wrote to memory of 4712	4788	msedge.exe	95
PID 4788 wrote to memory of 4712	4788	msedge.exe	95
PID 4788 wrote to memory of 4712	4788	msedge.exe	95
PID 4788 wrote to memory of 5104	4788	msedge.exe	101
PID 4788 wrote to memory of 1840	4788	msedge.exe	102
PID 4788 wrote to memory of 5104	4788	msedge.exe	101
PID 4788 wrote to memory of 1840	4788	msedge.exe	102
PID 4788 wrote to memory of 2844	4788	msedge.exe	104
PID 4788 wrote to memory of 3376	4788	msedge.exe	113
PID 4788 wrote to memory of 4988	4788	msedge.exe	114
PID 4788 wrote to memory of 4916	4788	msedge.exe	115
PID 4788 wrote to memory of 1076	4788	msedge.exe	116
PID 4788 wrote to memory of 1076	4788	msedge.exe	116
PID 4788 wrote to memory of 1076	4788	msedge.exe	116
PID 4788 wrote to memory of 3616	4788	msedge.exe	117
PID 4788 wrote to memory of 3616	4788	msedge.exe	117
PID 4788 wrote to memory of 3616	4788	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnj-2FICaqI60oCKbx16j6rYSEoM6hQvAujyL-2F-2FC6xO5iShrvnr_zb7wV6j-2F21a2jJHEJfT-2FOcnQPGV4InRzZ67SoIMH09J6eN6hszpM3vh-2FJK4S4OCb8stHO-2BZJAzLaCbAVeBOS-2BmuSSSGWmeYEHx-2FPvv-2BIdS1U8yTqXTjPQEaMsEgYqKhKx1-2FThRiG-2F-2F9fq8BBkECIEfgxvhYAB8EAwsi6aYkkL-2F9hOc8UFH8-2Bn-2B6b-2BmuTnnwsLBZhs99ZWyJzyrDwHE-2BreGAtuoADm3GMmvNjpqBIquFCTwkYh-2BgOFpIbckquH0Jnr5vKIpqkOfmue-2By4MaYhnPn37KbC-2BxL29wF9dZGvHH3NEtGPpCy2346BbCmy7g5eYCTMV1im1DatTI-2FNn76g1qSmUKDADjikilgs2EOZMWksUQoZ8jH17ccasgzYTyXVnTl2hEyfAHg5rG8YU9xU-2FDFxAjMaaW-2Fs86mYLl0SacuQGA7ygSl4FUFHoVL2vu-2F5AR7nj7tuWgCAsTPfUdlL961b9aKVwisG-2FRfuO9VJgZD3NwucqAeSLVqPp5F4sPOsDSEKMY7Ev3djwRX3sqNIpr65CanUScAcI9GqRf2jnLM0hPeDEWLQIbQzrbyov5nkvcaJAbnSPY4-2BTwBK1fYjuSE9sZ-2FIflmjkGYy7wEyJwT-2F1BCjbqgL9uvyTLtTbDvs9xD4EF8AdHUrQQB21j1wVood39pXbhyctjLinB-2BNcL9xWd6kF-2F74wGk1y0kqWkN-2FhIQl430QAvrAywBBfjJRODea-2Bbl-2FNi8D0G9hlgdprHmqP9SWuLk0zkfM0nlTPnW49OgXcq0cKgKsRgVAukxRSF9xFB9w7JOImItnXi17DZfi1ORmVdTOjt8vFdeW45zC3u2Tf6grnXyqKI1YZIQVqd99O1u8jSDJm-2BO6l68eJe9RuVvmrj1CDCmMNr1KjI3JWznoIE-2FWs6sVlNk439vSbtUkdiTwzSPHlmk8vDybA69ljEUJ-2B7TxhieYZri2efBxhvQ8kAqh6q02745BdSyzTOC4LQM5H-2BYYUvDg9D82286LBJW6wkyIck3Rey-2FDu1fY6mcHToDXkRA-2FRk4Pqax4SL0Ra9IkkYKzalX3E55kWSay-2Bx2VUSLsEkrg1t5prmDcpP0iuNiouwWB0FhsAkM8W-2B4R-2FSrDtb3SMyg2tejqTaycR0KTaGEfHrxvMENMaFcawaphokCfZ8J-2BE6oKeyPqvt-2Fg-2FfgZv4D6CICqRsRXghPFjkc17T4bc4lJvkjyREiUCb0EAl5xD4w9zAYt0sNV9JJu9KXqriBItApk1nZRhv0aam2nEqOA10rcBG50KDm-2BN1mmeaTOsMBjmD1ObqAW3m0ZWtNYcUWy5ggJOppXBNMcfZo0mY4-2BWZzW8V-2FrZAs7bY0R9Zv8okUqtbH0srEqBQ-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffc3179c188,0x7ffc3179c194,0x7ffc3179c1a0
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4804346029886372319,569143503307247698,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:3
  2⤵
  - System Time Discovery
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,12106817398672825532,248865667834502216,262144 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,7368419161711574224,10331241174319363063,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3766548585315795037,2582321421829581107,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5571192711783437144,12979528084000661869,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,3618071967728012520,11716541802278720679,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,2486619917657316229,967436677887269138,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,5206620888346599281,409476395923595811,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,1925753889827761262,8316656679256537713,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1373509523847061597,7304077852329004804,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1373509523847061597,7304077852329004804,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2372598201027874102,10914895821723792874,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,14472464313941874348,7613889787699774457,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,15138553128374429184,3159008896820997286,524288 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6268,i,13668755284366020033,17084211301107723970,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3612,i,14303374725517745594,4426526157903666889,2097152 --field-trial-handle=2780,i,824241932554030045,10941409612985221274,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e76915fccde88faa406f93ed315daceb86b49b21b8448a104e98d22578ca8a41
MD5 1c8f33455c6ef5f831f56344742c9a0e
SHA1 536cf010672fdfdc3211061dcdc6150bcbf6452d
SHA512 2de1bf24b3259905daa269b0026be3496f2c428f64d0e0ab7c650c62330f97f4935843d52acbe00b3ecacc4e706d3e66f9d6948348cbf1068622931cfacc84a3
TLSH
T1627170351286C8E1F3710132BCE9525EBB73A5C9F9A7AEE151D0BC372508FA2960715C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584929.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584929.TMP
Size 3KB
SHA256 8adeb30fd74673e8a65948363eff6b7455bb25a94abab57d1fcd2b224d7d7dd8
MD5 3595c5de96658be870aadaad6582fa5e
SHA1 dfc027010e7bf488c82bc6f2b781e0b129e6de9f
SHA512 916d9a8cb043f02a98c5ba088a34dc57522933c780abce166bc0cfaa86203faa2228f4a81a8b95cc210e02a9c8e9cccdd37973ec37a9a51178118d89fad989c5
TLSH
T1A97180351286C8E1F3710032BCE9426EBB73A5C9F9A7AEE151D0BC372508F92A60715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 466b2a22fd976b4ce35643da880f69acd54824703b8675922d63fad47bedb2ad
MD5 9162f35b361aab320c4304784f9d98c4
SHA1 8b03a98ba4db1aba3e578babfaaaf409aa5108b1
SHA512 d3296666c8aabb6776bc239c2bc4e257dffd90e01295f4e8c533c3bb49f0c24cc54a4e95d710adfda60e76b1f09db5a57223a9a9b8c1ea8992bb583253bca287
SSDEEP 192:sxZgRWyM/jK1Ml8Mk7/f9shUtIdpJHW6+WNGYIwWEUzIgrJ:sxZggM7/f9shUOJHbG5J9
TLSH
T10242D8126B345977CCCBD209FA55BF53D6F91573A2900E48A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e5814f82fab7019ce0e7a2ec0e8ef07861fb0a10c09fe821b742ca6eeb9b2a5
MD5 f8255daff1ac3b66bdd358769d9d7408
SHA1 82714fa72a4ce07481a6a8777df14f13db744796
SHA512 a293229bf0f47d8a4f3e1fe58bb9d189e93334bc2a7c80d6467f9a39cdce9f55a967cd38beb0fbba3c802f41bf0d61626576bbd94ee7af523a818624e48f0f1d
SSDEEP 768:s2sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9TrorWi:s2sqxXlWvJD6Tu1ja54LAs9gr5
TLSH
T160D21B3B694CCB7E4F840E5CEC266FD76ED801CBA6988D5447FA880C03CB6EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1eaf5a9ab07ca2d584e7152b2770bd4fe285b434590710bfff6ffd96fe13e144
MD5 d933da7f972820193d975335933edb6d
SHA1 a3ac4ca0bb55cdfc54b641dc0004f1c717395827
SHA512 71791f3e9fa25df8045a8ebddedd64e392b86dc34707ed08ee6f9839f061c781d22bdad829a4215c0d59ab40894d171482f4a4acf7c5a5a6cf349f340ec57ed6
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2Ae:ExH3ZFDNr
TLSH
T110E1241B3136066238BE2948B2A7CA3B4F4232637518A56F7F7850B55D6EE120DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 dd1cf3ddefa8cd51f0b08fdfb040421079657e586f42128afea2f559bc110379
MD5 1e58ab53f2214314d2ff365e8ed96b66
SHA1 66d1313d636b2da9fdf06032ab8cb3a5b03b58c9
SHA512 4678f131f6e4e5480773b593a96974755f201702f6f8635a2c6aa3cd61187a7eef7c58e2ec63ab005bd30289b035ea79e8ec03389184926292ed39ff81311400
SSDEEP 384:ItNn/s3n9SfsN5xuQ50bhKAVRN5Oj9z9d+2fu9QITGT0IAx9/:Ij+9UGNtWH5Oj9z9dlm9Qi+09v/
TLSH
T188927C325E389C774EE25556F50B324B0EB841A7E6C63F84D4EC6F0C01DBAAC139A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb8c5c7a836b1a03543c0461d8a7f049399324a5d39697927a5a6b5e9ff8e1cb
MD5 e738283f085bc0c5dd24fd3146fa3dbc
SHA1 9e48d4f0dea66445177f560e769c29985514b036
SHA512 792242265958e838965a62ff59269239a91fad86fde506ef0133deb00791ce94ca29d87c2bcd09ed364aec5d1136f10ee928e7b8fdf80bb7c4f6fccc4ca7ad8a
SSDEEP 192:tONiD6JkRtQmiUymaW+RN5Om5o92h3jRXU6:tONiD6UrUW+RN5Oj9+xU6
TLSH
T10E02C7356D385C779EE26E0AB98737175FA4207BE9852F84DAE81B0C01D7A9C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 305d74cae4124842fdc178d946377deeb83b6671105fce51241582a5e2197f94
MD5 a944ed3c4abb7029b69c28b8a8a42e95
SHA1 3eb2f48609f5828ba41a61f1f1e1373929687996
SHA512 7bcb33b467fe874ec73b75b34b14eec76bbface0a6da8a023a0c36173d9195b7d01e2809cdba709d682835883d521b2d68c841769d8bc6bdece67b3edda45a23
SSDEEP 192:kONc6JkRdQmiUy0ag+RN5Om5o9nz9d+2fuDVcRqImU6:kONc6UbAg+RN5Oj9z9d+2fuqQU6
TLSH
T11D122B366D285C775EE26941F48731174FA9516BEBCA6F80D1DC1F0C02EFAAC134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 689c339619a4546ffb5e27e8bb0312c4c41c83ad530a35350a8db9bd8628a379
MD5 fa93e005fbfdef2399c5a4f3aa0747f6
SHA1 9fa75239a9a188337dba583568159f6c9dda7f18
SHA512 4c0c03430b7aff1538bf3f744b09f85101cafa4c331ba7c1c927879308ef23b35cdb051a389b4c408cb51e1059e5c8b5d9a38713c70629f2402bd2ecd93a9c9a
TLSH
T1A6411898B6EA1108B3776F9A9BF6A47D447EB8772F06D45D10110D4F0763B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads