hxxps://iibhs-my[.]sharepoint[.]com/[:]v[:]/g/personal/rgauthier_ibhs_org/IQCtgijKoP6wSqEIbmuLsbrLAexZIWQ-bJT2PiuA8ucePco?nav=eyJyZWZlcnJhbEluZm8iOnsicmVmZXJyYWxBcHAiOiJPbmVEcml2ZUZvckJ1c2luZXNzIiwicmVmZXJyYWxBcHBQbGF0Zm9ybSI6IldlYiIsInJlZmVycmFsTW9kZSI6InZpZXciLCJyZWZlcnJhbFZpZXciOiJNeUZpbGVzTGlua0NvcHkifX0&amp%3be=YcqNl5&CT=1782235596785&OR=Outlook-Body&CID=F7BF0A47-6F1D-4B0E-92BE-C3C5EAF8FD3B

Analysis

user interaction
yes
max time kernel
298s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://iibhs-my.sharepoint.com/:v:/g/personal/rgauthier_ibhs_org/IQCtgijKoP6wSqEIbmuLsbrLAexZIWQ-bJT2PiuA8ucePco?nav=eyJyZWZlcnJhbEluZm8iOnsicmVmZXJyYWxBcHAiOiJPbmVEcml2ZUZvckJ1c2luZXNzIiwicmVmZXJyYWxBcHBQbGF0Zm9ybSI6IldlYiIsInJlZmVycmFsTW9kZSI6InZpZXciLCJyZWZlcnJhbFZpZXciOiJNeUZpbGVzTGlua0NvcHkifX0&amp%3be=YcqNl5&CT=1782235596785&OR=Outlook-Body&CID=F7BF0A47-6F1D-4B0E-92BE-C3C5EAF8FD3B
Sample260623-v9aqbaez21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267100621197802"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{54F07315-CAF4-4DEB-8B41-DD886319C680}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2536	3592	msedge.exe	87
PID 3592 wrote to memory of 2172	3592	msedge.exe	88
PID 3592 wrote to memory of 2388	3592	msedge.exe	89
PID 3592 wrote to memory of 2172	3592	msedge.exe	88
PID 3592 wrote to memory of 2172	3592	msedge.exe	88
PID 3592 wrote to memory of 1388	3592	msedge.exe	91
PID 3592 wrote to memory of 1388	3592	msedge.exe	91
PID 3592 wrote to memory of 412	3592	msedge.exe	92
PID 3592 wrote to memory of 412	3592	msedge.exe	92
PID 3592 wrote to memory of 412	3592	msedge.exe	92
PID 3592 wrote to memory of 2156	3592	msedge.exe	93
PID 3592 wrote to memory of 2156	3592	msedge.exe	93
PID 3592 wrote to memory of 2156	3592	msedge.exe	93
PID 3592 wrote to memory of 1792	3592	msedge.exe	94
PID 3592 wrote to memory of 4756	3592	msedge.exe	95
PID 3592 wrote to memory of 1792	3592	msedge.exe	94
PID 3592 wrote to memory of 1792	3592	msedge.exe	94
PID 3592 wrote to memory of 4756	3592	msedge.exe	95
PID 3592 wrote to memory of 4756	3592	msedge.exe	95
PID 3592 wrote to memory of 2708	3592	msedge.exe	99
PID 3592 wrote to memory of 2980	3592	msedge.exe	100
PID 3592 wrote to memory of 2708	3592	msedge.exe	99
PID 3592 wrote to memory of 2980	3592	msedge.exe	100
PID 3592 wrote to memory of 5004	3592	msedge.exe	102
PID 3592 wrote to memory of 4508	3592	msedge.exe	108
PID 3592 wrote to memory of 4508	3592	msedge.exe	108
PID 3592 wrote to memory of 4672	3592	msedge.exe	113
PID 3592 wrote to memory of 4640	3592	msedge.exe	114
PID 3592 wrote to memory of 1984	3592	msedge.exe	115
PID 3592 wrote to memory of 2916	3592	msedge.exe	116
PID 3592 wrote to memory of 2916	3592	msedge.exe	116
PID 3592 wrote to memory of 1228	3592	msedge.exe	119
PID 3592 wrote to memory of 4572	3592	msedge.exe	120
PID 3592 wrote to memory of 4572	3592	msedge.exe	120
PID 3592 wrote to memory of 4672	3592	msedge.exe	121
PID 3592 wrote to memory of 4672	3592	msedge.exe	121
PID 3592 wrote to memory of 2960	3592	msedge.exe	122
PID 3592 wrote to memory of 2960	3592	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://iibhs-my.sharepoint.com/:v:/g/personal/rgauthier_ibhs_org/IQCtgijKoP6wSqEIbmuLsbrLAexZIWQ-bJT2PiuA8ucePco?nav=eyJyZWZlcnJhbEluZm8iOnsicmVmZXJyYWxBcHAiOiJPbmVEcml2ZUZvckJ1c2luZXNzIiwicmVmZXJyYWxBcHBQbGF0Zm9ybSI6IldlYiIsInJlZmVycmFsTW9kZSI6InZpZXciLCJyZWZlcnJhbFZpZXciOiJNeUZpbGVzTGlua0NvcHkifX0&amp%3be=YcqNl5&CT=1782235596785&OR=Outlook-Body&CID=F7BF0A47-6F1D-4B0E-92BE-C3C5EAF8FD3B
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff94aecc188,0x7ff94aecc194,0x7ff94aecc1a0
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,5400208933113310789,9979104048929602910,262144 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,9850279810759882142,6074996641148053728,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,10778677817298052111,1358758361485761395,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13785731827913043555,8004374733142203630,2097152 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4003751570326353481,2970857886563252468,2097152 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4370446562656261027,4996410548313531914,2097152 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2727567383288484934,16543470202641385910,2097152 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,761329476604708817,3765854561062902427,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,11417712981808819401,6244270399880893703,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2348434782494837329,10206091124669475832,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2348434782494837329,10206091124669475832,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15987732942648197626,10876611276996737778,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,13895164834275357709,3736776677149132717,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10305639337965700914,5321972232956410585,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,13173134951421864228,436691202064027395,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11078334337985071693,3933590299639458819,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,14930483595535971036,15638814151208737363,262144 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,15540787705658239447,4242507812588633516,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,9832562362745765203,2045946718608554876,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,1554713032093225913,7393603124596915491,524288 --field-trial-handle=2300,i,15418939436363417668,10420592711732157439,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 03084ef4bade48bc03a70479ba1f19bb3b3f8aa3f23722e428d7f2a57d414790
MD5 ee3c84b9a5352dd5245042647d868538
SHA1 7fe1f162a9ee9b97380d78acfb58744008f27c60
SHA512 76ce3f9a3cb63e41fbdcdf9e0eaca2f6e87f1f5b365f16fc56476179a61a117f8dc63836242a37342e7881af4c361aecbd7209ec4c5a2afd042aa80af3fb4e1d
SSDEEP 192:7j4NjEEaKKhhhhhhhhhhhhhhhhhhhhhhGJMTLO:7j4NjEEaKKhhhhhhhhhhhhhhhhhhhhhU
TLSH
T1E8E1585782D8DB9A8F0510CA4DA463AC5070370EEBDFD50C07ACCDD9354E6DEB8AAB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4e8e5c4ad4e9e2d462e0825e83376c4aba3e061ffe766d264f624a8e53a2210f
MD5 5c3987ee2dbd53ed11036b24b082cec8
SHA1 fade0b6a4185944f5970f513cdb79c9204bbf47d
SHA512 eaf177b0a3a0789ebc0bd11daddfc52715da46a24939e48bb2af3b1206dd5b474a6a6a3578e379fb77dd58a440641614d8e0dc34699a74e4eb6ab800561f38f6
SSDEEP 48:zscguzthl3wrJnWmWRZpYmD15l0c6sGon3x690gk88Rb9AYEGVv9NfxSlwgz3ZR/:LhSojzj5K05SVYU3Rq93vEI+QxE3oS
TLSH
T10C9192BA129626FADF658433D0F6670033379AE6F1531E0A06304DB7B532F92A1581BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea3d98efb42a469015be3259cfa7ff1b72830ef534df791aea9cc70c6fa834be
MD5 606f6989bced9e8f3bc13619f2ca52f5
SHA1 accc7071658781e3435d0a3358699faab841ee57
SHA512 9e8eede93ca5d028623f21aec982361d484986a4fafacd3e79ace81a8182479231cff02d0367b1b7975cfb6345f9c34a16db7d09baf40ec48dfd39e454146549
TLSH
T11B51EEB7C3E4862FD92251F4AB043D27CE6E04545B6C386685D4EE8B63D24B2F10150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2efed87472b7d0d3c246212a9e82ff91b4b180f1be76870165a6a4f0f043cf33
MD5 600483d4d5bac637a6d9fbbef3f58390
SHA1 b4a44307aac24326c82ecbe8ea01dbe254b9a1d8
SHA512 fc9114c64f1e59d37468d93d813b3b9c5c11c7096c284ce239f009da8fd470cd1b1479cb73637ed09a4f51dd36cba2a8aecfe1fbef75785a908984fdbcde2039
TLSH
T18651BDB7C3E48A2FD92251F5AB053D27CEAE04645B6C386685D4EE8B53D24B2F10161F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 63f1ebe145203f79bd2c53f24178935dc83a3732dcb96ae48d6dbf572cb3a3b5
MD5 e5ca350a9b647b434b7a52de7ba375c2
SHA1 ecf43c05ccc8426b71c4bc58d22f02ee6db75eb9
SHA512 b1c42f0d416de0a3b816e7eb37614d2af45a40f1888e3a35414338a75a606820d6865fdeb09cba0c7f2b7fb61f5cea02d6c67f872b5a0bb8f4f96bf9d68700ea
SSDEEP 192:sxZoRhyM/jK1Ml8MkL/fGsaV85b54Idp/EHW6+WNZG4k/YIEJZ22IgrJ:sxZoPML/fGsaMbzMHbZu/W9
TLSH
T1F952EA166B389977CCDBD209F945BB53D6F50572A2900D48A9FCDB1C04EAAEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c0e5d75f2981f598939767f82dfe3fa0a1d37bc110a5c30730643e41899ae162
MD5 84b7961022462c2476100be24a856ddd
SHA1 ba14ac1b8333970b3dabf023fab2116590a4865a
SHA512 3b724ca634fff3a301318782a54d9f7c66f8264ecae8d6abaaae3a792f50ebe02f85e3534eb201206a161bbcc7b1899b0a26e3ba3a1e42b8b0ef224cbbdad18d
SSDEEP 192:sxZoRhyM/jK1Ml8UQTkL/fGsuV85754Idp1EHW6+WNZG4k/YIYgh22Ig5nJ:sxZoPq4L/fGsuM7z+HbZu/pj
TLSH
T1AC52D916AB389977CCDBD209F545BB53D6F50472A2900E48A9FCCB1C05EAAED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 811f9b7bd75294470769dc67e24e073004879c97a7acbb5f17d55ae74f5b9699
MD5 b76e80802f1a60309886dc24d2bd2e83
SHA1 243aea3bc1da4e787f451698d58745b2de119c0a
SHA512 618478347803a167b7cd09f030b3d933a8867f9d5ae5bb5d546d3587e3e56875dd7f92fecc9e52daaa01821837aa936e5bda8e4abc39d4a4cee994506414589c
SSDEEP 768:2ssqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9urousw:2ssqxXlWvJD6Tu1ja54LAs9lu9
TLSH
T1F7D21B3B694CCB7E4F840E5CEC266FD76ED801CBA6988D5447FA890C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e1fd47e4cffc5fd128dd2df4f035ef1b85d899f0f5b3c53a3474435e524a278b
MD5 096ea9207ac49683964d199bb656f3d3
SHA1 097a3da587798f04a5c15943b759266762239f88
SHA512 4f15bc8760fe8920dbe9b39f731776026b654755db58e594fe92a14c5c3eb669ccb502fd1913c1c925afaf7b9734f4d8996a3f053251ec1aae581dd874550b17
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCJ:ExX/l9Zfu
TLSH
T150E11402717F02033ABD7909A3AA89374E4275A37418A4BF3BB955624EB7E111CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e5716d52bd11f0409728682731bc6d9f4d62dae363d876bfc6704d72631dcce6
MD5 e6a9eb4feeae047a7f038b84ccb92760
SHA1 de46091f4a5d8b9ccbcaa3bc04e5ce13416191f0
SHA512 8fac082aefd2716ef9541f3e8d299b1e91b6c0763b92782816e1361c7734d011c137a9cc6353477053b231bbc0720a9a4679321b9b46ca949a0c94a0aa64ddd7
SSDEEP 384:ttNn/s3n9SfsNTbI8beVWVRNwOWG9JHSITGT0IGKx9/:tj+9Uxv0HwOp9RSi+06v/
TLSH
T19A928E326938AC7B5EE25596F50F360B0FB445A7E5C93E8495ED2F0C01DF2AC134AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 17a2da1ce7adab158572855b8d46192be342274cc840254548a3217440d074a1
MD5 8b17f5fec28d4ad6c4a683be377faeed
SHA1 c2c494b0844dd90d0e777e8e568fa64bc8645c40
SHA512 134f890aef2f2aeec47edfcd257495f749cf40691297ed4afcbca64645d9c59792e19cfa7a3cd103e66e5d024b37fdc48a9ff17d01f1d2203fedd79732726b6a
SSDEEP 384:ytNn/s3n9SZzsNTiI8beuWVRNwOWG9JKSITGT0IGKx9/:yj+9iwE0HwOp9kSi+06v/
TLSH
T1A7B2F6F255E75876C9AE5747B33E2D070EBCC067B5852A44B7D81B0CCC8A27FD20A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff6ed7ecb886aa022f05decd9f184b613113ab5006747d8959df0bb3788e9022
MD5 008a4b8d596e5e1fc44b0e7dda7d6286
SHA1 59707ec4c9ac3428ce777d116c9ad637ad72e768
SHA512 a47f125827a7a0451ba9cab6d548b6c311b1a059324bb66cb1b6706644f8e79114d07399c537d630a794b88dc7ad05d1511fd1562711a45d893baab5a00288b5
SSDEEP 192:sxON7y6JkRHfQmiUyUost+RNwOmhOmVU9DFEVcrq79U6:eONW6UBmC+RNwOWG9JzSU6
TLSH
T1FE121931A8385C7B5EE26946F54B36034EB5512BFB896F8091DC2F1C01EFA9C234AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e77704f4f6725cdf35977fc3e7bc646db7987d1489cf474a9489c79286991ad
MD5 0cb0c6417990a4729b3a89cb991989b8
SHA1 e913c21c8a462a216b4ee75a9260ab7292c4ecb4
SHA512 492c6d88ef5e7383c9fc8c35f1be569ca37b4e3899448df106a5309ba942f6e1c8ef1d6ce7f6669acc731add08609ffb8fa8419536c6e0723f76e05d55cf1644
SSDEEP 192:tONg6JkRtQmiUy0oW+RNwOmhOmQh3PRQU6:tONg6UrYW+RNwOW0uU6
TLSH
T1BC02E835A9386C778EF26E0AF58B27175FA4203BFA852F84DAD81F1C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e6f3f4be81d8f1019d319662f8fadb963becdec0b6a6d9bb83f288b3f6b1b13a
MD5 901c4c5342db651147330fb6174ddbb0
SHA1 5f0b15ea1cdec9deef43628c8f3531984e5b5c12
SHA512 c9826e1f9709e50ebcdd023c5dc3e5291b2ab4d95c4c3b0976eaa2f08a57c3ee9901994fdb082be490e9d55aa490bac70ff34a6460b956e22702a46e1c396eb4
SSDEEP 384:ttNn/s3n9SfsNTiI8beVWVRNwOWG9JHSITGT0IGKx9/:tj+9Uwv0HwOp9RSi+06v/
TLSH
T16D928D3269389C675EE25496F50B360B0FB445A7A5C93E8495ED1F0C01DF6AC134AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bb9c83e-cc84-4e73-82d5-43b493263741.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8bb9c83e-cc84-4e73-82d5-43b493263741.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 338cc1c8d590d727bb5e1f9a97a5d2cc1a8bbf898cd089ef2d18f2b34b9fc15b
MD5 ed23f69a7b3067a6e04ce22a3804fcad
SHA1 acbd969d3e89d1ba4c946bb9c9badb09dc01cec7
SHA512 2af5d5e4a33a017e56a39de3058be8483120eff4ccb97e8799fd09b8d75572913e3f4e802ad620484a52cca99b399e45d08195ccbc75bfc41a46c8916f480787
TLSH
T1B341E95CBAFD1118B3B76F5A9BF6A96E447AB8772E06D15E00110E4E0673B40D861733
MD5 SHA1 SHA512 TLSH

Submit Download