hxxp://arne[.]honeysstambasawali[.]cyou

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://arne.honeysstambasawali.cyou
Sample260625-psa2vsb17k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268645222935499"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DFC74F73-5809-47B8-9D60-4156C8043D21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4204	4680	msedge.exe	88
PID 4680 wrote to memory of 2520	4680	msedge.exe	89
PID 4680 wrote to memory of 4068	4680	msedge.exe	90
PID 4680 wrote to memory of 2520	4680	msedge.exe	89
PID 4680 wrote to memory of 2520	4680	msedge.exe	89
PID 4680 wrote to memory of 4288	4680	msedge.exe	91
PID 4680 wrote to memory of 4288	4680	msedge.exe	91
PID 4680 wrote to memory of 4112	4680	msedge.exe	93
PID 4680 wrote to memory of 4112	4680	msedge.exe	93
PID 4680 wrote to memory of 4112	4680	msedge.exe	93
PID 4680 wrote to memory of 2060	4680	msedge.exe	94
PID 4680 wrote to memory of 2060	4680	msedge.exe	94
PID 4680 wrote to memory of 2060	4680	msedge.exe	94
PID 4680 wrote to memory of 208	4680	msedge.exe	96
PID 4680 wrote to memory of 208	4680	msedge.exe	96
PID 4680 wrote to memory of 208	4680	msedge.exe	96
PID 4680 wrote to memory of 116	4680	msedge.exe	97
PID 4680 wrote to memory of 116	4680	msedge.exe	97
PID 4680 wrote to memory of 116	4680	msedge.exe	97
PID 4680 wrote to memory of 4576	4680	msedge.exe	99
PID 4680 wrote to memory of 4576	4680	msedge.exe	99
PID 4680 wrote to memory of 4576	4680	msedge.exe	99
PID 4680 wrote to memory of 1920	4680	msedge.exe	100
PID 4680 wrote to memory of 1920	4680	msedge.exe	100
PID 4680 wrote to memory of 1920	4680	msedge.exe	100
PID 4680 wrote to memory of 1884	4680	msedge.exe	102
PID 4680 wrote to memory of 4088	4680	msedge.exe	103
PID 4680 wrote to memory of 1884	4680	msedge.exe	102
PID 4680 wrote to memory of 4088	4680	msedge.exe	103
PID 4680 wrote to memory of 4812	4680	msedge.exe	105
PID 4680 wrote to memory of 2588	4680	msedge.exe	110
PID 4680 wrote to memory of 2588	4680	msedge.exe	110
PID 4680 wrote to memory of 2588	4680	msedge.exe	110
PID 4680 wrote to memory of 4400	4680	msedge.exe	112
PID 4680 wrote to memory of 4400	4680	msedge.exe	112
PID 4680 wrote to memory of 4400	4680	msedge.exe	112
PID 4680 wrote to memory of 3800	4680	msedge.exe	115
PID 4680 wrote to memory of 3800	4680	msedge.exe	115
PID 4680 wrote to memory of 3800	4680	msedge.exe	115
PID 4680 wrote to memory of 2188	4680	msedge.exe	117
PID 4680 wrote to memory of 4184	4680	msedge.exe	118
PID 4680 wrote to memory of 5084	4680	msedge.exe	119
PID 4680 wrote to memory of 4268	4680	msedge.exe	120
PID 4680 wrote to memory of 4268	4680	msedge.exe	120
PID 4680 wrote to memory of 4268	4680	msedge.exe	120
PID 4680 wrote to memory of 4736	4680	msedge.exe	122
PID 4680 wrote to memory of 4736	4680	msedge.exe	122
PID 4680 wrote to memory of 3300	4680	msedge.exe	124
PID 4680 wrote to memory of 3300	4680	msedge.exe	124
PID 4680 wrote to memory of 3300	4680	msedge.exe	124
PID 4680 wrote to memory of 1948	4680	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://arne.honeysstambasawali.cyou
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc0da6c188,0x7ffc0da6c194,0x7ffc0da6c1a0
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,8156127964360707917,3635773221882644510,262144 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2502839836540317085,11771233121290767690,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,15647942226506943030,4269035423104173370,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16024991654090531574,8864546465074745815,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,15898048828297878361,5616788675735149141,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,5068908459196496162,12049401509490865421,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3965611856198364395,12730845443466684151,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4872,i,5965387702102789848,15251123569477352319,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5096,i,13665764433645620661,5496274010489257741,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,10617368149664208819,9283515039098924888,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,3206803384937276973,1591126448812907516,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,5495493694343284224,8033810962655707906,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,5495493694343284224,8033810962655707906,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6332,i,803981314814900629,7741533464419066522,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6376,i,16230908853470998150,17924367969591245622,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4460,i,11898288754385035842,11929206043875633985,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12180658928632416413,16784455465492843258,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,5747826955068903118,3702513553198200663,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11152630989345437823,18120846106511251109,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4408,i,7953714921114182310,5893553078990573738,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11387109508580730523,16556084346705260896,524288 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4540,i,2451144717424203707,12742133213197633896,2097152 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,17831928520051916448,17900870993643288937,262144 --field-trial-handle=2252,i,11960026413630213492,3915942776033298083,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5382c5830f04a56011268526b073f876fb777dc19a7315009abcb003e10b0e5e
MD5 018adcf2be4ca8722b27eb611da1d010
SHA1 66888ea2975ff3603a56a809f2a1a72bb7a53c90
SHA512 d88d601d98375c3628d8ca3576439a8498a92a336bcf98915fa95de7aeecc8f2a43d2f5cf7ba453ddc1f3c37d6b07e66ba52fe4d0e949a86dac5edd3f6d02ac4
TLSH
T1BC618219194E14B5F7611B31E8C14600F9B053B91EB72ED336F8D97EFA2EF23802559A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589f58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589f58.TMP
Size 3KB
SHA256 6dd2bab09e669d6b3f3036d1c531ddcfb28d5e116ba38ceb7c620f80527d350b
MD5 2a2e7f30bd1ffc81642e2719252fba36
SHA1 e69c1b22df21157bf150ad9a283cc9b6a30fcfce
SHA512 8a5b84866085da04b7bf59b1ad167f443d564c7b8c04f0a3190fd781d35529e3b049368ff78665e87b26fd970992ba49ad5e5242632b0934bba49c2fea85111d
TLSH
T19E618119194E14B5F7611B31E8D10600F9B042B90EB72ED336F8D97EFA2EF23802559A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0503f4551c3783c60686969adde32bf8fe9c81ff730cf1b0b6f310de310851df
MD5 b51277b0b8b9352a181b964a2c4015bc
SHA1 e75f0fa7b18679d80f4ee88fd4535ddaabbd3cc4
SHA512 41a89e6f2c4392ab4392d36e24e5e514e5b45bfb3a9a1cb5bcee4340e7a92e38625c59cf917d64bbef414d7f8de40200ee67013c563f437a0b5864652afedd6b
TLSH
T10821DDF383E5866EC91556F0AE247E2FCE2D0551836C3C5A89E4EF1B93E6075E001A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 914672b9eb5ac60cdb04c606f02b8f7fc93dd2fe1352cfb407a3265bf5516afe
MD5 40189889b714981337c9169b837a3db2
SHA1 a9ef9000350af7721f780a46d4bf25d43390f63f
SHA512 42810686a4b40992505bef09ced0b47fedf14b21eaa5531aab686c89ddad5e87f0b7756047da4449869ab17a58f8c20fc713ae956a16385bbef18cba1a3c6505
SSDEEP 192:sxZUR/yM/jK1Ml8Mk5/fqsS1JIdpAkHW6+WNGYLzFw5IgrJ:sxZUBM5/fqsS1CNHbG79
TLSH
T11142E8126B345977CCDBD20DFA45BF93D6F90473A2900E44A9FC9A1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e219a285345415a8d2f220e6dd363f6161066bb603de0125bfe2b9dbde5514b8
MD5 be033006806b9db821b63b1f68d76739
SHA1 68ffe79a449ff2ef4aea0ec61c3d99651d6f7d09
SHA512 bcfbcf65cc7d2252c2aabc0bc455e303cea52a2b1b4b3ef08cfe2f7ea812ae828c63b710c27c9911aadfbb31acfc045b81d5398c97a1d5305f96b49df2b992c9
SSDEEP 192:sxZUR/yM/jK1Ml8UQPk5/fqsvCcJIdpekHW6+WNGYLVM85Ig5GJ:sxZUBq85/fqsvzCfHbGg4
TLSH
T10852E9166A345977CCDBD20DF945BF93D6F91473A2900E84AAFCDA0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a789d26a1484b8cf5b8a1d586f3648846ca9bb3144856e2cbec78e04b8cdb453
MD5 95a29c944b8e83a6497d117d9ac395c2
SHA1 eb421ae08c7899e6b54593a610d30613fe30f853
SHA512 82fc9cab6f82b44c0458ee195536aeebc5eb08bd4d97bb9c5f9b0152e5f0d881f31da4644554079ac31ae88688dcde34e75ef682b00bcd86d07c031ceaaafd02
SSDEEP 768:+4s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNZroe+:+4s6pD1WvxzWju1jahILIsNSe+
TLSH
T1B6D2EA3B680CCB7E4F841E5CEC2A6F966DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 875ec0d89bff57e299d43fb8fa398591856db04430bc11b14729d9ea8ee1e7ba
MD5 d44e340d3c248bbafaed784810a48a47
SHA1 244a49a39e052409b8d3ba374e3e2aee5a1028ce
SHA512 1cfe33789dcf3e75108680197728c17cc47661abb2716a2d5324cde4b1130e1400f16906d6af363aace728be57b4e0098ef5468c2e61906dba8e171ad1010ee4
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFzIVKwEfyI/Kva4bytLIxK8IMX:KUAAKteP+zWKwEfysKva+OLeK8Io
TLSH
T1A2B1260271BB13123D7E2908A299972A5F8276633814F42B77AD40725EA7F340DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 7eca6de2447648f8e80dd2295c3991fc57a9fcddcb9d19cc0c37275ca222ef15
MD5 c0558e59507b6d505b16cb86c91cfe56
SHA1 424c3220261397af844e59cc74032f7b51e4c0dc
SHA512 f1739a4de5a4cde5c1a7342a38282fb97a9fde41668883abaf4ec4cb1be58f83422e4e9aee901bc34dcedef8ce5522498becb0f0b8cd88b1edcfc6547ea48be0
TLSH
T1A62178C2D3F521A56E4E7547D10A9403AAA13EA7270F9C71331E54F55FC4C181B5EF21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8921c39b748c89408ef69e0b6944b78232997c6710ce474f749f3ca387ca6d96
MD5 3b108fde527ac3bbb0979448d9b1aafa
SHA1 bb0706a6ded18643b343c25bff62a4e02657c304
SHA512 e5286500364c88bc51233e08511591d66e83a9e8dffe66421ad8efe9cac8da8b08e42217d37464157d0fce59ba2dd8777e920d2b3c9f58326adf9470d8e75d0c
SSDEEP 384:atNn/s3n9SfsNh3DKJBua9sO7SB5amn15wbAjEUqV:aj+9UjFiO2bamn12bfUqV
TLSH
T1BC928D3A6C3C1D735DE39089F58B221B5FB98177E6862E90D4EC9F4D00EB69C131AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b8dd815258a3ebc2625121c79803487dd948f5470379d3cf86adcef4c7285f5e
MD5 d4258c292315dd7ac71a235edad83e9f
SHA1 197f3cf6fbab9a07b69922760375d64986529cc6
SHA512 fe234ffc48dd0b572186cf3b5c3035725b4aaa69fdf99f30697e18bc44d7198f516a4efd49396afa04f6c27abdeed813870fb6bfb520171a97f27411bbdb84fc
SSDEEP 384:6tNn/s3n9SPzsNhiDKJBua9sO7SBIamn15wbAjEUqV:6j+9k4FiO26amn12bfUqV
TLSH
T129929D3A68381D735DE39049F58B221B5FB84177E6C62E90D1EC9F0D00EBA9C131AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 17dd982f911c6b4c1946b9672ea19ed6de2a723d15e3be1a784e1ac1d67c840c
MD5 6a523c1a41d438c7fee8f410d1310fa2
SHA1 a91c96c4338eda5665a17e5ced9e8025ed8e4802
SHA512 d910bea8a9776f419ca934b754353d09d21cea84d8fd87e7de60207c4cc7ed9a4b493f22c5ce08fb48740ca2858447b6cb95fe2815a195562c38899348f6ba51
SSDEEP 192:qONp6O7+3hQmiUydPGttb0RO2osgG1fU6:qONp61mGt9sO7ClU6
TLSH
T1C002093968786CB79EF2AD49F68727175FA5113BE9922F40D5E81F0C00D7A5C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d76d266f91d51f7d52f7ad3b41574c23dbe30c4134f37d26357d431b888e68ee
MD5 3f092b2848e05cba2b96a9c9e052cd1a
SHA1 8a92cb10612df5e7251dd4f865725dae82916ab9
SHA512 253b80eaddb5da94f01fa0f60c5212c8082efc426258aa4dd4292d4fc11473e554cda639ccc8e1466511d941f662425b1e72c594a630eb95b73d56e8fca8f485
SSDEEP 384:6tNn/s3n9SfsNhiDKJBua9sO7SB5amn15wbAjEUqV:6j+9U4FiO2bamn12bfUqV
TLSH
T122928D3A68381D735DE39089F58B221B5FB98177E6C62E90D1EC9F4D00DBA9C131AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c30b40667c220f9b1b9627fd74cce639bb7bc620fc5f02facd1ca31876360f3d
MD5 380c698760840ffb6bd0725b6e1a289d
SHA1 de21f37174673adfb0b3206eefe32c27426fd344
SHA512 6f4fb78a0253e6e5e0e75b5bd80cde2aef09ec7855fa3e03415acd0a8ef0aa54d31135fe5f134f3a94f109dc5ffaf8ac54b43827634916ad9bcf73ae49ad9fa6
SSDEEP 192:iONU6O7+3eQmiUy3PMttb0RO2oSBpcNCqAfU6:iONU6gCMt9sO7SB+aU6
TLSH
T19B121936B8689C775EE2A544F98732179E754137EA867F80D5DC2E0C00DF9AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a981ad392a159e505da38f7739f8349c63df84e03297d3c24daf73e472818f15
MD5 14cb6cc14185e1c53b9b5fcc32cb7016
SHA1 c409fc5133ebd39e58db31e050443cea3a8990e1
SHA512 691f80fb96831ce121fa87accd1cb909122d4df19a141d441dee04657aa1477303379f9fa91a612f20e19c52646cde62bb9511b50aa6a2904c312aa3d66a4acf
TLSH
T14D410998A6EA1148F3B76E469BF7A89D487E7C372E07945D10110E4F0A72B40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download