hxxp://ccralull-psd2api[.]luxhub[.]com/bg/v1/accounts/6900538320/transactions?bookingStatus\=booked&dateFrom\=2026-06-17&dateTo\=2026-06-26

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ccralull-psd2api.luxhub.com/bg/v1/accounts/6900538320/transactions?bookingStatus\=booked&dateFrom\=2026-06-17&dateTo\=2026-06-26
Sample260626-dk4tesht8p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269167059417910"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{381D8455-1DD2-46FA-B661-248ECD5F04F7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4964	3964	msedge.exe	86
PID 3964 wrote to memory of 2052	3964	msedge.exe	87
PID 3964 wrote to memory of 904	3964	msedge.exe	88
PID 3964 wrote to memory of 904	3964	msedge.exe	88
PID 3964 wrote to memory of 904	3964	msedge.exe	88
PID 3964 wrote to memory of 4692	3964	msedge.exe	90
PID 3964 wrote to memory of 4692	3964	msedge.exe	90
PID 3964 wrote to memory of 3872	3964	msedge.exe	91
PID 3964 wrote to memory of 3872	3964	msedge.exe	91
PID 3964 wrote to memory of 3872	3964	msedge.exe	91
PID 3964 wrote to memory of 5068	3964	msedge.exe	92
PID 3964 wrote to memory of 5068	3964	msedge.exe	92
PID 3964 wrote to memory of 5068	3964	msedge.exe	92
PID 3964 wrote to memory of 1560	3964	msedge.exe	93
PID 3964 wrote to memory of 1560	3964	msedge.exe	93
PID 3964 wrote to memory of 1560	3964	msedge.exe	93
PID 3964 wrote to memory of 1168	3964	msedge.exe	94
PID 3964 wrote to memory of 1168	3964	msedge.exe	94
PID 3964 wrote to memory of 1168	3964	msedge.exe	94
PID 3964 wrote to memory of 1448	3964	msedge.exe	97
PID 3964 wrote to memory of 1448	3964	msedge.exe	97
PID 3964 wrote to memory of 1448	3964	msedge.exe	97
PID 3964 wrote to memory of 2192	3964	msedge.exe	100
PID 3964 wrote to memory of 2192	3964	msedge.exe	100
PID 3964 wrote to memory of 2192	3964	msedge.exe	100
PID 3964 wrote to memory of 4900	3964	msedge.exe	101
PID 3964 wrote to memory of 4900	3964	msedge.exe	101
PID 3964 wrote to memory of 1896	3964	msedge.exe	102
PID 3964 wrote to memory of 1896	3964	msedge.exe	102
PID 3964 wrote to memory of 440	3964	msedge.exe	106
PID 3964 wrote to memory of 4200	3964	msedge.exe	113
PID 3964 wrote to memory of 4200	3964	msedge.exe	113
PID 3964 wrote to memory of 4200	3964	msedge.exe	113
PID 3964 wrote to memory of 3852	3964	msedge.exe	119
PID 3964 wrote to memory of 2848	3964	msedge.exe	120
PID 3964 wrote to memory of 2940	3964	msedge.exe	121
PID 3964 wrote to memory of 3168	3964	msedge.exe	124
PID 3964 wrote to memory of 3168	3964	msedge.exe	124
PID 3964 wrote to memory of 3168	3964	msedge.exe	124
PID 3964 wrote to memory of 4772	3964	msedge.exe	125
PID 3964 wrote to memory of 4772	3964	msedge.exe	125
PID 3964 wrote to memory of 3640	3964	msedge.exe	130
PID 3964 wrote to memory of 3640	3964	msedge.exe	130
PID 3964 wrote to memory of 3640	3964	msedge.exe	130
PID 3964 wrote to memory of 1820	3964	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ccralull-psd2api.luxhub.com/bg/v1/accounts/6900538320/transactions?bookingStatus\=booked&dateFrom\=2026-06-17&dateTo\=2026-06-26
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6e9cc188,0x7ffb6e9cc194,0x7ffb6e9cc1a0
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,9635460526040498926,9580929942402902864,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,2937466975055971102,6333841992549354856,262144 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,4112042194128568348,4221110742814730511,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,12157267320932501300,4840965933265701172,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,17848561962051818436,17413254263673722715,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,12269496314614169070,11492067775476281732,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5791723481430196996,1561442609451204959,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,1940889204016112038,462121086251719793,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3424,i,11094771239915985972,5964441299156251671,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,1089114164414146380,4611015278660037402,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,5056333955550500051,2202219420582148934,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,1668746011708578522,5479064675468718865,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,1668746011708578522,5479064675468718865,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6172,i,12525280278980583967,11475683627067930249,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,1581175626749751538,17077503683233411683,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,1873532367831089512,17217425059747799947,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15600425681939641478,11043745653966174123,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5348,i,7609022587559866320,463375111766044416,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9945910044007957734,3651396558005051250,524288 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3608,i,6192973086683156015,14642817421136456469,2097152 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5368,i,313120162763138409,15811165130322096796,262144 --field-trial-handle=2256,i,16061091403029636278,16526914549884407798,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b57a7479c8c839595fb09c5c06596c4b076f51979ccb71ff322e464f181b42e1
MD5 c14ad0a9c4661ff2d691190994771d8b
SHA1 1356ff7683ca1f34ed762c788cc8e51e552604be
SHA512 56db1e38d51982331007b02c280a40cb5bb20111e490542d40cb97c20973dd84bd37436841a0908ee4aaa2512d4d498efb68b74f8e0e03ea96a57e367d27ccf5
TLSH
T1F971187E024217D1E765217BFDD906053A7D8BE909024EAD11A0983FA90EBF4BD3740B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e5c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e5c7.TMP
Size 3KB
SHA256 f05763839fcda67eaad32aee11b67b59116d6014940b0d01c6fdf213ffac8b94
MD5 ee2c07a57b7a607daa2e95e4a3ee0c8c
SHA1 ea038ca51d4f4ff935713eab3f6194ac023a2dd9
SHA512 8325fa35f368be5e177fa8e3dc1ce8e3e400bdf3bfe13fa2fb00e050aa79f1b7d2e179268c29a0bf9b7b23545220986b2cf08b4bd6a90c12295c51972fc61833
TLSH
T1EC71183E024213D1E7652177FDD90A053A698BE909024EAE11A0983FA90EBF4BD3740B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 815B
SHA256 7364427eeb9da9e673ff2220bce3fd062e7dac95107dfb2a449a4117f8f9ceb7
MD5 efd53997a6d3aaa8af3e6bc4eec6b164
SHA1 c65c439302dba0489246454c4bfadcaee4eaa63a
SHA512 4257aa50d3d7cb18fa601699b39e44c4f4fae80cba127412221a04c9bc37b8a704bb4484b45cbea05fc40020618304d100c4cb5a0c5e1fe49a3a7d3a41d43afe
TLSH
T16D0189B3C2D5C6AE894116F0AA28AE2BCE2D0945832C3C59C9D4EF2BD7E3479E50145F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d39e3f280084f4d3a80854c9467c271b319233df9b922cd6c9117af063935327
MD5 453e3f591ce704ccdcbb50680e137bc8
SHA1 4a3f3c9c64d54e0370cac40e5276f7eb50d004b0
SHA512 c33121e8bed030819afae05e0bf3aafa1944c8fd02b89e4264864c8e6e0cddcb3d7e47cb12cbf459d675e8910dcbff52371528d3a464b6fefa192899c764dc9f
SSDEEP 192:sxZER9yM/jK1Ml8MkY/fvsmtWIdpJGHBG6+WNGY4w+zVIgrJ:sxZEdMY/fvsmtXYHpGb9
TLSH
T14842EA12AA345977CCDBD209FA557F53D6F80473A2910D48A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59df98315aff1314020de3547c0ae5f610998400993134e100bf8bb9160bb6d2
MD5 4d6169d2c28cd7e37337b4e22d87440f
SHA1 0dcf8f7bb120b9eac0f919e1f35d41546b27a3b0
SHA512 9857d17be620bbc67cf1aa62ae9fdc68b383999340afeffc85fdc7e7be25298c5e44f62e5ee40035a4ecb5b1bd226e2a31593a07225af8810152b143cd3c5b55
SSDEEP 192:sxZER9yM/jK1Ml8UQ7kY/fvsLYWIdprGHBG6+WNGY4YHzVIg5UJ:sxZEdqQY/fvsLYXKHBGIq
TLSH
T1D152C716AA345977CCDBD209FA55BF53D6F80473A2910D48A9FCCA1C04E6ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aa00ca6d59ea8fe94f93769ad314007c1d086d14a082736a8c118bc23b3b0342
MD5 ce30addf577ff2dd8310b9824ecc17c0
SHA1 cb533e7ba79362d705a4129603e3b45576c09732
SHA512 14d2893b312c0711b2d30dd0ecf2df9cf155bc919d445ed2be35b7b8ca3b4fa75beacd9bbcc9577d760b371f1a50445a935dd3e59ae32ab3c0a06f6a33504a0b
SSDEEP 768:FB8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdyroUkiUn8:FB8iJPNWvx76ru1jahALocdpCU8
TLSH
T10CD20B3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 518e6a3a13a16e2af9cd30b024f21e50c8fc39eec6b0e78a59a825b67dec446b
MD5 099fefba8881c6e883457a38faf8be6b
SHA1 077ba3837710a468af753b7ffab789d29df88abe
SHA512 f59821b88df2141b414e6aaa4c63ce74e4b439ea4f092d6bf15364c7e6b5923584ab5394f9abf11180bac3ae1456d9f423db6e605931a11e970e30c2c07debbc
SSDEEP 48:KKII7KhKEXyHDIfDRxhC3ZmxIAzCK1ntlCpTSy+tIVQrfFvDvMrumI3nvKu+2JvM:KKIAKhKWSwAKdGeCQKDKqB
TLSH
T16191932635FB23012C3E788892998B5B474130633135B46F3BA940B68E2BE251FFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598275.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598275.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 eb4b9226dd81f5064259f79ae0473a7a554d4fc55b00979bee41443f05c3f160
MD5 0e142fb8ce78b24cc2c242dc58617ca0
SHA1 22ca5b79471509769e9606ded80c3c2ac304a39a
SHA512 d9385701f7b947051bb4f8b265d42553e3ebb73ae3e59a9b7f0f3f0fbc36752910355fc37188948b66d239490c7a33237cfdf8525524a0d12b5df3ac8bbd1952
SSDEEP 384:j0iF1tNn/s3n9SyzsNt8TUNTUlIlZl9C5g6kRESZxmn15wbAjEQ:jPF1j+9hIwg39zmn12bfQ
TLSH
T1C3A26D3388685D3B6EB38E45F94A321B9FB04177D6CA3B94E6DC9A0C00DB2DC030AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2017a4239f9ec6f4be6e7cae385b9fd9e6e16a19cbcd542da0d91e37631c5784
MD5 8eeb31fe946c20d17b654abc5f7e72d1
SHA1 be34a42c74b845153058f0d105db21277f68e784
SHA512 6a14ba06aa924aeacb6d73f0af5f86d485f2f70d33a404979fcbf29a5bbfb8e00d05b1d0451b579b2954f82e02d13f3ac67c9bae8f85efbb3ce003fcdab0bca1
SSDEEP 384:DtNn/s3n9SfsNTZl9C5g6kRElZxmn15wbAjEQ:Dj+9Uaszmn12bfQ
TLSH
T1FA927D3698782C275DE39949F44B371B6FA4817BD7C92F94D4EC9B0C40DE398131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7af9ef92d820a968b48f4af0414500c7b896342397042e6249fac97ff8919e3e
MD5 b49e5894aeb2230d827f92b709e48137
SHA1 88633319b88a042915bb7591d033b6b47706ec79
SHA512 5c6eed2d59c90dbafdd537a49958841cce4ef8405b8eed03e3f40b549257e2af3df9f7332c75b1b358489c3407f5e07edb529ba08d86df5f98acd28bf2deffe7
SSDEEP 384:7tNn/s3n9SfsNT4l9C5g6kRElZxmn15wbAjEQ:7j+9Ufszmn12bfQ
TLSH
T191927D3698782C2B5EE39949F44B371B5FA4817BD7C92F9494EC9B0C40DE398131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e61fbdd555676191b9904a83c42280ad1a3d88b9c34a0571fa19d9559ddf079
MD5 d4f5178a3d50711aa755d27603dff014
SHA1 72df581c435b61ecf566a35e9e14e1b42092f4d4
SHA512 9abcb1ca855050f9641e4317398b07bf7b7ad9f9bb6d3e36d9198ec250f268440ee4a8a384fa6aa44c5be10ae46560991412c9bfd1359a0e0156e570b2e60f53
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop555D9BhPwivh50xy0SFYK+AxrgCMx:gONx6kDfQmiUyLjZ903etnQiopU6
TLSH
T19902D739A8782CAB8EF3AE45B48737275FA5112BEA952F85D9E81B1C40D764C1303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50151d283ecaf79bb329dfed0c5a5bdd6a1e5e685eed07840bb0193afefe2e73
MD5 76cab2bb029871b02124044832f8e892
SHA1 735936829f9c59c00bf6ef4741d73671f41f7723
SHA512 45c01249ea24901469bca1a758222efa3c8bc2a60c7c92a20fb316f720395b9b2fd89a422bf963d9ee182b9e13e3759f67b962a4f82f41e6b72af0b10bceb135
SSDEEP 96:DqONkmQsjpfmUT/K5ih/cIPURHl8h4otop554D9BcPwivh50xy0SFYK+AxrgCMyT:GONW6kKQmiUygjm903etLEFcRIqjxU6
TLSH
T195121A36A878786B5EE3A845F48736175FA54227EBCD3F85D8EC1A1C00DF69C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fdbbf53370a08f9d68610c46afc54c3d6c70c591b1e2594b8b09dbb378cb5d94
MD5 730c4b7a7d7b64b53414ee41ec66292c
SHA1 c525806b2b7b3d4229c1c81f185a3eb53ee0d848
SHA512 3e74d8b18158d7e21bf2d86878cecadbab39477acf1c058c946d0bc701ca309661ed84597af1f6e41e15c3e719f3f301886948bfd91073eed0b6aef5ce249c41
TLSH
T19B41285CAAF91148B3B76F16ABF6A8AD487A7C372F06D45D00010D4E0A37B40D871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-194-0x000001DC22D50000-0x000001DC22E99000-memory.dmp

Download

memory/440-193-0x000001DC22D50000-0x000001DC22E99000-memory.dmp

Download