875fb1d4ff6a9686580451fd4f3749702aefe0f5ac3f10cd1fad93ec10faa25c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1edaed4343351574c6dbcccf576c90d7.exe
Size 81KB
Sample260626-lhafssh19s
SHA256 875fb1d4ff6a9686580451fd4f3749702aefe0f5ac3f10cd1fad93ec10faa25c
MD5 1edaed4343351574c6dbcccf576c90d7
SHA1 c129f9d1973716ff8ba869e260002d24b0f6a9d1
SHA512 0f64e6b73af6d231e94d9dd922806eb4a8a490bc1b534845952e74d03d98e69d1b5e6f010fc0274cbab675284b9646e9467e313ccd76e59f0f2785a6bd495fd2
SSDEEP 1536:yz7XE3QjjRDnQmJ0FITbz8PTlX2Vf5FAvNfmLHfq9dk11C2MC6k:yzrE+joI3z87lmpiMS9EC2MC
TLSH
T1E483F207D5695E32CD2C7273009B4DB18D26E0F4D69D0F4B33854EBCEE85661BF2A18A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000002447f-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
924	1edaed4343351574c6dbcccf576c90d7.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s32kcp.dll	1edaed4343351574c6dbcccf576c90d7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1edaed4343351574c6dbcccf576c90d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269400012444583"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{4A062979-04A9-49EC-86EC-B275D182C4D7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
924	1edaed4343351574c6dbcccf576c90d7.exe
924	1edaed4343351574c6dbcccf576c90d7.exe
3820	helppane.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
924	1edaed4343351574c6dbcccf576c90d7.exe
924	1edaed4343351574c6dbcccf576c90d7.exe
3820	helppane.exe
3820	helppane.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4324	924	1edaed4343351574c6dbcccf576c90d7.exe	106
PID 3820 wrote to memory of 4536	3820	helppane.exe	108
PID 4536 wrote to memory of 2560	4536	msedge.exe	109
PID 4536 wrote to memory of 4872	4536	msedge.exe	110
PID 4536 wrote to memory of 4476	4536	msedge.exe	111
PID 4536 wrote to memory of 4476	4536	msedge.exe	111
PID 4536 wrote to memory of 4476	4536	msedge.exe	111
PID 4536 wrote to memory of 3512	4536	msedge.exe	112
PID 4536 wrote to memory of 3512	4536	msedge.exe	112
PID 4536 wrote to memory of 3084	4536	msedge.exe	114
PID 4536 wrote to memory of 3084	4536	msedge.exe	114
PID 4536 wrote to memory of 3084	4536	msedge.exe	114
PID 4536 wrote to memory of 3276	4536	msedge.exe	115
PID 4536 wrote to memory of 3276	4536	msedge.exe	115
PID 4536 wrote to memory of 3276	4536	msedge.exe	115
PID 4536 wrote to memory of 2688	4536	msedge.exe	116
PID 4536 wrote to memory of 2688	4536	msedge.exe	116
PID 4536 wrote to memory of 2688	4536	msedge.exe	116
PID 4536 wrote to memory of 4340	4536	msedge.exe	117
PID 4536 wrote to memory of 4340	4536	msedge.exe	117
PID 4536 wrote to memory of 4340	4536	msedge.exe	117
PID 4536 wrote to memory of 2848	4536	msedge.exe	119
PID 4536 wrote to memory of 2848	4536	msedge.exe	119
PID 4536 wrote to memory of 4592	4536	msedge.exe	121
PID 4536 wrote to memory of 4592	4536	msedge.exe	121
PID 4536 wrote to memory of 1264	4536	msedge.exe	122
PID 4536 wrote to memory of 1264	4536	msedge.exe	122
PID 4536 wrote to memory of 404	4536	msedge.exe	123
PID 4536 wrote to memory of 404	4536	msedge.exe	123
PID 4536 wrote to memory of 2848	4536	msedge.exe	126
PID 4536 wrote to memory of 4152	4536	msedge.exe	127
PID 4536 wrote to memory of 4152	4536	msedge.exe	127
PID 4536 wrote to memory of 3484	4536	msedge.exe	128
PID 4536 wrote to memory of 3484	4536	msedge.exe	128
PID 4536 wrote to memory of 636	4536	msedge.exe	129
PID 4536 wrote to memory of 636	4536	msedge.exe	129
PID 4536 wrote to memory of 1704	4536	msedge.exe	130
PID 4536 wrote to memory of 1704	4536	msedge.exe	130
PID 4536 wrote to memory of 2656	4536	msedge.exe	131
PID 4536 wrote to memory of 2656	4536	msedge.exe	131
PID 4536 wrote to memory of 3960	4536	msedge.exe	134
PID 4536 wrote to memory of 3160	4536	msedge.exe	135
PID 4536 wrote to memory of 1144	4536	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\1edaed4343351574c6dbcccf576c90d7.exe
"C:\Users\Admin\AppData\Local\Temp\1edaed4343351574c6dbcccf576c90d7.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\winhlp32.exe
  winhlp32.exe -x
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4324

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffe7139c188,0x7ffe7139c194,0x7ffe7139c1a0
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,2043863789924219692,16678489810166800901,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,14276489373448279605,2208000558404917626,262144 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,8426172222614347685,8150002080175156889,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16497877979547284054,12905049545882671075,2097152 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3213977132048456853,14199665295103582966,2097152 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,11234020969861945092,6971802422429192136,2097152 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,3913688640333625981,1536146170089866021,2097152 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11540567604855497308,4542862748245268132,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14517283451058134765,18279333320168918749,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16545435359862612617,884373481758904301,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6414379932012583232,2016229437066207589,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13300459973774963342,3579538333224383489,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13300459973774963342,3579538333224383489,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2341225161654305799,10420815167749775131,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,14125055592392216972,1914026382647349684,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,15481208067538121462,11994779854456820057,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5269926942131963252,7265401132173893898,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3446173179638236094,9991374468009095174,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,2456400036342019429,1507632347616077191,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,18300754279494230037,13853035389035738971,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,5150797490619118475,13598634966883712435,524288 --field-trial-handle=2252,i,10677440618061053873,12696298975037368635,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    3⤵
    PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad285ae2add850025873dc9d3b497c8f7298d99af12bb0cb7dcec216e22863d9
MD5 c46342669b1acbae2b603f65ff61280c
SHA1 8609dcc0dbf984e64934d2a96a995734b30299d1
SHA512 5e19c4f7fef79581565463e82b559f872d7081094b2999d864776bd142b1aed187219f20394792c6d760ac8f09d972b28aacebbbc6ea980b30e343d3a29ee00f
TLSH
T183716EBA18E30F65EB15F2705BD10242B23091EBF613EE234D90D7FB6D22731488A098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e73483c4cc53b40c96e40f6f5ef823f5515ff63dc49aca762af31f21d1295e27
MD5 31ba8f57c745c38bf2c68c77ee29ce22
SHA1 362df616c6bd7ade4f578d68d97372778d3e83f0
SHA512 4ec0d8dfbde009d886f8e273fbc8636030bfc20caf0da13f2e918da317e211414cb7654a60c6ac404ab7036e2d526799ba92c48fff81e660d735bf1770826e4c
SSDEEP 48:SWZHutDuopkqrZv+AFYE7+u+Nuzub0sua/lGOuYCuyugDu/Onur2uzQPaSITc4uL:TEFpDWAn7A+a/EmAroWCfOn6RU
TLSH
T1648172BA18E30F66DB1AF6706BD01646B23085EBF613DE634D90C7FB6D137614846494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ec3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ec3b.TMP
Size 3KB
SHA256 9438e3fb73e091aed09103419ecd86abda9da4867875dcf3ec97e5328f01b1ff
MD5 f5de8bb9370605444c579796de391e7d
SHA1 e032ad9b0b3ec78435b5792a1a77588f8f0ce618
SHA512 032faf836d5f394919ef8d03ee2f2d64bd684ca20fc42deee2e78640f6a9d2c360ea4d4646bc317abd609f5c16480d0a88b25a8b5acb3249c7f99e57f3341941
TLSH
T14C716DFE18E30FA5EB22F2705AD10242B13081EBF613ED238D80C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e1150881880220911047eb1e01ca878cc3f9c1105077930a9308a4082d83b944
MD5 87f3f16f0a785b1644298597686d4991
SHA1 aef596b1ae75990bb32186c9952371a63e63885d
SHA512 a690554a92659fa1f1a6f50f601ab786f0a35b92100baa7094493be95da03837792933be8be79bd6b5133abdd458120d9c16b42a64119e729351d788a4da3573
SSDEEP 192:sxZWRkyM/jK1Ml8Mju/fkslId0myQcmTIdphh8GHW6+WNGbY/YIbARAIg4J:sxZWK7u/fkslIdhcmM/HbZ/zc
TLSH
T1C152E816AB34997BCCCAD21DF955BB57D6F50462A2904D44AAFCCA1C04E6BEC2307C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad6efa5af321928a08bc131d8771d53c6d9924e810ccf61fc37e9d475a2ca3c1
MD5 2c92831925f0cbe047ff57e9e738ea78
SHA1 d8bcc9cd26e4855458bdbdc6955994a04c798b5f
SHA512 0eb1207034cd3c80bfc320c3aa531adb4028e26562f58ea7ec8c9f4f652a4a00e016edf9be80df4ab51ca5dd33d6d2624fd3b13d48f560708e105c3c646eb6f4
SSDEEP 192:sxZWRkyM/jK1Ml8Mju/fksaIb0myQcm5Idphh8GHW6+WNGbY/AReLeIEARAIg5FJ:sxZWi7u/fksaIbhcmS/HbZ/od
TLSH
T18462E917AA34597B8CDAD61EF551BB57D2F50462A2910E44AAFCCA0C00E7FEC6207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4309a2c024abdfcd2759c89dd0b1a174e17b07f0cd9e35d0af2a9ed1f858e2bb
MD5 530ca3f5b2cffb6def3498ff7dd3e540
SHA1 e37c87772e19884b0d0704ad566b130756bdf200
SHA512 a070f0ad2d5e3a7bbddad6ff4bc7e3dc9d743a2196ba435b5aa0cf9522805eb587678650f210edefe14b3ccd60144b47264c9df41b079403b350f1de6e06adcb
SSDEEP 768:kisqxfF7pLuL7JlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6454Ll6AR9/rox:kisqxfTE7JlWvJD6Tu1jaD454LAs9sIC
TLSH
T103F20B3B6D0CCB7E4F804E9DED2A7E9A6DE801CB96D8C95447FA840C02C66EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4cd598d861b2988b2b9d795c7a3363ed8e730421250b2a745e75007f425d3042
MD5 d5bbb549c33a9934a02b1b9d57919d86
SHA1 79228402f44884f99093d7703536ac36436e63ad
SHA512 b6b8bcf040a5486db068d862b26d9a81c48c11cc66ba50c3e7f91a8da22da88f7a8e242dc8192ea012864c77c8903fd85e7255f4ac95a72ac2183d4823c8702a
SSDEEP 384:nvtNn/s3n9SGsNlpCb4p/YVEVRN3OKZ9QvObUmn15wbAjEm:vj+9xRaH3Om9zUmn12bfm
TLSH
T1FF928C31AC384C3719E7A94EF54B365B5FB850B79AC02E84D5D88F0D01D67C8231ED2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad6fb46a1aa42e201c40468e21b992349edb7edb28e305203dabf553ff6ef0fe
MD5 ff0ac97cea0ca660bcb2d222c26f1de5
SHA1 9019ade8944ce227e0fdb12d1878ae38c80cedab
SHA512 c473625d34ff75d9d692c7d64c757e709926eaf33bed3253a0d03af293168d5baa1305025029d879072aa0a8e6ebfc7293ed410524fb51fb1a51c0cacc436914
SSDEEP 192:tONK6JkRtQmiUy0/W+RN3OmNOmFHh3JROFU6:tONK6UrrW+RN3OKBpmU6
TLSH
T16F02FB357C382C7B8EF2AD09F98B27175FA5206BE9952F84DAD81B0C01D765C1347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4796a912d4a5f8f4649966dcfecd1d8365df24d440d8898dbdecbf49775680cb
MD5 e5c29c73c4e2150fe8756ba632656e55
SHA1 606dd004b2cdebbe28fedf4237ae51fb9ac63ffd
SHA512 d31110be4d8c61ca984bb570d552a49e5e612a153299dc221362ef835e056da2f60ba295710a68926125156b46b4022c98929279dea6d53784d6e0aa0c7b7e97
SSDEEP 384:nZtNn/s3n9SGsNl8Cb4p/YVEVRN3OKZ9QvObUmn15wbAjEm:Zj+9xqaH3Om9zUmn12bfm
TLSH
T1CF927D31A8385C3719E7A94EF64B365B5FB850B796C42E84D5D88F0D01DB7C8231EE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9455286c6c785692a4995f45d4f9d078b18c7e5feaf53cac4a50e0dddbfe30ed
MD5 a82c6d0941aed20167d68c48c3bd40df
SHA1 2f975e3b02996d5d323faf427bdbfcf39c82b079
SHA512 fdc93227ede699ab8b098b5b2272cad91b9179ed9fcb08050a89fdc23f546f2a8d755ab59f901fdae95fc01ae46b39b8c636c020439cc32631b93f2e3fbae4e0
SSDEEP 192:jONY6JkRRQmiUyqY/E+RN3OmNOmSC9QjMKbVcCqwx9U6:jONY6UvtAE+RN3OKZ9QvSUU6
TLSH
T1A512193178389C6B5EE6A809F58B32575EA82077ED856F84D5D81F0C01D7B8C274B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41dbf852-16b2-4429-8722-69ab14e932e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41dbf852-16b2-4429-8722-69ab14e932e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5447a01667ccdcdbc7f4f8b70c738054d25e31667ec5f37e2d99b98a2e7477ee
MD5 3eee1cb97c29de9d97e67c3a7ffb7b14
SHA1 15dda5d72941d2e3d8e0c05d38de984574fe1d40
SHA512 80e2bc04e89e6ffb5e5a8e09be7eb3f6111ee8bf51194d3c7ef9f2e170ac4fca7458b701b503e693ec90e2966dc44b2397273ebef6449cff81853586665dcaad
TLSH
T12D412858B7F90248B3B76A5AEBF7A86D447FBD672F46D05E00110D4F0A23A41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

28922dba-f74a-4095-b44e-3015bb6d7cdd.tmp

Path C:\Users\Admin\AppData\Local\Temp\28922dba-f74a-4095-b44e-3015bb6d7cdd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4de0ec77-3ed2-4b58-888f-eeec23369b8d.tmp

Path C:\Users\Admin\AppData\Local\Temp\4de0ec77-3ed2-4b58-888f-eeec23369b8d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1852607783\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9e93364-5c26-4b93-a863-f2f207ba3307.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_2147296906\c9e93364-5c26-4b93-a863-f2f207ba3307.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s32kcp.dll

Path C:\Windows\SysWOW64\s32kcp.dll
Size 24KB
SHA256 ca34b8abaa6ef2e5c334bf1e3b6c40113daa85d292a4979ff485d0e39380864d
MD5 d9ea52d19a203cd964263272315a71d8
SHA1 5aa90f154e5bb01351523e97d37fb20e69ee7b6e
SHA512 d67e6fa33fd80147aff518c982eb8ae255b06d13a5be08ddc264eb00b6563e5e8efb00c08cf5b31e738b13a2d3faf78fa3d97ed3fded15dbce1ad050bf9081e7
SSDEEP 384:2NgDbKH2a5NEmw4yV+BPWM1Up2z3LzX3BHzCe81n1Rh1qpT2P8prgN39hwn6:S8bKHx4mEVKLj3BHGv11H1gdktc6
TLSH
T1EDB2D06C64ACCF99C17DC53EA3E6B8488517B0E6C0A9835D5C1DEA9508A07F07E3D729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-575-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-628-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-18-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-565-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-12-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-11-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-629-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-9-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-7-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-648-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/924-649-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/924-21-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads