524f06a13810008ffe4acf40f4dbdccd3e48504b06900da023f6d416e10bf102

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
marvelous-designer-13-unlock-tool.html
Size 24KB
Sample260706-3e33daav4l
SHA256 524f06a13810008ffe4acf40f4dbdccd3e48504b06900da023f6d416e10bf102
MD5 9071320cf527f560acb94678f1787cbe
SHA1 11690e78e3c43823095c54782f647a0f224ecc03
SHA512 b5f5392bf15ce2779059c52850a26328ac19396517c2f70370ffce7c1644f1f38bfabdb042750549cf9034a676e6bf7f1d951b2d642f42ec550199e3b7cb1438
SSDEEP 384:hyZ7mkgjEjE1gadCO7rfcnEqs5kCgkzZFtsHAT0OgK0LIJjX2uvw9Xi:hyZBjFAfo5C7DtpgTIpmuI9y
TLSH
T1BCB2C01070F1F282ED59141C2D58492E778BA24CCAECF20D47C099EDA0EF66BDD9785B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2336	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{220B391C-1041-4467-9596-A4D1E2AF2C2C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3140	3760	msedge.exe	87
PID 3760 wrote to memory of 2608	3760	msedge.exe	88
PID 3760 wrote to memory of 2336	3760	msedge.exe	90
PID 3760 wrote to memory of 2608	3760	msedge.exe	88
PID 3760 wrote to memory of 2608	3760	msedge.exe	88
PID 3760 wrote to memory of 2080	3760	msedge.exe	91
PID 3760 wrote to memory of 2080	3760	msedge.exe	91
PID 3760 wrote to memory of 4496	3760	msedge.exe	92
PID 3760 wrote to memory of 2092	3760	msedge.exe	93
PID 3760 wrote to memory of 4496	3760	msedge.exe	92
PID 3760 wrote to memory of 4496	3760	msedge.exe	92
PID 3760 wrote to memory of 2092	3760	msedge.exe	93
PID 3760 wrote to memory of 2092	3760	msedge.exe	93
PID 3760 wrote to memory of 1768	3760	msedge.exe	94
PID 3760 wrote to memory of 1304	3760	msedge.exe	95
PID 3760 wrote to memory of 1768	3760	msedge.exe	94
PID 3760 wrote to memory of 1768	3760	msedge.exe	94
PID 3760 wrote to memory of 1304	3760	msedge.exe	95
PID 3760 wrote to memory of 1304	3760	msedge.exe	95
PID 3760 wrote to memory of 5508	3760	msedge.exe	98
PID 3760 wrote to memory of 764	3760	msedge.exe	97
PID 3760 wrote to memory of 5508	3760	msedge.exe	98
PID 3760 wrote to memory of 764	3760	msedge.exe	97
PID 3760 wrote to memory of 3424	3760	msedge.exe	100
PID 3760 wrote to memory of 3040	3760	msedge.exe	103
PID 3760 wrote to memory of 3040	3760	msedge.exe	103
PID 3760 wrote to memory of 3040	3760	msedge.exe	103
PID 3760 wrote to memory of 1800	3760	msedge.exe	104
PID 3760 wrote to memory of 1800	3760	msedge.exe	104
PID 3760 wrote to memory of 1800	3760	msedge.exe	104
PID 3760 wrote to memory of 5948	3760	msedge.exe	105
PID 3760 wrote to memory of 1592	3760	msedge.exe	106
PID 3760 wrote to memory of 5884	3760	msedge.exe	107
PID 3760 wrote to memory of 4836	3760	msedge.exe	108
PID 3760 wrote to memory of 4836	3760	msedge.exe	108
PID 3760 wrote to memory of 4816	3760	msedge.exe	109
PID 3760 wrote to memory of 4816	3760	msedge.exe	109
PID 3760 wrote to memory of 4816	3760	msedge.exe	109
PID 3760 wrote to memory of 3736	3760	msedge.exe	110
PID 3760 wrote to memory of 4080	3760	msedge.exe	111
PID 3760 wrote to memory of 4080	3760	msedge.exe	111
PID 3760 wrote to memory of 2876	3760	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\marvelous-designer-13-unlock-tool.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe9498c188,0x7ffe9498c194,0x7ffe9498c1a0
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3033556423128134885,11952065334755753626,262144 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9456565633192204212,5908783718044979144,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,16997615769658971920,14620024305617240117,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,9608188927480575226,4183910935378482570,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,14282604956879887683,10264760342470682311,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5512292522695017924,16474040684041974239,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6502355685222860003,16211076076494862891,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,1037948452717921221,2763307507980321128,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12463129836228916176,5980774274160766216,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,245313525380231390,16331065404581939898,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,245313525380231390,16331065404581939898,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6588,i,15945841773335687811,18031994808374474921,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4860,i,9002067742555863486,9372913000277927299,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6868267818561662117,3137464394754752900,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9500923816383764204,15166766349676360841,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12039907711273355,13997054138094556052,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17250368138344274475,9826002363975799910,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5404,i,1998148880639338340,13283474444596464823,2097152 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,2786179012244080060,7541041914155165599,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,16229163480776082675,16712303664603283907,524288 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5568,i,18082910192224860016,394257844219684233,262144 --field-trial-handle=2288,i,14973950481335581688,3071421012618025911,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 080d31ed1eec99bea1c3f2e8b7b110286a36affe24cd79a816204c6100fac0be
MD5 625672494a1e70c90b38ef51edeb4b19
SHA1 a768835221008f5678399308d47748887bba9580
SHA512 412a94b38adde51bc9e656c3142b4eb425cd3c8150de4d6c77fbe43b671f76d07bf572e109e7a24a15e2db0839579cd7bd71a48838f810d5579b111095682934
TLSH
T19D615E5833794BD1C3284E712BD380BABE70AA7975675E1D0488A4F54A3A7C4D213DFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599d40.TMP
Size 3KB
SHA256 6cd8558cb93a81dbe9909f48b36f570aa5cb38ad073a505cd721e2bbb6676caf
MD5 87c727c86ee9446f5f4f6db08032f8ec
SHA1 0568e7f5559f75c70335c4034baac037a6e6290a
SHA512 4b9d072a6f1cd32e181ac190912933417d6a5ae96ede68c348fdbe6955cf8ad4ee744ca03a0cb85d40c683eb00db7509f76f421ddb7335158de1c9db76ed0064
TLSH
T152615E58333907D1C3284E712BD390BABE70AAB9316B5E1D0488A4F54A3A7C4D213DFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a469b1e8b8c8b796837d088d83268ce14259df7b6283ebf13d9c07a86f53daa6
MD5 4fb3fc11c38078d7b2396fd971a10c4b
SHA1 b73a2b87c05c48c785e39a0ec9aeadc91b538a98
SHA512 46b731a2bd96b8f7e9bcb28d40febc6b4d996d3e3333bfae381609d1fa08733766a21e349f343322ab5debbbfa19c1544f18f4c7badc7268968b4a6bd8adf709
TLSH
T180719DF3C3E5866ED91156F0AB146E1BCE2D0914832C3D2A89E4EE5BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 53e6723dad862affeb046b5ff2a2a29d64246f2fd3d11fe563eaa3496e405d82
MD5 c5cc6f7592fb4663816b98f3419a6cf7
SHA1 c71f55d733e4eb5a1238c6e17ef1901eda6b639d
SHA512 b92dd109ac7eb1214639c4874e093c15a96a435cba461b61c17ebf40d2fc130cd97d3ff7fce5324f79ee2466c1e62c277991f3c34a904d423f629eabb356b114
SSDEEP 192:sxR3RayM/jK1Ml8wOI/fms+TqVY78hzoA8p4/eu/g6+WNIYtZIfl9WqQGAIgDDJ:sxR3UII/fmsUqu4cS/5IsiNXwR
TLSH
T18462D8056A34997B8CDBD20DFA517F53D6F85572A2901E44AAFCCB0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 00aefa4ca37128d08d647300213cecf761c134da912bc38d3b3ac77f777c1624
MD5 dcf246b8ee6501c109699e70e4f70458
SHA1 6e873280859aed41f9285dc74907806a1480b765
SHA512 40b8a3bf85c9178956e83c51a7ecaeef74477121b26b27e0eda51d668bdba89f341d5bbaa3c4551f3602929bb5d6d109138f017f9d9e0899a614e25a9c8ba8b5
SSDEEP 192:sxR3RayM/jK1Ml8wbI/fms+TqVY78hzoA8p4/eu/g6+WNIYtZIZl9WqQGAIgDDJ:sxR3UlI/fmsUqu4cS/5IsiDXwR
TLSH
T17262D9056A34997B8CDBD20DFA517F53D6F85572A2901E44AAFCCB0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a7f17249460504a2e20200919de3a615cd291034fdf6810ff53d3e1b0a72280f
MD5 66557e02e8d0eed8d8448d7938562ea7
SHA1 62b66464fd6bcddf15b185873f2cb016742c7020
SHA512 73e4244f450e281734ce0d9560faecba0ce6d3894d69c6fef4875e09925e8a99913dd69ff78739a3ae02f293423f43e1e7f22afd6b14b89ec2f8eaa3e758ce9d
SSDEEP 192:sxRgRayM/jK1Ml8wbI/fmssTqVY78hzoA8p4j/g6+WNIYtZIZl9WqQGAIgIJ:sxRgUlI/fmsSqu4ci/5IsiDXws
TLSH
T10052D7056A34993B8CDBD20DFA517F53D6F85572A2941E44AAFCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6f56f0419cb031a50f8dfac9f227897e5532e678e1d7245907b0be5ddf54da17
MD5 5b1f11a4ce0e6f6ff81f6f9976160ff9
SHA1 cb8ad9b5c2e060f3edcec1b407581769ade2efbc
SHA512 54d5e61691aabad1d8b209f03c543ef50df8993b89cc0930704e015c02bbf5939a3f43bf214814345c9a3ab5378911b47f48ba98276fd016305c79bf668f8fbe
SSDEEP 192:sxR3RayM/jK1Ml8UQfOI/fms+TqVY78hzoA8pe/eu/g6+WNn7rHj/YtZI3ol9Wqe:sxR3UqGI/fmsUqu4cI/57/sisXwR
TLSH
T14362E9166A3499378CDBD21DFA517F53D2F85572A2941E44AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d49a27930ac3b53a3f99cd369f26479cd11dfcae369f0917e08309ec87ffff2c
MD5 51edbe41a435abf2298021af0f74e24e
SHA1 87d4e88f70c0cfadaa97dd89ce39d4000bf3c91e
SHA512 e77b39cdede18924dae8545c15c3c0e2ffd275fff8a7f6b53575ae7b99ebf6dc0c8c0d2dee76d89fa86557622b57021e53b3cc0e503e3bf86e79cb152c652b6b
SSDEEP 768:dOwS1wBzwRc1wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVlwmPzwx1o:dOwS1wBzwRc1wiWg1zwsfMZwKu1jaQlx
TLSH
T101C2EA3B644CC77E4F844E9DAC29AE976DD801CB5B984D4447FA880C03CB7EB921B5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ffd2043fa016e8de49deaa84c9f81d927f20b6ab8eef87deb6bdfad2b597aba
MD5 779c6738e2edb4d801a1e9baf0771c17
SHA1 ebabb9becc356ed3f83cfdf9c31ffac60e29843f
SHA512 58e304a2ebebcb585d2a1f8ae365bd31d4463fa71feb5615d4e8fd7c8b34d37a1cc33ed17105ac010433be02512091dc95cfa8668c9e7667d893cfcc0a06532c
SSDEEP 96:KRpfpIptpppfpdp9pxWpJpmpsgpRpxK4p4gp/pxcpnpvpOpRp9pSH4Jco6GKQWOv:CpfpIptpppfpdp9pcpJpmptpRp7p4gp/
TLSH
T14F916409717B0240387E294CC5989D67E6C170B33056657B3BA912E29F66E46CFFDCE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a38c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a38c4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ffe32c4dd123bd820a2460aded2b398e70228051f5c5ac41b926e64b454d28e3
MD5 a39eebabd999bf3efecccb2cc34bc320
SHA1 574230f123fd684bae8b05e1eccfb26625b1d16f
SHA512 2ec13298d8a95d081c48022872c2360ad18129401aabccec98456b0d20c5b1cc7785937ceff8e7f1f177c8dfa1d8534ac297cc1027405f68df684b402a7013ed
SSDEEP 768:f6rv+4UNbd+3Lnl3Hz4hog1vu37BtAwjUSzF+BKB:f6bsbM3LnlXz4TvuoTrBM
TLSH
T10C03BF32A85489739CF7D7C9B25A3A43AFB4415385C91F90D8ED6B0D428B16D234BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ef8fabad3a6b6a44407a4091e1a24c290d36aeff032ef787b56ca652f8848e0d
MD5 4ba69ddcb4f3e07e007e9e56010ecfb8
SHA1 d9924dd6478ddcc391ddc61cdf097f5ddd4666eb
SHA512 9f58a8858ef11a7b80001052a0767338fc7384df78d546eb4bb5cc2a6f27ebb63fb859e7fd68ada59268ba8a23a426591e8b14c31385b4a6d8b518e880d39804
SSDEEP 768:fHj+9A3LnRbfHz4hog1tu37BtAwjUSzF+b9Mx:fq9A3LnRb/z4TtuoTrb+x
TLSH
T116F2AE32A8409D738CE687D9B36A3B53EFF08167C5C92E84D8ED6B0D06C716C5747926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e0943754e1e21f418252372892bd541332c9b658fc4679e7aee239be73bf92c5
MD5 dce6b398513e54a37b07449c53e40c15
SHA1 51efdf9ac7c05931a9ea2991dac632841540b3b7
SHA512 2a6f7a5322891f80f78b95a6c7b4f1fb728c46921fca247aaeed98cecae593f262a5fdeeaef1c8dba476b74fbfbc62e4fcb450ae192a3306fb77e6e112ad4b81
SSDEEP 768:3dCF1j+9A34wgZnRb4Hz4hog1uu37BtAwjUSzF+b9Mx:3d39A3inRbkz4TuuoTrb+x
TLSH
T174136CF258C38976CDEE8797A33D2E129EBCC163B5892940B7D85A0CCD8717FC246925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 43f0df1f46b10cce51175ae0ee40da8a2aa868a249dfbc1b696e764b9fe52887
MD5 ef61bc6058807d510262ba2305461f3a
SHA1 b688cab235618c59fb76e83d9dfca7436b0dc440
SHA512 45889e39df31c1d1e2291e0da7ad2d94a681b78420239952db6e28dd9f4b3d7526d50d9aaf2f0ec8cc12610fcd386660667d4b7afdd381174dcf7b41152f06a9
SSDEEP 768:CIrv+4UNbdX3FW/Hd4hoEu37BtAwjUSzZ/UikB+:CIbsbR3FWfd4PuoTqUJI
TLSH
T15A03CF3298449937DCF7D289B25B3B43AFB4506385891F94C8ED2B0D828B16D274BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f441c6f-a76b-4d38-8c60-35459662fad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7f441c6f-a76b-4d38-8c60-35459662fad9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download