hxxps://github[.]com/ClickNin/java-freemium-account/releases/tag/v1

Analysis

user interaction
yes
max time kernel
90s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ClickNin/java-freemium-account/releases/tag/v1
Sample260707-ebzzjset5q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2088	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278696144311585"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{678CA12B-859A-46FA-8855-A7A4CBCFD08B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe
628	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4236	724	msedge.exe	85
PID 724 wrote to memory of 2088	724	msedge.exe	86
PID 724 wrote to memory of 5104	724	msedge.exe	87
PID 724 wrote to memory of 5104	724	msedge.exe	87
PID 724 wrote to memory of 5104	724	msedge.exe	87
PID 724 wrote to memory of 2272	724	msedge.exe	88
PID 724 wrote to memory of 2272	724	msedge.exe	88
PID 724 wrote to memory of 2800	724	msedge.exe	90
PID 724 wrote to memory of 2800	724	msedge.exe	90
PID 724 wrote to memory of 2800	724	msedge.exe	90
PID 724 wrote to memory of 4756	724	msedge.exe	91
PID 724 wrote to memory of 4756	724	msedge.exe	91
PID 724 wrote to memory of 4756	724	msedge.exe	91
PID 724 wrote to memory of 3088	724	msedge.exe	92
PID 724 wrote to memory of 4324	724	msedge.exe	93
PID 724 wrote to memory of 3088	724	msedge.exe	92
PID 724 wrote to memory of 3088	724	msedge.exe	92
PID 724 wrote to memory of 4324	724	msedge.exe	93
PID 724 wrote to memory of 4324	724	msedge.exe	93
PID 724 wrote to memory of 2072	724	msedge.exe	97
PID 724 wrote to memory of 3876	724	msedge.exe	98
PID 724 wrote to memory of 2072	724	msedge.exe	97
PID 724 wrote to memory of 3876	724	msedge.exe	98
PID 724 wrote to memory of 700	724	msedge.exe	101
PID 724 wrote to memory of 4536	724	msedge.exe	107
PID 724 wrote to memory of 3196	724	msedge.exe	108
PID 724 wrote to memory of 4536	724	msedge.exe	107
PID 724 wrote to memory of 3196	724	msedge.exe	108
PID 724 wrote to memory of 3196	724	msedge.exe	108
PID 724 wrote to memory of 2464	724	msedge.exe	109
PID 724 wrote to memory of 4048	724	msedge.exe	112
PID 724 wrote to memory of 3336	724	msedge.exe	115
PID 724 wrote to memory of 3336	724	msedge.exe	115
PID 724 wrote to memory of 3336	724	msedge.exe	115
PID 724 wrote to memory of 620	724	msedge.exe	118
PID 724 wrote to memory of 4720	724	msedge.exe	119
PID 724 wrote to memory of 4420	724	msedge.exe	120
PID 628 wrote to memory of 4764	628	OpenWith.exe	123
PID 724 wrote to memory of 2636	724	msedge.exe	124
PID 724 wrote to memory of 2636	724	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ClickNin/java-freemium-account/releases/tag/v1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ff84b0dc188,0x7ff84b0dc194,0x7ff84b0dc1a0
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,5554135261347215359,13997750538905926707,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,3049092053188193294,10139204312207836436,262144 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,8109613190867567003,1877020959486901696,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8693606563334113197,13597607515551047338,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17349636813008421902,121837092589435249,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,5330522325921961614,2380238836780048265,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,71896143015840045,12828190299371072611,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,10066440489959729009,1883771378880617905,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7384605170056833498,16980408568083284966,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11374072491239978490,13918767844233081711,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11374072491239978490,13918767844233081711,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,14262827787086420177,5230850588212172569,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4628,i,9250268060726980963,12823736870945552099,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,1538607907808655381,3633866892618146219,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,10975774439277357415,772178859780806228,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,10975774439277357415,772178859780806228,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6624,i,10067683655422367683,8337583859954165450,2097152 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16868410705260369288,15969616519822647865,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,7576256446334557559,7956621730163887233,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,15936833924213016254,12522351675778643405,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3634259247928450913,13534012966454827531,524288 --field-trial-handle=2268,i,16718734830450121163,3074072787802354774,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\account-v1
  2⤵
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c0f502b5d9341596bf8e375575590c9064a9b52ea1436ea921e6c04dc06254ff
MD5 cb38a3fa74604bd7fbd4bf76a0fa968d
SHA1 da6c9dcfc85df7a2910d4acea7f4f334b995b967
SHA512 3e59c57d12ea6925fff79ccb990ead90778dcb73234690053a6ff7ac2d592908f6f8dc94e5c2ae80b89b0e27b59c780f5e434a15d55c3f5a61ff675f5b3349a3
SSDEEP 48:VgKngPPka8EsoA/H4+FUVXg8Ko1lvAAqY3qgdkl1X4tvzXhkCWjAXWcSQ6pXGc:VDsPka8vovbVwS1VMeqDBMvtkCWjfQ4T
TLSH
T1F8B1C6344FEAA6F5D72280B258DA4267307688E6F433DD4EF144D8BE1E877E14718135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4be093594f499d145c23a500e5692d1d17513eae218e53fa71cd8a7837c9af6
MD5 934021829a97a5754973cbba781ccf77
SHA1 6a5a37d8e3f7fa79a593ccfb5d6b2f1d256ddc28
SHA512 f262819d96bf70fc8b4fc82d91038ba75855c2e469ced5f2c2946af90ba247251e602c566a7736da3a39dbbae096dcb70c5de81d8fdfb2da988f70dc75300949
TLSH
T17B419BF783F1856D9A1256F0AA18EE2BCE2D0111835C786985E0BE17E3E3871E002B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 88fa2fa66ed71695a2caf055af90956d5aed014f99419b4d47db1a5b8c526b32
MD5 93649b23a5b4783f7005d097dd3c299e
SHA1 0515055d2c6af4feff7fe2c94af32c66f6f683e8
SHA512 4f71f846d86ad8b3c1a5b25b0c6349175d6cd8a53327c5e791b322e13aa86ee9425b07c866dc4db67d1588d318dbd69c2fe32d79c9b09c3badc620352b7fb48e
SSDEEP 192:sxZyRpyM/jK1Ml8MkA/fqszPfwvIdp9QgHW6+WNYdy/YCBQr/cIgrJ:sxZynMA/fqszP4AHHbt/Qo9
TLSH
T10152C7126A349977CCDBD21DFA55BB53D6F9047292900E84EAFCCA0C05E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3093ff3410039b4dee653df358978aaa5e7c6936e9853933af92f4c6f7146eca
MD5 a1a5cfb7329c48b8de51373ce471c38a
SHA1 c6795372b25f6ada8826b14ace39b7563595528d
SHA512 9a53c0652114997ca7818607c4dcf00e609e9ed2617ab1f78be8a0be645848a3016eafbc3ca2c9fe7b12f7f4147a4f69dabc3e65da628a25eefaf854983cf522
SSDEEP 768:9C8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVaroy:9C8bqn+WvSCt6u1jaCZLbWVRy
TLSH
T1F5D20A3B280CCB7E4F845E5CED26AF966DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 cd1882d63da7a734afa73d292f44d4d007b3852b89f94ea857efe66428836499
MD5 2a8c23afe730080bb8325c80c34b1ee2
SHA1 58b0a8d478af6041abe279e5b45167065cb9abfd
SHA512 7e4232aa182e2875e73562e2073712cf024bab37a0d69d8b9df38778dab9f30dcc64d20dbcfaee691a9918149215dd82e972a7063ff5ab9175a8beb17728243c
TLSH
T16E21515A723622002CBDF54CC258D45696C1707533146C2EB76C03578B66E4F9EFDCD9
MD5 SHA1 SHA512 TLSH

Submit Download

bc41360a-e4d1-4c28-821b-0c28b04b9611.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc41360a-e4d1-4c28-821b-0c28b04b9611.tmp
Size 13KB
SHA256 637e1cda99dda0b70cb9e50ac4037e9ef98f62c72b1e13cba70679fe35ab2ae9
MD5 eda17271066e708534a34733ce5a3b83
SHA1 e89fad89ba3100a25594aaca69d5cbfba3a23e1a
SHA512 f1631c6df285133618845e84204227a0aedfb4d39e438d699e7929c5891537ea01a9e17e87f1631207928792af02f375c358c042ccde0c660ede02a99d0561d8
SSDEEP 192:sxZyRpyM/jK1Ml8M9A/fqskPfwvIdp9QgHW6+WNY3kXYCbQr/cIg5zxJ:sxZyn1A/fqskP4AHHbzXKoF
TLSH
T13252D7126A345977CCDBD20DFA95BB53D6F50472D2900E84EAFC8A0C45E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59efd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59efd5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 173bb244bfdd755854c4a4bd4ecb892d815f37a88665395841a94ba5acb5db6d
MD5 3db8c467f25026b7ab0a2b80ac638126
SHA1 82d54341d05bcdaced10e532a4f7604205859e64
SHA512 65a1ec2737c88ff6e1893b8f9cb512388c15d2903a521ab03dddf25bd788f014175d17c3d0b534aa68cb93b1a25d14403312bfe90a82f06c2f916e0cd77493b6
SSDEEP 384:+tNn/s3n9SfsNfa8hybfBEa++d5Lh7OObjI9G6w7b:+j+9Utqa73Lh729Mb
TLSH
T1EB929E322C388D774D929558F48B39179FF8917B96CA3F88D5DCAF0D01DB6AC1302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 216434cb4f106958c397246f595648589cdcb576d02518512bfca634c2879f18
MD5 f7b39cb2207f884a81ded95e8a90d167
SHA1 f4c556707980fbbf4fc6daf2c3205b7b95b8142d
SHA512 028b3adfaa39834fc1c6a87ec0f5a62a67d12f422ec451f452a260118bdfff8801428d8475151369e43a16b808f206d7a210050296b84fb707bf811eeb4e17e7
SSDEEP 384:8iFdtNn/s3n9SPnsNB8TUNTUlIlr8htoBEa++d5yh7OObjI9G6w7b:nFdj+9UwwgTqa73yh729Mb
TLSH
T123C228F218E78936D99E8747B77E2D168EBCC167B5856A84B3C85A0DCC871BFD302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8c449967afd179748eb94c4f988d341a85184446b8b48f705d50ec38006782a
MD5 e883b21d4f2190f24ee4c775019bbdd9
SHA1 215b0c85721ee7736f4962d651905616ca7380d2
SHA512 8af92af95989346ca9878a5eec9e5286dbf7ce82e33db14ea9feddedde83eac650e31bc3d13029024ec9c2f1b2a2e709cf3d5ef331d3f26e0de71bfcf72c64fa
SSDEEP 192:vONR6Db6QmiUyAzHBa+j1+FdCKHRgixU6:vONR6uxHBa++d5G6U6
TLSH
T13002E83568785CB79EF2AE49F48737279FE4106BAA962B94DAD84F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 31e1c0287e38977f29ab0386d5c73bad45e8fb360581d1296a6976742cf018f6
MD5 c0da91c93370ec42356974714cc03d87
SHA1 77d6ce6365155f9303107af92ce4b814797fdbe4
SHA512 9bdc091bc8d4a4095a6714ddcf6ab0f855f0538dfc68790adbd04a96da160128993a3961784af13da3d489d9c3e9539c24e4c9694fb3a0bc99b3053ff71e58f6
SSDEEP 384:FtNn/s3n9SrsNfr8htfBEa++d5Lh7OObjI9G6w7b:Fj+9QBqa73Lh729Mb
TLSH
T18D928E322C388D774D929558F48B391B9FF4917B96CA3F88D5ECAF0D01DB6AC5302926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d2410b0edce7b39b8fbb817facca2b28997b256ea165fdd86a013ecdb22e048
MD5 409a675b2d876f91ee031be82ec61687
SHA1 6a7e45ef23000d0aefdf4c04d62b918ce46fe58e
SHA512 3eda3c73ef6bc4883892f19eceb4ba574f2fadd4418be2ac25d1e1f51085a9b9f6ca8a4b58bc3b04150410a3ea3e986b3545051bbae8d39a46997c2de8807bf4
SSDEEP 192:wONC6DbgQmiUymzzBa+j1+FdCK2LNzAqf7U6:wONC6INzBa++d5mh7U6
TLSH
T11F123A3668789C7B5DD2A944F4C736139EE4912BEECA7B94D5DC5F0C00DB69C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4667346da9a59d54199f3621ee671f85e848f7d6ffd76f7e9bd1293e42123653
MD5 912a4efd8f0f1b97461047be8cd27a7b
SHA1 08aaf965afea41b0f4cf1f21ced64a3675a04f91
SHA512 ac1db3699b1ee8125735267358a54cc40bf51c43b4b8f75b51063f1c2c1ed0e0afa84a3597cd985a64987b540a4043c81d3181083b11968f67ba608fa3445fce
TLSH
T12941024CAAE91158B3B36F1A9BF6686E847ABC772F07C55E00110E4F0A63A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

account-v1

Path C:\Users\Admin\Downloads\account-v1
Size 256B
SHA256 ce94dc62a8d2409f9ff5b5f2cbf4a4d4cacbeb401503e0a002b7bc5b2267c9ab
MD5 2d4592655e1bf9d0fb9eb7486fa9ab24
SHA1 fe61c96c29064381486317907664f00ad3363f33
SHA512 52f041d9a50d080dcad0c9ea21f4ec466d31266133a00bac5255be5f0e8029984596c1aad64fbb2becac1aaa68219f45f9e946abe9e79c715711432ae77bc05e
TLSH
T1BBD02B7659545B626B5005007DD991B87A610A52CE6EF8B7EAB0C243403D8E96A29425
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads