hxxp:///home/petik/ss/malware/2026-04-17_a72932723643f2009c1ae22063de31f3_amadey_elex_remcos_smoke-loader_vidar

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http:///home/petik/ss/malware/2026-04-17_a72932723643f2009c1ae22063de31f3_amadey_elex_remcos_smoke-loader_vidar
Sample260709-tefseady31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280862867136452"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{4554C3CC-EB2F-47A7-BAAC-140981B98EDA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4928	4856	msedge.exe	84
PID 4856 wrote to memory of 2768	4856	msedge.exe	85
PID 4856 wrote to memory of 4764	4856	msedge.exe	86
PID 4856 wrote to memory of 4764	4856	msedge.exe	86
PID 4856 wrote to memory of 4764	4856	msedge.exe	86
PID 4856 wrote to memory of 1088	4856	msedge.exe	87
PID 4856 wrote to memory of 1088	4856	msedge.exe	87
PID 4856 wrote to memory of 4640	4856	msedge.exe	88
PID 4856 wrote to memory of 4640	4856	msedge.exe	88
PID 4856 wrote to memory of 2216	4856	msedge.exe	89
PID 4856 wrote to memory of 4640	4856	msedge.exe	88
PID 4856 wrote to memory of 2216	4856	msedge.exe	89
PID 4856 wrote to memory of 2216	4856	msedge.exe	89
PID 4856 wrote to memory of 4308	4856	msedge.exe	91
PID 4856 wrote to memory of 4308	4856	msedge.exe	91
PID 4856 wrote to memory of 4308	4856	msedge.exe	91
PID 4856 wrote to memory of 2876	4856	msedge.exe	92
PID 4856 wrote to memory of 2876	4856	msedge.exe	92
PID 4856 wrote to memory of 2876	4856	msedge.exe	92
PID 4856 wrote to memory of 1928	4856	msedge.exe	96
PID 4856 wrote to memory of 2500	4856	msedge.exe	97
PID 4856 wrote to memory of 1928	4856	msedge.exe	96
PID 4856 wrote to memory of 2500	4856	msedge.exe	97
PID 4856 wrote to memory of 3120	4856	msedge.exe	99
PID 4856 wrote to memory of 4396	4856	msedge.exe	101
PID 4856 wrote to memory of 4396	4856	msedge.exe	101
PID 4856 wrote to memory of 4396	4856	msedge.exe	101
PID 4856 wrote to memory of 4532	4856	msedge.exe	102
PID 4856 wrote to memory of 4532	4856	msedge.exe	102
PID 4856 wrote to memory of 4532	4856	msedge.exe	102
PID 4856 wrote to memory of 1600	4856	msedge.exe	112
PID 4856 wrote to memory of 1600	4856	msedge.exe	112
PID 4856 wrote to memory of 1600	4856	msedge.exe	112
PID 4856 wrote to memory of 1912	4856	msedge.exe	123
PID 4856 wrote to memory of 4988	4856	msedge.exe	124
PID 4856 wrote to memory of 452	4856	msedge.exe	125
PID 4856 wrote to memory of 4324	4856	msedge.exe	126
PID 4856 wrote to memory of 4324	4856	msedge.exe	126
PID 4856 wrote to memory of 4324	4856	msedge.exe	126
PID 4856 wrote to memory of 928	4856	msedge.exe	130
PID 4856 wrote to memory of 928	4856	msedge.exe	130
PID 4856 wrote to memory of 996	4856	msedge.exe	132
PID 4856 wrote to memory of 996	4856	msedge.exe	132
PID 4856 wrote to memory of 996	4856	msedge.exe	132
PID 4856 wrote to memory of 1188	4856	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http:///home/petik/ss/malware/2026-04-17_a72932723643f2009c1ae22063de31f3_amadey_elex_remcos_smoke-loader_vidar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x240,0x23c,0x248,0x7ffe0325c188,0x7ffe0325c194,0x7ffe0325c1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,16931931473811538481,10586816641483976197,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1890952481323345032,11653314033131830971,262144 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,10148892750934319313,10035227218476829988,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10401335183260817657,12799588765107928621,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15680002578842322898,7991490546074673309,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8461089052294656562,17614774479753913495,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,12937594481188243076,4425179962101339367,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2319047310375062690,14149797451035127867,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16676258218546855760,13417911097432256059,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9353267738142351430,14351176397016985392,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9353267738142351430,14351176397016985392,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,11345283519723591803,14790388512010962373,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6292,i,9121538316346357691,3057216480820540848,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6212,i,12663382372057866755,1463154723987305130,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,2791102471856273098,4096861832637012173,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,13548636173175224221,10954923351375009652,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,14555486056019846546,9823687052502245879,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2624,i,11120408915103238524,2619302187694828109,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,14591619556686137613,15305947330883848116,524288 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5196,i,9323642984410821864,14871679525564129389,2097152 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,200359894325578050,4689775968252253980,262144 --field-trial-handle=2484,i,13288572912442662567,714565141540369613,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3ae58d9201d3d339749732b355fd38e33c9d04a0e52a95cc0788f29b9bf2fb9c
MD5 d80da6cc56d4415a30cafe36d6dfd19e
SHA1 1ff7ea72287935d625320ea58cbd1eb77c7526ec
SHA512 521a363174e01ae20ebc71c103ea0880bb01a4d063d3da62afaf65b2ddd5aaf130a70a83bda52ff7e1c03d841a4323598fed861ca61b139000e8320de19bea8f
TLSH
T1FB515EB854826523E7251031A1DA2F7E38B6BFDAFE5BCD7740908D32450FBE583A9478
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fa88.TMP
Size 2KB
SHA256 482952899880238de1240031b7aea52f468cea405af96165db16e8f1cfa0fec4
MD5 aae70e7393baa97b1ccd0722c49093f1
SHA1 fd14dfa628de9af308b1b460af525b672bca28f2
SHA512 bd7846fe80d1bdf0d4ed920868c79ab257b61024b04ac76a9c7eef4576a8f05b085ebb4e6e7ef7f3020a63c6488e4af17bf5302de2fe26a2ddb8f02aa331750e
TLSH
T1E35161B854826523E7251031A1DA2F7E3876BFD9FE4BCD7740908D36450F7D18369474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92967f6a4033e574231036f2365a16b1ff55a3cc2ed857c77680033f9c2e371a
MD5 044dea0b20587616c3ded732cb8d4136
SHA1 243ba5ffbfda5b8de8e564da1b7e568f5e698795
SHA512 f29e82b02a15684ea536f0f04d54163ac47b846e9e1da6adc2d8398cd0c9c9cd25429d0b67b97132d20d1215fb182f5a1b7f207612c44a3b2b2783fc28592319
TLSH
T15321D0F783E485AEDA1156F06A18BE1BCE1D0502432C3C19DAE0EF17D3E3479E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff74f1cf62d770159f408a5d432e1380191dc9d2dc9f75dd12c1164211a0417e
MD5 7dad0763a2ef9ea37fa06561af02158c
SHA1 e03e08ad4b7d58d012f07ef557d5ef0cf19dcd24
SHA512 542c1cca921ef3f6802602344fd40d0d06f13b60fab958b702b255d6ce7c1855a081ef87fce8a66c15daaa58c82a6610df380703e52a4269d36b9096c85b4e49
SSDEEP 192:sxZHREyM/jK1Ml8MkGE/fWso66PwSqIdpAIJHW6+WNGY9IK/MGIgrJ:sxZHWMz/fWso6qDAMHbGg9
TLSH
T1A642F9166B385977CCDBD209FA557F93D6F9147292901E48AAFCCA0C01E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6086db188b3baa687049c4637dcad2207c97ede42db0b864fa8f34bda50eae19
MD5 3d1a5d09fa8490503e6f1b690c44ec46
SHA1 3ac114eab712419434f27e6f9bcd40a4a4bf3428
SHA512 71f1e1989fa994b1b7338db8bae1600c3595bb4b39f8811c53a96210ed937f577685f213fed0b5df85cfd3b5f1d8e9f8cca1f743b8e6a9636fba2430b098ed7d
SSDEEP 192:sxZHREyM/jK1Ml8UQ9kGE/fWsY66hwSqIdpmIJHW6+WNGY9Iu+QGIg55J:sxZHWqWz/fWsY6EDmMHbGP9
TLSH
T17652D7166A385977CCDBD209F949BF93D6F5147392901E48AAFCCA0C01E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d6eae9099327d95022086f23b60e9cc16139a3c4626cdfbb3c31b20742a1c196
MD5 23c25737ffd36b675318b53be886a13a
SHA1 58e65d1f93401ee42e60c0963d4db977e8cf4105
SHA512 82c9108cbed86d33ce1336401740e0bb490630dc0450ed045b5d726d825a4e0b41cb5ac4f57722dd164fa5275e3760155e37950290893f22b0514ce925e337c8
SSDEEP 768:74cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNgroWg6iP:74cv21wWvu+Z+u1jaeFLeRNrWyP
TLSH
T165D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2613f7ada8de1526b0abfaeee0e9ccb229d720acaf1f0bf91a1a180b44351921
MD5 a12d9af92dbefa47995b78045a19bb74
SHA1 a8a5dc2bc366df425889c1c5ed317d1fbdebd59a
SHA512 dc0714050d982ef981d1669469e493e370cdbddff987b446e838dc996359029d50393d20aadc4a455048096b74f741f315d24c7b0ad55f8b30a37868c9bf65e6
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCcj:mT3LVxnr+JFTBBi9UBtXcqzs7z7cIyXS
TLSH
T1B4C12402303F0242297D7918B37A8536AE4172673818A8BF7BB910A15F27E225DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b2190ae-78cc-4335-8f5c-ebc89c0865a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b2190ae-78cc-4335-8f5c-ebc89c0865a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 776f559f59911a504d69d1b800f5c27395b8450de3b3cbd1a48fa90571ee3817
MD5 01bb70495b7daf287c7a2573aef24882
SHA1 7103a6c02da0653c7b68978ef11d7e29c4a55aa5
SHA512 bc7385260b9956839c0ae8e7aab2ee661a4c06acfd3727befffa37c428001c2bd49d4314b3b8e4b9ef7ed8d823dd83c622128a6f14edf9f4c0a9dbb35d9f909f
SSDEEP 384:etNn/s3n9SfsNUxyzi600e+CQdi++z2OObjI9G6w7L5f:ej+9UwY/4Exz229MJ
TLSH
T111928D3668391D679DE29594F48B3917AFF4507B87CA3F84E6EDAF0C02DB6AC0302915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 06b06f9980c91f5c006dc40ed01184d70077b2e4acc16a69ae7b2d789ffd63c4
MD5 28858db15397bfa896e20cbddfd8f4de
SHA1 ada49310ecec5c26a3f05cdf9953814e0f3ce00e
SHA512 e88b6ac9e7650182baef037fa33b1a808800c59148cf0312833419b2397b9ae40e7ee9d0060ab4c267a9d871929382099974765bf3c1a6b412430ca5dfe04e33
SSDEEP 384:ciF1tNn/s3n9S7zsNc8TUNTUlIlMyzi600e+CQdi++u2OObjI9G6w7L5f:HF1j+9sFwgDY/4Exu229MJ
TLSH
T127A26B3358688D7BAEE69A94F84B35179EF450BBC6C63A84E7DD9F0C02DB1EC0306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a554f5f33752f5e0d546c656c7b366280f07f3477a630c66ff0834487b1b240
MD5 a66225e562fd2f9ea1a10ee4eb0b3505
SHA1 14bdb486a65006c7e4d8c37920d999d3e1df158d
SHA512 5d4e83e0c0307999225a04b3cd3d11227abcc39621b4e3737b341ad159b1c21312d5d733921c7e4ad76980ba114a9662a96a31a101a4af7ddc57b36797f938b7
SSDEEP 192:JONB6v+YLNQmiUyKwyZh+CG6+FdetRLusBLTU6:JONB6vz/LZh+CQdMZU6
TLSH
T1EC02EA3568782C6B9BF2AE05F58736135FE4203BEA963F85DAD81F1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8c60bac6a5d0046b2b565dc05762d02cc07c81465a505b62aa1162fcf205e102
MD5 99efb83d6f3aa5df7ec45a5b897246f5
SHA1 64a66251cbf978e055e654bfb750467f99bd4c6e
SHA512 325254fc95b5826965b17e498fd5f4320a4e963c0c27a84cc806fffdb6474b27c27d779d904c683d9cf5ac0f7265a9f404d32f5c787281107698f59eb9acc7f4
SSDEEP 384:TtNn/s3n9SfsNUMyzi600e+CQdi++z2OObjI9G6w7L5f:Tj+9UxY/4Exz229MJ
TLSH
T1CD928D3668391D679DE29594F48B3917AFF4507B87CA3F84E6EDAF0C02DB6AC0302515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8bb2c051e3e4cf555090e499d870494591280d4c5a1595e0b36c7c3160d322ef
MD5 3de4ccebb1ac211e1cb5979656121f8d
SHA1 71151f840aa50e01100188da0206329b8004aeb3
SHA512 0fc324639188272848d6b25f4bde18cb69e726e621650d9ebaf6e98ce6532e9ed5b91392bfd14185596c252cbb977213c3a1dded1cd963faee7e28d9e4c5a22b
SSDEEP 192:8ONN6v+YLNQmiUyKEyUh+CG6+FdetRLXx++BCHqq+U6:8ONN6vz37Uh+CQdi++G2U6
TLSH
T19A121A36A8785C6B5EE2A944F48735135EE45137DBCA7F81E6DC2F1C02EF69C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5638de54-895c-45b8-b929-08e8b1b5f69d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5638de54-895c-45b8-b929-08e8b1b5f69d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4cb9dbbc017afee66286a49c50e600ef27c4928ed672493a846b503a72c37ba9
MD5 5d271b8f2929316b6846baaaaf329556
SHA1 3570e4e6fdc25f981ed7149a8eaed2d327c50154
SHA512 f6bef128e6b16b1aca09befc182e32cfd090c20ad3b2da0586aade0a32adebe4604b1964555b714cc43e52ade6ea2cfeeec68f021623c6d1e2a51df6f4849a63
TLSH
T11E41D898A6F91148B7B7BF56ABF6686E847B79772F07C45E10110E4F0A22B00D972733
MD5 SHA1 SHA512 TLSH

Submit Download