hxxp://jcvosevf[.]site-shartbandi-variz-kam[.]com

Resubmissions

14/07/2026, 14:24

260714-rqn7tag18v3

14/07/2026, 14:22

260714-rpv9qsev4j3

14/07/2026, 14:19

260714-rms2laet6p3

Analysis

max time kernel
148s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://jcvosevf.site-shartbandi-variz-kam.com
Sample260714-rms2laet6p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285123584804119"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{B11A7DA6-3618-423B-B999-E972C3A22C5D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 892	3836	msedge.exe	83
PID 3836 wrote to memory of 4924	3836	msedge.exe	84
PID 3836 wrote to memory of 1560	3836	msedge.exe	85
PID 3836 wrote to memory of 1856	3836	msedge.exe	86
PID 3836 wrote to memory of 1560	3836	msedge.exe	85
PID 3836 wrote to memory of 1560	3836	msedge.exe	85
PID 3836 wrote to memory of 1856	3836	msedge.exe	86
PID 3836 wrote to memory of 4028	3836	msedge.exe	87
PID 3836 wrote to memory of 1348	3836	msedge.exe	88
PID 3836 wrote to memory of 4028	3836	msedge.exe	87
PID 3836 wrote to memory of 4028	3836	msedge.exe	87
PID 3836 wrote to memory of 1348	3836	msedge.exe	88
PID 3836 wrote to memory of 1348	3836	msedge.exe	88
PID 3836 wrote to memory of 2108	3836	msedge.exe	90
PID 3836 wrote to memory of 2108	3836	msedge.exe	90
PID 3836 wrote to memory of 2108	3836	msedge.exe	90
PID 3836 wrote to memory of 3316	3836	msedge.exe	91
PID 3836 wrote to memory of 3316	3836	msedge.exe	91
PID 3836 wrote to memory of 3316	3836	msedge.exe	91
PID 3836 wrote to memory of 1132	3836	msedge.exe	94
PID 3836 wrote to memory of 1132	3836	msedge.exe	94
PID 3836 wrote to memory of 1132	3836	msedge.exe	94
PID 3836 wrote to memory of 4900	3836	msedge.exe	96
PID 3836 wrote to memory of 4900	3836	msedge.exe	96
PID 3836 wrote to memory of 4900	3836	msedge.exe	96
PID 3836 wrote to memory of 1640	3836	msedge.exe	97
PID 3836 wrote to memory of 4996	3836	msedge.exe	98
PID 3836 wrote to memory of 1640	3836	msedge.exe	97
PID 3836 wrote to memory of 4996	3836	msedge.exe	98
PID 3836 wrote to memory of 2988	3836	msedge.exe	100
PID 3836 wrote to memory of 2460	3836	msedge.exe	101
PID 3836 wrote to memory of 2460	3836	msedge.exe	101
PID 3836 wrote to memory of 2460	3836	msedge.exe	101
PID 3836 wrote to memory of 3140	3836	msedge.exe	110
PID 3836 wrote to memory of 4912	3836	msedge.exe	111
PID 3836 wrote to memory of 4656	3836	msedge.exe	112
PID 3836 wrote to memory of 2940	3836	msedge.exe	113
PID 3836 wrote to memory of 2940	3836	msedge.exe	113
PID 3836 wrote to memory of 2940	3836	msedge.exe	113
PID 3836 wrote to memory of 1576	3836	msedge.exe	114
PID 3836 wrote to memory of 1576	3836	msedge.exe	114
PID 3836 wrote to memory of 5044	3836	msedge.exe	115
PID 3836 wrote to memory of 5044	3836	msedge.exe	115
PID 3836 wrote to memory of 5044	3836	msedge.exe	115
PID 3836 wrote to memory of 2432	3836	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jcvosevf.site-shartbandi-variz-kam.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff21d0c188,0x7fff21d0c194,0x7fff21d0c1a0
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,11881113718845435133,17970691209820689123,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7850044888873621589,486890428767083292,262144 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,1970906008255195384,16546258666854782718,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6165142268042768530,1959670086958597593,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2900005642397266981,16398981152606943564,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12282759189566720088,5478998765465435987,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12633636718652892223,8385077506227892253,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,2434969270491846865,16431522265381997304,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3528,i,834131709635087521,3245417501508246357,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,15924233458634939082,17023997335377058685,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,4092897341111943517,12747760753095933338,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,6893310667864955500,10801363429633126691,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,6893310667864955500,10801363429633126691,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6168,i,11618947526262523104,3036121394179416823,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,13880123286966712405,8383388359773105470,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,3114114785197427887,17874573871263403109,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,13757283432415383612,9751972577931955722,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3716,i,9349084233948517304,8054962714025249157,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,12742841261578389656,15185819645852986249,524288 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6180,i,15452087114888945576,5839746192417787835,2097152 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4436,i,2475465128133612604,7138612965625848625,262144 --field-trial-handle=2448,i,4197681019808746631,10932602109356589274,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2960445247a7e4fdb70604af287e67ba277831ad1fc9d3517cc103bf702ae6e
MD5 bfd25e5f9f3f26f3c45f95999cccaefa
SHA1 2254719db810271f58a962acf8fb1429d5345628
SHA512 edd5df5854c85c2c15a6cd1ef07618444c69eee03997db649cfc0c7244d6bb96e54bc1dd97c40feb4dee683974ea6befec987a85e69291084c43587e384c83dc
TLSH
T12D713BBC3F1D2A51D3A7963FA0B01310B27580C0FDE33EA64354A8BC580EFEA21D556A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a6f9.TMP
Size 3KB
SHA256 3c0769b88886dfe1cb9cd1ab583def1c3f210462533451c329b2a220157e6f88
MD5 85eda1dff636660a3f578e1a07008d7e
SHA1 ab22b7bc6c0e7572972b7d36051650b83b0cd4e9
SHA512 d81b7a43ccfcc65f9c42e07590b00d51b2ce85d1ed7e32e8c9cab7e2bfa76a88b7a7690ced157f2b5d03e08aa9bc4b552173a28d0bb03be4e62f008f4e5353d1
TLSH
T153713CBC3F1D2A51D3A7963FA0B01314B27580C0FDE33EA64354A8BC580EFEA21D516A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 297bb54b2cf604e364d5d02cf01cf421f6b3a952169ebe510c75cecc4938d3b9
MD5 d163dae8250774031ba15213b8604d3a
SHA1 9790d77891cc13400b4ce87dedbf0a82f42f4f58
SHA512 802f55a0574bf5673b0113652df3e37cf44cb2312d183f7f395c17ec6ed90dafa8213a353cedcb1e431fcef36c87766f9d32c6810c43e3288f0c7f6a2ac19654
TLSH
T1D921A0F383D5856ECA1156F0AA18BE2BCE1D0501432C3D1AC6E4EF17A3E3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4feae0a45f689fcbcb1beea3dafc149587da65e03b716ddd43603d7374493d59
MD5 40bf55c37cb139858341b4f8b57c8954
SHA1 9cf304291cf5c521f9ef305e9b3d92785d3aeb3e
SHA512 4b65636f6b34e4a065eb09803a5f693cc665365f26948d13fc685f2c96a1bcbf502e5e8b187db01fffe4a13aac997c4735b02fdd842034750ba251107d326d2b
SSDEEP 192:sxZzRXyM/jK1Ml8UQAkD/fDsf7PtIdpwAH0ql6+WNGYrL9ZAszRIg5KJ:sxZz3qTD/fDsf7GRHzuGQbZU
TLSH
T1DE52D816AA34997BCCDBD209FA51BF93D6F5147292900E449AFCCA1C00E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 11eb56009256b1c0c34852473619ea358a93bff0c8ba615629e77ccf27c21926
MD5 973bfb966dcdf4a62f2a773878a77134
SHA1 6bf19f5dcc7f393d9e79fdcaef1038ea0e9649db
SHA512 20f2f8bd0fb7da7497a7c153e32e7f56014624412c26e20ad54fc81eb317487a9340415d984556cfb150a2be69946601cfe4e5e7813dbdfed21f54455be444a3
SSDEEP 192:sxZzRXyM/jK1Ml8MkD/fDsedPtIdpCAH0XY6+WNGYrXZxszRIgrJ:sxZz3MD/fDsedGHHGBG24Z9
TLSH
T12042D812AA34997BCCDBD209FA55BF53D6F50572A2900E449AFCCA1C00E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb9c6980950f6090e54bf449ecf1107edbeb0008a0c280ccbc793eb510351e81
MD5 673c47dbd356b6403e18aa14060b7f40
SHA1 147bc73f26e86cc53ff7b3a8a2945ac7f587270f
SHA512 fc3687f67731aec2332c6150e76b9a059587795f99a226bcb7aafe9cc22e7d46a2c4963f327fd880656e5369e6217a8641d748f2ae61f521e69559bd127cfdab
SSDEEP 768:QlgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRbroWZRTXxGo:QlgL6XeWviSZqu1jaSJL7+RoWDxGo
TLSH
T1EBD21A3B690CCB7E4F840E5CED26AF876DE801CB5BA84D5447FA494C03C77EA512649B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 032d6bf0ed96940e499908c7a6f63f6dbefa13bd8f1ee47040176943efcca3b6
MD5 695569c9a9fcf858d90aff9036d64ed8
SHA1 20911eb52cfb52833b5c4f8b7339f7e0efb9c65a
SHA512 103a81b253cca364c96fbe24bddeb4b3be18c33b7d25c21cb137a578849dca3a8be96d253f5a0833d40787e71fed45d2c656827c70eac900d1596391edc921b7
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5UBIZK68czyxWIXKXqsDyZz:KwX+KUs6ByK68qSWwKXqKKz
TLSH
T1AC9156127177560139FD241892A286679E8271FB3914A57F3BB8B4D60F6BE120EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 4361724d1d32b2475ae15dc6a98f289f2daae3f2bc8be69cd37b82caa2e99e81
MD5 6ce095518785daf676b2bc45bd4a430d
SHA1 74408b8e30ed44a2479447703d33176cbd704fd4
SHA512 96b21a0382ab5f6ea6566d993c4b0d8f61e6e9e80dd25d512aaba7c6e102eb7b10a0363662573f385d86f1f4dac906ee1df0e5733eae32dc982e175c9b42f18b
TLSH
T1A721128093EA94957FC9B941C13B5703E0E1BDEF350D5933235D94F44F458170B2EA65
MD5 SHA1 SHA512 TLSH

Submit Download

af8cee58-7db4-4463-88fb-ddea565b34b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\af8cee58-7db4-4463-88fb-ddea565b34b6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 90558c0dcc5e6d85a0f09476d11b3a369eaa5ed4c7e3c8a2f6a86071e12f84fa
MD5 c98a9fb6a2e55a38832b0d75d3676539
SHA1 5e664da4909b13e17a1d4242cf965ddc0588dc26
SHA512 66dd1ee4f776d20e60066d790e09173d536dd47e1222a7af9024886be25d3ee637420edaf1498eeb6eebaaa4dcf2cfb628e1c4445409cb9f35939fd62e87b987
SSDEEP 384:jtNn/s3n9SfsNvkFy7lQeg8gSXu9uO8uYdov+OObjI9G6w7eUp:jj+9USW2AnrYdU+29Mp
TLSH
T188928C37A8289C379DE2AA91F5473A179FF4813797843E48D6DC6F0C05DB69C4306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 22a48a01f53b81b7cb1c83f735cbd4982cbecb36eb856ad53e8ddeca637db39d
MD5 cc6cb914e9e82bb36fdaef0c840d1c91
SHA1 348f3b4a3b26fcdd832267438e29afd0a14ed29e
SHA512 384405ecace34599b29d4d8b2fd76f72bc46c37fab6b1f51390f02d3f70bd4f5cfaab17a00b32bb63911cfab28aacbde6cd7582e13c1bdfada0abb8f0ea2fb8a
SSDEEP 384:LtNn/s3n9SfsNvkky7lQeg8gSXu9uO8uYdov+OObjI9G6w7eUp:Lj+9U1W2AnrYdU+29Mp
TLSH
T1AD928C37A8289C379DE2AA91F5473A279FF4813797C43E48D6DC6F0C06DB69C4306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09badbe22039b79a883d82b763d6adaf2a09d166691d4af44f323fb465e76c0d
MD5 242a929c644777c84e3d56f15a989e41
SHA1 9c540c9cc7fb99fd91a89b98754d6db68f9a817b
SHA512 593633581439b685ceda13717c5b7171d520066d3fd2cd9a15f38034986f58eb205cc96144feb6692e6e153f8c8fb54aaf0e8f8e45540c4c944b5bd843912f38
SSDEEP 96:RqONk0OQsjpfVC10tOJ5ih/cIPURHl8h4otop5SRDSBOPPvfzSuOaPzMvbfcqs62:YONf6LCWtDQmiUyoyILSuOCzShsEVQU6
TLSH
T1A202D936A9686C779EF3BE45B5873B276FA41037E9902F44DAD81F0C01D764C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 37ee3320df2b986d43a396384340370ce2cd56cf36228df57390f5afcb7761dc
MD5 8ad1269361f4c50e654f97578f1874ec
SHA1 87db464372326c13f14ec1df41586b8f15ed992f
SHA512 e21c73030507241f2ffd6777400bb164c0092553843335c3d3c1765861dfe4302c7ce88e0983b74164d3860f05c7cace22d098454f9189ed98f4a19ea04d3694
SSDEEP 384:PiF1tNn/s3n9SPzsNR8TUNTUlIlkky7lQeg8gSXu9uO8uYdoE+OObjI9G6w7eUp:aF1j+9UgwgcW2AnrYdZ+29Mp
TLSH
T10FA25A339858C83BAEA29F91FA4A36179FB4417786853E94E7C8AF0C01DB69C0306914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 205c9034ce851610bd70f8e267ebd157fbc04658883bec8df3cd0e450d64bc03
MD5 a414dd09964a61f505e4630b8f8bbbb8
SHA1 0fb5c8e1da42a2363f31f2a881f46feebf720454
SHA512 30b5d531ebc03ffe2d4844d822180972e6edebb1b6ae9b41713c35f3fff0a7cf0ca21e55125dac57022f991705e9dadba30afb00174ffbea0f3314861a52261c
SSDEEP 192:9ONS6LCWtxQmiUy9yaLSuOCzS3YEGNofI/5q/vU6:9ONS6mgPTamuO8uYdoW+U6
TLSH
T199120C37A828AC77ADE2B991F48336135FB45123EA843F54D6DC2F1C05EF68C134A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64b5f328-9e3f-49f3-a65e-20bd5b83a147.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64b5f328-9e3f-49f3-a65e-20bd5b83a147.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9f0128ed76926b7af70ab54e2911f9529b3c1f7239ffc0285ba0dd5ac6a98fd
MD5 98492707625f1e92909b42839e003487
SHA1 f948035024097bc358d6c8fcf1e91879fff6fcfa
SHA512 f98ed482a114bb56646b91c4224002e69c8a07f5bc3bb08b778e93712619aecde49b03e31f547c95e0ed19739de9092ffb6a0c7f403b90e177a1f1c5ba2fa113
TLSH
T180410998BAFA1148B3B76F5A9BF6A46E447B7D332E06946D00110E4E0662B44CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download