hxxp://autumn-surf-ec3e[.]267doc[.]workers[.]dev

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://autumn-surf-ec3e.267doc.workers.dev
Sample260719-p8pvyses21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289396184654020"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{0CA5C98F-75AC-4D5E-A46C-715975BBB552}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 380	4728	msedge.exe	84
PID 4728 wrote to memory of 3364	4728	msedge.exe	85
PID 4728 wrote to memory of 4444	4728	msedge.exe	86
PID 4728 wrote to memory of 4444	4728	msedge.exe	86
PID 4728 wrote to memory of 4444	4728	msedge.exe	86
PID 4728 wrote to memory of 3216	4728	msedge.exe	88
PID 4728 wrote to memory of 3216	4728	msedge.exe	88
PID 4728 wrote to memory of 1492	4728	msedge.exe	89
PID 4728 wrote to memory of 1492	4728	msedge.exe	89
PID 4728 wrote to memory of 1492	4728	msedge.exe	89
PID 4728 wrote to memory of 472	4728	msedge.exe	90
PID 4728 wrote to memory of 472	4728	msedge.exe	90
PID 4728 wrote to memory of 472	4728	msedge.exe	90
PID 4728 wrote to memory of 2836	4728	msedge.exe	91
PID 4728 wrote to memory of 2836	4728	msedge.exe	91
PID 4728 wrote to memory of 2836	4728	msedge.exe	91
PID 4728 wrote to memory of 5084	4728	msedge.exe	92
PID 4728 wrote to memory of 5084	4728	msedge.exe	92
PID 4728 wrote to memory of 5084	4728	msedge.exe	92
PID 4728 wrote to memory of 4276	4728	msedge.exe	95
PID 4728 wrote to memory of 4276	4728	msedge.exe	95
PID 4728 wrote to memory of 4276	4728	msedge.exe	95
PID 4728 wrote to memory of 2012	4728	msedge.exe	97
PID 4728 wrote to memory of 2012	4728	msedge.exe	97
PID 4728 wrote to memory of 2012	4728	msedge.exe	97
PID 4728 wrote to memory of 2912	4728	msedge.exe	98
PID 4728 wrote to memory of 2772	4728	msedge.exe	99
PID 4728 wrote to memory of 2912	4728	msedge.exe	98
PID 4728 wrote to memory of 2772	4728	msedge.exe	99
PID 4728 wrote to memory of 4604	4728	msedge.exe	101
PID 4728 wrote to memory of 4912	4728	msedge.exe	102
PID 4728 wrote to memory of 4912	4728	msedge.exe	102
PID 4728 wrote to memory of 4912	4728	msedge.exe	102
PID 4728 wrote to memory of 3068	4728	msedge.exe	109
PID 4728 wrote to memory of 2052	4728	msedge.exe	110
PID 4728 wrote to memory of 2304	4728	msedge.exe	111
PID 4728 wrote to memory of 4544	4728	msedge.exe	115
PID 4728 wrote to memory of 4544	4728	msedge.exe	115
PID 4728 wrote to memory of 4544	4728	msedge.exe	115
PID 4728 wrote to memory of 4208	4728	msedge.exe	117
PID 4728 wrote to memory of 4208	4728	msedge.exe	117
PID 4728 wrote to memory of 4912	4728	msedge.exe	118
PID 4728 wrote to memory of 4912	4728	msedge.exe	118
PID 4728 wrote to memory of 1708	4728	msedge.exe	119
PID 4728 wrote to memory of 1708	4728	msedge.exe	119
PID 4728 wrote to memory of 1708	4728	msedge.exe	119
PID 4728 wrote to memory of 2748	4728	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://autumn-surf-ec3e.267doc.workers.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ffa248bc188,0x7ffa248bc194,0x7ffa248bc1a0
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,4528946752783662688,5810405419120905759,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5852196039825518588,13995331749882171765,262144 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,411139634844052662,1805219064440215149,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5479532110788420172,17962456249746584471,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5274308397795204712,836065105026886122,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3937517980856130607,226136074961435964,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,10098823570497511148,18015282498147989442,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,8019335490966378793,17199255690897973442,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5316,i,15986028849121189475,15700722537759391052,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,11981161266901811550,11310210292782461172,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17392902321077973159,12815940385439520649,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14681541440600694802,4259679891217110328,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14681541440600694802,4259679891217110328,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6272,i,12650733634316193688,17741299649223912348,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,3527367620072990343,759563879535746788,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6619753970331443381,9263395778243594507,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,5767957906562715197,9979139437877412734,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2972,i,10342775682510744104,1579839523133940925,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,16128052529006760504,14785761833479096700,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11148847475140335931,8426562502334620385,524288 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5352,i,11334387569126742597,5997310130611181627,2097152 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2140,i,3613758640219956632,14431245701714296232,262144 --field-trial-handle=2308,i,16709026217033436991,697187847804779124,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0d43b2519537d4175c17242cc7fa561fde3c04defff66b8f19f26f567e6debe4
MD5 d4858a4f574584b7886a2795eb48b9e3
SHA1 cb929ac23f32d5160c03b3c57e1f62b73318eaed
SHA512 ce789d5efcd48f9da41156c5073332649c39794a0d559d1fcb427b366dc77b14d6678140c6e0fd6d969fb725ab94dd23b73c711727e4e29aa8ae68137486a090
TLSH
T15D61F73D32674187E76F85F1F8F95E4C327941BB9B6F9E3C4658483D7A08B6A8423418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c0b4fface0d400c5df1d872f08933ea48628c48dda7f27bcf36252000831fbb8
MD5 ba4ec52fc1eeb8b72d08b8ea352caa07
SHA1 f0ed76c5ee7339bd0a3981414efcd2b994b276a6
SHA512 9a14d2003322afeca4717a215506f03208349aba646881d923098d61272b3fc2b4e218c6aa57cbbb24b74847a0ce7231c131418f647eac05e8fba8fe01aa4a8c
TLSH
T18B117AF3C3D5856E890116F06A24AE2BDE2D0A06832C7C1989E4FF6BD7E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 afa6d6da44ca86fc3eea955d40de2fcd0bea4e0b261424fb75e86f7c29513c3f
MD5 4f40b7ea26b43fb062df6c88fec3049a
SHA1 b70057da7cb725696bece936bb4b7711cbadd65c
SHA512 8eb4f9820b97938ed6de50cb5775a5b2a1e5cfa3b351bdf990107029e3fa33b44818e221f9c1cc6f20a44097d85f9514f5c751c756b40ea8013af6a8856213f5
SSDEEP 192:sxZTR0fkI/f7s1v4YyIdpH6HrR6+WNGYLz+fXj2IgrJ:sxZTOMI/f7s1v4Y7aHmGjS9
TLSH
T1B622C9266E38653B8CC7D21DBA15BF53E6F9503296D41E48E7FC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e0f7c1db0ebd1105da779a04bd9f5918af61181cd62d629a79c3a968aca81ae5
MD5 18d24095bebb599da9b526e00d060f44
SHA1 62ffee5dee3b3fe5e5d83c5d761d5aa181c10a6c
SHA512 60c7c163325aa7cd8747ba106310c24946ca7731c74605fd5d75d56ffa0beb84bd03e5dd2c3a07b2e2ec079ce9dcf933b64df94c6f8aa4af8d32a4515f7fcf0e
SSDEEP 192:sxZTR0fkI/f7sqv4YyIdpH6HrR6+WNGYLz+fXj2Ig5+J:sxZTOMI/f7sqv4Y7aHmGjSY
TLSH
T12022C8266E38653B8CC7D21EBA15BF93E6F9503296D01E48E7FC860C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4291201a9ee6618b695a3368f8accb06c08ce9201d2ed9069e57ebf7bae56881
MD5 cf0c3d701e3944fae9704ddd821b7a9c
SHA1 eedacf88e6085df719f2194ebb90a7b8e5f81e10
SHA512 5b3d32a3ffe80a2ed6c7c506bee2d532b3951105c678204a395e4c2010ab1be69a024e7a2b90d1ebcb8abb3ab9e6c4357031f7e8db43bc0d280c1fa130419eb2
SSDEEP 192:sxZTR0fkI/f7sqv4QyIdpH6HrB6+WNGYLI+hXj2Ig5UJ:sxZTOMI/f7sqv4Q7aHWGgSC
TLSH
T1B732D9266E38697B9CC7E21DBA157F53E6F9503256D01E48A7FC8A0C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5061cd636b21d616d87bdc57651590dad00b93ea62c83798b3eecb0f3a6752bf
MD5 64063d418cab1e90379a65080ff24d25
SHA1 7af558cf277fee5742dc667e23734c01070d4d8d
SHA512 13bb5992133b1ba9d4c9dbdf818ece92400477cc2e30dc8f73613a87dbcd2ed741a54d052ed6fb792bd021a2fadabf6ee1706eec8890d357440bf9520c57596d
SSDEEP 768:UPO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvzrog+:UPO6fP1Wvxz3ju1jaZILIsvAg+
TLSH
T127C2E93B240DCB7E4F801A9DAC5A6F977E9802C7AB588D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2966cd6282082fcfe22a8543f3183386df43ad31b0b7a5b43536b2e56f1f00f
MD5 4bbbc5deefc14318b2f9818b06f2def1
SHA1 d2468ae9faf004c7557c9159b376b791e6f6d84b
SHA512 7d5c90fd69ca69f1816af690ca68d09d01eef05564f8fecbbe94955222983d344aeab2162198279cdf71ea4a63c72d79e2b75fbf89923a4122d1c964c1573dce
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFOuI3KvasrylxIhKq00p:KUAAKteP2OuwKvaCOxuKq0K
TLSH
T131A1101332BB03437C3E295C97A58B67474676A33018B42B3BA910B61E6AE344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8164f303-0690-4534-b440-f048f1a8caf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8164f303-0690-4534-b440-f048f1a8caf4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 433fc88b989c0019335d59d19124932ef0c48ff3bd95aaa3b9f7730835618481
MD5 964071459668f7558af00677710a78d5
SHA1 e17cba8724d633230e0f9c8c283b05ec65c804c6
SHA512 7da83fd659ae5f0fdad78c7d9c83341e46f29796dc1fc257f1232bd1cea9e29cb0bdfa04c2480d1aafcafb8bedf45bdda2d0463bee2675a689fb999c1370a4e4
SSDEEP 384:IiF1tNn/s3n9SMzsNx8TUNTUlIlroXTaVOki8a9DOMMe/7zJrwNmOObjI9G6w753:TF1j+93QwgeXTafilJO+/fhwNm29MV
TLSH
T198A27D335824CD7BADA29A55FA4B365BCFF4007BCA866E84E7DC9E0C01DB59C1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 91fea7c3ea6fee6463fe00d3ffe479a6206194c346531e625122903d5633b686
MD5 0ecbb7fb704578fc7914a02afa14a348
SHA1 6b545c528fa6bed87b4a34a1880ba9cb2b9f64f0
SHA512 44fe32ee6f3fa201f99252e0955d4c2fc4b1fc4e974108bcd3f2f2a5a21ceb68b27f1323021387f1629bae9cd2702dc0c2f41370af5714391528289f0dcb5072
SSDEEP 384:qtNn/s3n9SfsNProXTaVOki8a9DOMMe/7zJr1NmOObjI9G6w75Um:qj+9URXTafilJO+/fh1Nm29MV
TLSH
T10792AE3168349C3759E39156F9873A6B9FF4407B8A8A2F84D6DCAF0C01DBAAC6316C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 97189d46fa720c31fc6515bd5b9c5fabcf6e684aa035addbc061823327c69061
MD5 79489c79e9cabefc01b5c520589a92c2
SHA1 3f1451cf1b2145879d4e8884f28af20a0f8a3ad6
SHA512 ee26d078a23da5fde019fe55dc812789d672e3962b360bd0ed02c99faa0ee11cb9aff98eaf51265bd651617ccfb0b905de89d9b7ce9c698372f8a76a7ca17850
SSDEEP 384:jtNn/s3n9SfsNPCoXTaVOki8a9DOMMe/7zJr1NmOObjI9G6w75Um:jj+9UuXTafilJO+/fh1Nm29MV
TLSH
T16992AE3168349C3319E39156F9873A6B9FF4407B8A862F84D6DCAF0C01DB5AC6316C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ced098dca435b47136968eff307d726806c10d82fbbcd45ab90366cab6ad5707
MD5 aec1bbdaf90ac778a82954f30f5eb893
SHA1 75731b143e49b431afd7dd7fbb398c90f793d536
SHA512 3759dd0960dc55cd1a2a53dd00e75ede3787bf0828bc1f4098f6849f9c59f5b7a2a0a59de07cde2feda5e4dd19eff78937206e833a153d6805e4a55d5c81978c
SSDEEP 192:tON66O7+3mQmiUy4tvsttb02O2bbh2e/FF0SJr/cNHqozmU6:tON66A95st9DOMMe/7zJr8NmU6
TLSH
T1A6122A3568289C775DF2A545F98736179FA5413BEE8A6F80D2DC2E0C01EF66C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 338d70124c81dc73d95c71239f0ee9ae0d2a24d6a8a488491f934ace0adac817
MD5 678b7074b03531142d03ee5348041b1a
SHA1 18bd7edc29bceb2bfc837dcf42967b50dca5ffde
SHA512 aab140a816ace9ddfb1b556a9bf5b20c7c0d8e138145311d93dc2136a39a44664b63dd9db35c19d7dc3668f65f6cbf0ce64bd8a9b94a5bd6e6e381f8e02cb5b5
SSDEEP 192:qON8S6O7+3hQmiUy9vGttb02O2bbh2eQgGpoiU6:qON161WGt9DOMMe25U6
TLSH
T18502E8346D686CB74AF2AE45FA8737175FA5103BE9952F84D6E81F0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdfb6b4f3df0ab2fe74063f2ef6dd863375a15be0ca060cd19b8b1f214aac115
MD5 024a35a594b911d8673e93d55ac46f47
SHA1 7402910b7e15c0ef545dc41f418a684de3a4aae8
SHA512 6240898c5fc243fd8bd57f2fafdce3a67951cb58897aa23e9cd73be97db79aba327ada7d13f1d0526c0267f15c3bf924c14689f8aee4edeac30b563f1323c2cf
TLSH
T184411798A6F91108B3B7AE4A9BF6686E487FBD373E0BD49D10010E4F4662B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download