hxxps://www9[.]sidetrade[.]net/Login[.]aspx?IdMembre=302931&URL=F99F4D391A8C231ECAEB2936C62EA00C2188712F07003BDF9DEFC3A637C0DE44EB1F5A4DFD58CB643751C8396143AED4

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www9.sidetrade.net/Login.aspx?IdMembre=302931&URL=F99F4D391A8C231ECAEB2936C62EA00C2188712F07003BDF9DEFC3A637C0DE44EB1F5A4DFD58CB643751C8396143AED4
Sample260720-lc5dzsfx21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290130618711939"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{2BE14B50-DAB2-4457-9CA6-A2861413F9E6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1700	2624	msedge.exe	85
PID 2624 wrote to memory of 2996	2624	msedge.exe	86
PID 2624 wrote to memory of 3272	2624	msedge.exe	87
PID 2624 wrote to memory of 3272	2624	msedge.exe	87
PID 2624 wrote to memory of 3272	2624	msedge.exe	87
PID 2624 wrote to memory of 1844	2624	msedge.exe	88
PID 2624 wrote to memory of 1844	2624	msedge.exe	88
PID 2624 wrote to memory of 1556	2624	msedge.exe	89
PID 2624 wrote to memory of 332	2624	msedge.exe	90
PID 2624 wrote to memory of 1556	2624	msedge.exe	89
PID 2624 wrote to memory of 1556	2624	msedge.exe	89
PID 2624 wrote to memory of 332	2624	msedge.exe	90
PID 2624 wrote to memory of 332	2624	msedge.exe	90
PID 2624 wrote to memory of 2484	2624	msedge.exe	92
PID 2624 wrote to memory of 4908	2624	msedge.exe	93
PID 2624 wrote to memory of 2484	2624	msedge.exe	92
PID 2624 wrote to memory of 2484	2624	msedge.exe	92
PID 2624 wrote to memory of 4908	2624	msedge.exe	93
PID 2624 wrote to memory of 4908	2624	msedge.exe	93
PID 2624 wrote to memory of 4172	2624	msedge.exe	99
PID 2624 wrote to memory of 4172	2624	msedge.exe	99
PID 2624 wrote to memory of 4992	2624	msedge.exe	100
PID 2624 wrote to memory of 4992	2624	msedge.exe	100
PID 2624 wrote to memory of 2132	2624	msedge.exe	102
PID 2624 wrote to memory of 4084	2624	msedge.exe	104
PID 2624 wrote to memory of 4084	2624	msedge.exe	104
PID 2624 wrote to memory of 4084	2624	msedge.exe	104
PID 2624 wrote to memory of 4588	2624	msedge.exe	106
PID 2624 wrote to memory of 4588	2624	msedge.exe	106
PID 2624 wrote to memory of 4588	2624	msedge.exe	106
PID 2624 wrote to memory of 3336	2624	msedge.exe	113
PID 2624 wrote to memory of 3336	2624	msedge.exe	113
PID 2624 wrote to memory of 3336	2624	msedge.exe	113
PID 2624 wrote to memory of 4396	2624	msedge.exe	115
PID 2624 wrote to memory of 3308	2624	msedge.exe	116
PID 2624 wrote to memory of 3012	2624	msedge.exe	117
PID 2624 wrote to memory of 4908	2624	msedge.exe	121
PID 2624 wrote to memory of 4908	2624	msedge.exe	121
PID 2624 wrote to memory of 4908	2624	msedge.exe	121
PID 2624 wrote to memory of 752	2624	msedge.exe	123
PID 2624 wrote to memory of 752	2624	msedge.exe	123
PID 2624 wrote to memory of 2456	2624	msedge.exe	124
PID 2624 wrote to memory of 2456	2624	msedge.exe	124
PID 2624 wrote to memory of 5024	2624	msedge.exe	128
PID 2624 wrote to memory of 5024	2624	msedge.exe	128
PID 2624 wrote to memory of 5024	2624	msedge.exe	128
PID 2624 wrote to memory of 4720	2624	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www9.sidetrade.net/Login.aspx?IdMembre=302931&URL=F99F4D391A8C231ECAEB2936C62EA00C2188712F07003BDF9DEFC3A637C0DE44EB1F5A4DFD58CB643751C8396143AED4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x13c,0x23c,0x240,0x238,0x248,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,13871937804715707775,17448005096769420561,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5552625766589688850,14713443636693556829,262144 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,10648984425417373043,1591232113613144323,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,10442760964936238400,802833442347008308,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8050275892190648440,13766814052875055880,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,15773431940281106716,755769617699169863,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,240094787091641934,6649692449359045959,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7787374113741960265,2976164949608662892,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12436323253598139562,2427007054614480557,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,12014509070619815689,5567144171527698835,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,12014509070619815689,5567144171527698835,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6164,i,14486302205794563738,15792900336165881663,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3556,i,1629048791044172662,16775271985477798387,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6220,i,2047052040372301173,1441434077800847044,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,11860386978258701669,7684861431888376231,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,5301490751695708007,16171000742646380761,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,440279795625097614,9514409127028599666,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5132,i,13394010910281711562,3887437476770120367,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,16346486203633262885,18385247640195291212,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,15316321372773701170,3434923110774615869,524288 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5904,i,9774363658410930726,4154092584182228442,2097152 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2136,i,480564609360260644,13340963769886278606,262144 --field-trial-handle=2204,i,14307299791110594315,3503622611519099153,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 027cd778f081aadba9d17ce88ca55493dec9383c713a5158ab87d8a75fbc9ccb
MD5 1bd87612703a7e76b74a6541a645309d
SHA1 cf80bb669b93e92826b30fbf0f723565a8295e09
SHA512 9dcb8219660c4c714d955c84f310a3f97a4473777b6c04f6f76f57b14014013820c3d8b5d37281146679245b0a1d25b5237fb66e307f928c1fbb1981cd0a6425
TLSH
T1CD71910B06693E95EFE71170F3ED420D38F283F50D632E661E6CD83D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903ee.TMP
Size 3KB
SHA256 bbdf746508d45fa2267c1c8d433a94db33853744fcc0de4d8cc26c68bd148f38
MD5 f3d7b0595ecfc59b56390a041bf251d9
SHA1 62ba707b665edf052e52323a69f6da2d949050d1
SHA512 99adb0f1043a24ff99faba8c1a2f4270dbd7ce6346401b903430da3b18c184f3079077a18cd915b42569ab87f66e0415ba3ec4e1b684405f6967d97f2afcc751
TLSH
T19671A20B06693E95EFE71070F3EC420D39F283F94D632E661DACC83E652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bfd7ad364895ec5431c855c9eaee1be9d23f8f8618e853468a6cd7e57a2f45cb
MD5 43dd908c7dd3f5027ee4876d8baa003b
SHA1 d5e7ae9372032896e6a7eead88a0a4aa9f8b5e46
SHA512 0c5d5221eba7c59e9fb73269800597f72842dca025a86ba8b26bb8735adc3d1ded7b873c4abb5f8b0b0b230e3fbce4bb4784c0e6eab94d3d13b4abb0c3b0d169
TLSH
T1E6218CF7C2D9C66EC91116F0A624AE2BCE1D095582283C19C9D4FF5BE3E3472E20255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dfdcc9ad2c45d8825f322878f8fc51cf9ee0989cbd22a6a5237a522d272a1d21
MD5 f6cd5be39f4e081a0732330a3d8a8f4d
SHA1 fe04d000dedc7604423b2e6400aec59e354d6dd6
SHA512 ef52a64955e4a2265020256c7168eb2c0a5c79e518a42d182f44825e002f1c2c1e3682d5cf57cb8a50c3b17fb2bbe58bc809ad685e814a0ffa9f9cccfe58afad
SSDEEP 192:sxZBRlkb/fysGNumNIdptEHW6+WNGY4wU+w3IgrJ:sxZBkb/fysGNbuyHbG+09
TLSH
T13D22B8566E3899778CC7D60DBA257F43D6F95032A1901E48AAFC8A1C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5777fcc99eb43a617021358d786c3e5305d59de34ae815d871b9ec0903c1536b
MD5 fafb109375c33aa351c34d85c6236070
SHA1 416959ead48adcc9be642a2eb874b2e4c50bcfd1
SHA512 0255bc50196c71807a1d6012a8c36f7625a4996687f5cb16fda6da6bba6fa1a991c03ec1b11054a8b42cff5f9267324b7c649c57aab9bab5c0c9211fe5cec457
SSDEEP 192:sxZBRlkb/fysvNzmNIdptaHW6+WNGY45C+w3Ig5TJ:sxZBkb/fysvNyuMHbGD0/
TLSH
T17122B7566E3859778CC7D60DBA25BF43E6F95032A1911E48AAFCCA1C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3129e06912f2cff6c2536efa76c98f61b8ffda4a1b78a1f053aa9cd621e95638
MD5 fdff4b8a23bd4f532479048fefd05e4c
SHA1 9eecb1e95f9bffff086ce76a992c71efcf3b810b
SHA512 e8b130039c9a82ce8845f0fce64fb77280fb15d94df0de1b9e9c7c61c33ea1bdef6d3cfb81a289fec832ad1d163c8b674da8b2aad4b010189f587729539cd0f5
SSDEEP 192:sxZBRlkb/fysvNumNIdptaHW6+WNGY4wU+w3Ig5pJ:sxZBkb/fysvNbuMHbG+0p
TLSH
T13B22B8566E3899778CC7D60DBB25BF43D6F95032A2901E48AAFC9A1C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 39de087926b9f73ddfbcf993a273fc56f0cbab3762d3367bf1578ef56e46c05f
MD5 b36afbb3b4d891b557a21afcdd3042ad
SHA1 e42248f44028f332b97feff2cefc21fa5925df92
SHA512 b3ed9a541b51b4b4a00a593f70648d141ed3168b6c9fc2a73f2aa24a913b033bdb8d12ee80c72ee6518a89ca93eb18aec9b39ce996d93f84bb94f01c66557d13
SSDEEP 768:viqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTcroY+Unr:viqirTNWvx7jru1ja5ALocTHZUr
TLSH
T128C2EA3B640CCB7E4FC01A9DDC5A6F963EA802CB5B948D4087FA994C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2e3b9fb3bc82cc2b0dfd2361e85df4d732bd46e1777f1be2ad4b917275b4091
MD5 ad31d42ac8ac4180d6fea03dd7c346a2
SHA1 f7baa570f006562b00332549182e5c8e23f01ccf
SHA512 942859b3cc517fe28c58936274bbd863df8f1139dd4a983b6fea4f5aaaf402ab55e12935f1dd70c7aa59620d14fcce9ac7b8721dc77a7dddc02e6e9d612c651b
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGMRuIvK7CsXypz:KEIgK9WK6A4KBGKuIK7Cmaz
TLSH
T1C091651232BF12423D3E690CD2519757878271A7301CE42B3BAD51B25EA7E268CFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c3067e9668ea915125343e873ef3c5e8c93381879c3560c104f6859ea9e95f8d
MD5 3710a2fa3a6209a563b48b7d76484c56
SHA1 ebc821015286b11c47cc6c61f7b502fe706979d9
SHA512 bac7511c81f7b63fedf3a5f5e02f1da044e496e0ee90cf9ffb9c2ab93d7dbdbcc594f2e932cd6c0caf3c366ee592e66812532244e8e68ba9b956a62d1e7e7b15
SSDEEP 384:0tNn/s3n9SfsNPpeDk43N9kvMZHkOObjI9G6w7m8:0j+9UZDTNZHk29MR
TLSH
T1FD929D36AC285D378DA349A5F54B3A2B9EF4817BD7C52F84D9DCAF1C05CB6AC4302911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3f7b847d5e8afede5c19985d14cff916e7cb278d71b7926bc2e66ccf680bb4e8
MD5 0546e4da7b4640ef4cd48b199406c69b
SHA1 ac83f621e6e059db30e349050bcdad6f17083b32
SHA512 d40c1b1fe6a056242660e0bd2f2a80708ac77821be11b04246f12d50e13f9499dde50608e4cd20c8582aae720407556fef40c31c476dd7c45f52a967dd2ce82d
SSDEEP 384:rtNn/s3n9SfsNPYeDk43N9kvMZHkOObjI9G6w7m8:rj+9UIDTNZHk29MR
TLSH
T11A929D36AC285D378DA349A5F14B3A2B9EF0817BD7C52F84D9DCAF1C05CB6AC4302911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33bbe9c7676083869f65ea06917d78c7cc82c2b39c7095fad01d181d74c91b6b
MD5 ad231e51ac0717ad513c84e65aaad486
SHA1 3a55c6e8987edd7e8e960799658d20ec16832729
SHA512 829d03ea251ec1df0e568c10ef6b2f7e282b21480e4f4fcdbf0fee501b9809bc9c9573b73e71f6fd9405b2b67084ff361e2ae362d446750798abd3342dffbdab
SSDEEP 96:BgqONkmQsjpfmUTGZK5ih/cIPURHl8h4otop5E9DGBBDPwivh50xy0SFYK7Ax6YQ:RONC6kVQmiUyYWN903NoeNacRHPqNBU6
TLSH
T17C123B36AC786C2B8DE36955F48736135EA5413BDFC96F81D9EC2B1C01DB69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ace9fa3be0cd46540786c40b262a32b63205872b0d896abaa1f1aa89de08762c
MD5 b4c4314eab451ae26a93205df9c092c2
SHA1 e804206501dfd2557896c3e4cf65154f875d222e
SHA512 db6fce3fa37817c54a04cc045ed07071b124a6a727186ba51c7f60b83a888670741a90bc044b3a7303039c2580b95e2e4d6bebddc13cd68f85c84be419dd7335
SSDEEP 384:ItNn/s3n9SXzsNPYeDk43N9kvMOHkOObjI9G6w7m8:Ij+9oIDTNOHk29MR
TLSH
T1ED928D36AC285E378DA349A5F14B3A2B9EF4517BD7C52F84D9DCAF0C05CB6AC4302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb857c07-88c2-42a0-a38f-32c46ec9db49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb857c07-88c2-42a0-a38f-32c46ec9db49.tmp
Size 8KB
SHA256 5588ecfcfff47a638bf72e2be37ca755fe59be945ea2b401e612de84574587f2
MD5 0a1196ce2176ae13cb893a5d9a02caaa
SHA1 3be917d6fe133446af5c2e683f9c72e1372c1195
SHA512 8e3aa6e161c2f4573c944c98eafd0f96eea5c4cb818306450fc7f607e4a7b8650830dcb6f8c0472e433901bdb6a23080f5bc5e3942160d6910a7036e52d308de
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5E5DGBhPwivh50xy0SFYK7Ax6YLg5:gONc6kDfQmiUy2WZ903NIQiHkEU6
TLSH
T17502E7396C786CBB8EA3AE19F48737275FA5113BEAD42F80D9E81A1C40D764C1743827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b117c2ba-6946-437f-84bc-1b47a27f515f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b117c2ba-6946-437f-84bc-1b47a27f515f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e5a0359f8ef8e1c67c2e769a8ff190c8fa20402323cfc599802489bad15cac1
MD5 f702d7e79c95b9fbfd6e916e14cd7b6c
SHA1 b59519c6e86590b9794c083b890ab020886bc128
SHA512 38f946abb03a4d29d0fe1fd96fd69db6238029358f725164b00b21c31e8c637084c8aa1800cd7b05d0f9d326179569bdc94c2b07aa9c706d37eb49ee48e3b5e5
TLSH
T1DE414D9CAAF91158B3B76E5A9BF6B56E447ABD772F06D09D00110D4F0A67B00C871733
MD5 SHA1 SHA512 TLSH

Submit Download