cf9fd1cc8a3edbd1ea433e5771d14cabe7a8444bd35194436fec2a758549187e

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
get.html
Size 187B
Sample260722-ph2f3a1vgy
SHA256 cf9fd1cc8a3edbd1ea433e5771d14cabe7a8444bd35194436fec2a758549187e
MD5 0dfed30b87d1c3047364c4d3d93e6427
SHA1 df082bae702e15990fa479959949417218e7ebc3
SHA512 1df2e6fcf7f06f3aa7ab99343c31f99bcec2bfc0fef614f5269afe0125a9f2867898dba62776a94846c0aafb8329b04c2f8294f62b4b5e5aa78f7e09ebaf160f
TLSH
T13DC0805A781540150275151535F13507D1AB9C77FDC05D14C190D0FA15F5FCB8FC35AE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291966603423951"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{8484BBBB-48DC-471F-AC4F-F5CA6EBB570E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5716	4812	msedge.exe	89
PID 4812 wrote to memory of 4332	4812	msedge.exe	90
PID 4812 wrote to memory of 1896	4812	msedge.exe	91
PID 4812 wrote to memory of 4332	4812	msedge.exe	90
PID 4812 wrote to memory of 4332	4812	msedge.exe	90
PID 4812 wrote to memory of 1052	4812	msedge.exe	92
PID 4812 wrote to memory of 1052	4812	msedge.exe	92
PID 4812 wrote to memory of 4124	4812	msedge.exe	93
PID 4812 wrote to memory of 4124	4812	msedge.exe	93
PID 4812 wrote to memory of 4124	4812	msedge.exe	93
PID 4812 wrote to memory of 3244	4812	msedge.exe	94
PID 4812 wrote to memory of 3244	4812	msedge.exe	94
PID 4812 wrote to memory of 3244	4812	msedge.exe	94
PID 4812 wrote to memory of 1904	4812	msedge.exe	96
PID 4812 wrote to memory of 3436	4812	msedge.exe	97
PID 4812 wrote to memory of 1904	4812	msedge.exe	96
PID 4812 wrote to memory of 1904	4812	msedge.exe	96
PID 4812 wrote to memory of 3436	4812	msedge.exe	97
PID 4812 wrote to memory of 3436	4812	msedge.exe	97
PID 4812 wrote to memory of 3964	4812	msedge.exe	98
PID 4812 wrote to memory of 3964	4812	msedge.exe	98
PID 4812 wrote to memory of 3964	4812	msedge.exe	98
PID 4812 wrote to memory of 5628	4812	msedge.exe	100
PID 4812 wrote to memory of 3912	4812	msedge.exe	101
PID 4812 wrote to memory of 6128	4812	msedge.exe	102
PID 4812 wrote to memory of 5628	4812	msedge.exe	100
PID 4812 wrote to memory of 5616	4812	msedge.exe	103
PID 4812 wrote to memory of 3916	4812	msedge.exe	104
PID 4812 wrote to memory of 3912	4812	msedge.exe	101
PID 4812 wrote to memory of 5616	4812	msedge.exe	103
PID 4812 wrote to memory of 3916	4812	msedge.exe	104
PID 4812 wrote to memory of 3916	4812	msedge.exe	104
PID 4812 wrote to memory of 4728	4812	msedge.exe	106
PID 4812 wrote to memory of 5472	4812	msedge.exe	110
PID 4812 wrote to memory of 2524	4812	msedge.exe	111
PID 4812 wrote to memory of 2196	4812	msedge.exe	112
PID 4812 wrote to memory of 3688	4812	msedge.exe	113
PID 4812 wrote to memory of 3688	4812	msedge.exe	113
PID 4812 wrote to memory of 3928	4812	msedge.exe	114
PID 4812 wrote to memory of 3928	4812	msedge.exe	114
PID 4812 wrote to memory of 4820	4812	msedge.exe	116
PID 4812 wrote to memory of 4820	4812	msedge.exe	116
PID 4812 wrote to memory of 1864	4812	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\get.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fffff2dc188,0x7fffff2dc194,0x7fffff2dc1a0
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14932770359162296498,5639425169639044180,262144 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2343470818861364668,6213489100932649030,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,12399918574789704027,12435395487572052917,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,16550833648833941776,9813641768393700766,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,2685053818159397586,17785294837437460178,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,1187591244737321063,3375858394424638270,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,6091415486766923482,16798195864729104899,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5308,i,9468879788143119418,5868671150243797184,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,7810725156912108025,11776984022614174870,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13386589756231854620,6428038905213734907,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16868838049204035555,9296942077932373327,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,12339424797798558147,9698802849031786697,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5904,i,13496390371210406662,14898779635484845418,2097152 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,5738967741277972945,11622292014007816506,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,5738967741277972945,11622292014007816506,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,14928383114772286478,7430806004189866475,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,8240700814431975792,10654740118043366395,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,6071415966760024393,5168278381160882688,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,16830790289383916439,413720851494157751,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:14
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,7667228962983821869,8991682838284547867,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,3888257274886777511,7884179933128961483,524288 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,2366100526998269306,9694237001066830060,262144 --field-trial-handle=2564,i,5628473892370492811,2006079812054960410,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1ce83f75fb76a445fecadb766b43d6085a6ee8cb3144d60c3faf86edae249741
MD5 3f8a8fc71c7a037b3332973208a8ac35
SHA1 44ec86843d5cc684a0c75fc3920325e920279b61
SHA512 bf77d587c3dc728f8de7572e9a5a0152ee74acfe1fc191e35f62b13d88a913c0e3d323336f4ee05126a9f0298faf78ae819041b7bac22e488c9d057665650dcd
TLSH
T122E026D505ECC26FA61864CB417CA30D83A3361B92C87A8E1B08C9C870C1550A7E3690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4c7e50767428592f130853026c4aa448a440d930a085971160435309db88ac64
MD5 6a2c08bc9fbfc5e1a0e5a4127cbbfa65
SHA1 14c41d4e73eb2830f44c497a26e5896ecc2268fa
SHA512 8807a981f064f17547d6fa2bb82070d60032d8f3b6a504a20df0a4b18f834b4d6d5f1e0f981a89595de6d5f15d58c4c8c27a0ab085b9cdfcac8817cc26e1ba1b
TLSH
T14951D913036945E3CBA249F3B7F1F54833F5A89BD2CF9E10A442DE759A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6eaa4c9f95a708fe01912adf1dfef01237e53f04837d65a58dc87ea9d1d7a5a1
MD5 eeecf96530cb01f025b2d24eeec52a92
SHA1 edc737d9bb7b11eb7d874e14bd060d38c4867915
SHA512 d4b160c4d6dd882187f9ee2e58c3365a2f22234a4784918a4b837e05b304e00c3986e8077beec2424c9570bab14c88f0d67d21b4b198f58d4c70ada2d03b80ca
TLSH
T1BD51DA13036945E3CBA249F3B7F1F54833F4A89BD2CF9E009446DE759A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8abdab82d4ee4bd9b2f1cee73fd7e32271312b7291eddc13b823e788dd088b4
MD5 e440eb2eff9515818d46593eab72eecf
SHA1 dd090167a4d725e6f54af8e7f1cf146c0925ad3f
SHA512 904510e458a554fe361eee30ccef5e5109aa3b68d187dbe11a17c82f110e5b4fc4ba468b453ebe244759946325e9f0170b31f40e855a8da7a75699ee01e39bce
TLSH
T16E41BCF3C7E8866D890156F0AB147E2BCE1D0915832C3D5AC8E4AF1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9a545dd7ace15c95b3688243737dcb8d36a201ab48b472bdd755783609ddfcfd
MD5 ab812e46b3ee3510ddebfe64242e3e2d
SHA1 0f9a26c1e4f06ccd611eec120b0284004377ea30
SHA512 820d98dfbb201bd505cdfbde8253aac176b2f59532469dc456cfbb9c5fca265c65604624be4a350baf2031c66434ec0e89d94e6c8317ab4ccc2ff3a3f3f6c3df
SSDEEP 192:sxRkRCOx/f6svBI3AtbzoA8p4L/g6+WNIYZFLKjGlIgIJ:sxRkTx/f6sZINW/5ISjs
TLSH
T12332B7166928A93B5CCBD21DBB567F53E6F95032E1942E48E6FC870C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d5c0f4162adeaee0ac36d2f0fdb648a5802af013f8c7a65cc9cc6ed2a9505dd3
MD5 18e515f39565bf8f491e0c2ce7a288d7
SHA1 5200d52a9051d8776f53edfc3bde6be04530e9c8
SHA512 89b4c270bca38c06eb698d27ef45452263b0e8fd0ff698bc59c14395567040627f26ed4117d3210dee5ff816d864b5b83a3a57c81187236f07bf29eb4281aebd
SSDEEP 192:sxRHRCOx/f6swB/3AtbzoA8p4L/g6+WNIYZFLIjGlIgDtJ:sxRHTx/f6sy/NW/5ISNb
TLSH
T14742B7166928993B6CCBD21DBB567F53E2F95032E1941E48E6FC870C14E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 77db1daa75216aa508ba774514f96c06386af95f9348cb932aa6cdc52c2e95bd
MD5 d72c02faedd7fa916363874b6c7ae999
SHA1 91a8521a8873dfc33051d0f704904ba9346cb5e3
SHA512 161d470e46c03b2cd10610421e5d4a3981b25fb9a7b4de965f9f0f21ac9e7baa35cca666a9afd28457ea82315b81bb2649f5abb1fe95002213d78e5e834983fe
SSDEEP 192:sxRHRCOx/f6swBI3AtbzoA8p4L/g6+WNIYZFLKjGlIgDbJ:sxRHTx/f6syINW/5ISjx
TLSH
T1ED32B7166928A93B5CCBD21DBB567F53E6F95032E1942E48E6FC870C04E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c99eef78-4a0b-4259-9a71-270925161d96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c99eef78-4a0b-4259-9a71-270925161d96.tmp
Size 23KB
SHA256 ad93b5f1f5ea786a881a1a018ba50da7f90865fc665b8698097a5690713d663a
MD5 fbc9b8e2a67d60471c33301da4cb828a
SHA1 b8036c71510accb81667b8f098e5f1945d0e1d59
SHA512 dd361472f16bcda23e31fc34a7c9cd2f633e709d23a3896ce97467de3aafb7a2ff08cf8f7f9e7e25dce2d151f3c57194516e5617c33121e865d7b49fa7457d49
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGAdrocs:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0Vt
TLSH
T1D4B2CA3B640DCB7E5F800AADAC196FD77DA802C7A6588D4047FE994C02C77EA911A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0a95f05-1ef0-4154-af74-2a290e34e95b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a0a95f05-1ef0-4154-af74-2a290e34e95b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5092ff67d25d2494acad095f6595234eddb4a488b2d68c402b68fc7f072de248
MD5 7dbe5d7a32912d14b5fca95b60e61d26
SHA1 79d6d63ed1b9b39459886e2ae0a0c3ca7503d914
SHA512 9774de653f563d6523f014775cf7b6f872bb451e76d0afa89fa44e4d14e2100d62922ed7ad8c7155c03b348e3fe48be72f96522debc7c5dd4cac613f2ec72bcb
SSDEEP 768:3j+9H3qp+LeSFOU1qWX4fouOToPvB2thtA9VAgzMjf:69H3/snnwthttGQ
TLSH
T17AF2AE72A8A98D63DD95C299720B73566FF04163D6C01FC89EDC6F0D0AC76AD470BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bae0967f6057b3c2e992d504400faf60c56e86dd18e051a0936cfb13dc22c01e
MD5 4447839326e64e0246ca839f2285c19d
SHA1 f563a5b6cf5e6390eb64d5657858089b23b8bd81
SHA512 2d6ed6922c9712fdf703fad4b32c2bbda4e717e1e375e21aee1677e1bf3c5b319f6c01f6cd936f183cafa05518b22c137228f6039af5a637ca4cdf47fd500426
SSDEEP 768:qrv+4UNbdx3Np+LeSFOU1qyX4fouOToPvB2thtA9VAgzzU:qbsbT3YsnnwthttGzU
TLSH
T13103BF72A8A88973DDA6D295720B72537FF44153D6C40BC49EDD2B4D068B9EE070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 46477b06f8b17856163898a3769dfafaac5dfdec9ff7ca80f1e53ce938f9cea9
MD5 170f67c3daf08501a039d68503369c4d
SHA1 ea5d5af55695453af39fc4ecdecec4f02bf5f770
SHA512 42f5b1a7f51e18ad80536d81a7d5ff775e9deab2f5d24a62fca6497125fa153af0b66597e64aa7c3f7dc5217fffcd7a3c4e53581cc7111fe93bf04466d59dd24
SSDEEP 768:cj+9H3hp+LeSFOU1qWX4fouOToPvB2thtA9VAgzMjf:79H3QsnnwthttGQ
TLSH
T129F2AE72A8A98D63DD95C299720B73566FF04163D6C01FC49EDC6F0D0AC76AD470BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1fd87d9c1f35d72e05d5d8d8a25ff2f5471e59bb0cdd737c000571300d5b6a5f
MD5 00bd64de717883cb65a96636c59f05aa
SHA1 9e30a9374cdc269b7dd5248261fa555803bb57d4
SHA512 5074cc5514c5a2cfe70df06fa1eb864678594ae64ca54fcb3b96fe59edbff1c3f180ca7f1152faf0a953fe212ee8d139a37f884f4e5e1511d40c65957cec3334
SSDEEP 768:4F1j+9p37wgNp+LeSFOU1qKX4fouOToPvB2thtA9VAgzMjf:19p3GsnnwthttGQ
TLSH
T1A7039D739898C967EDA5C799B20B72529FF041A3C5C05BC4AFDC6E0D05876ED430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b26764600f20dbbafeab0ae47f587b2aade9de6130aa7a4fe14c464cbc74ad13
MD5 e48769bc096da80f39cf93a66bf90c7e
SHA1 6583106e087dcd5b781c61723e3153ea735c9f0a
SHA512 182baa2113a4d6324ea62b63b98a06e5cfcd9d2b848dd036f6b06bf2e6f2870d26389dbdc4b82ba8a27568102d127361028975068f9a24cc138c7c03a88e9f89
SSDEEP 768:grv+4UNbdH3wg+LeSFOU1rX4fouOToPvB2thtA9VAwKeVH1SlX:gbsbh3ksnnwthttPEH1Y
TLSH
T1BE03BF32A8A88933DDE6D398720B72533FF4912396D00FC499DD1B4D069B9DE470BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b585e8d-7615-4853-b788-c0b7040a8efc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b585e8d-7615-4853-b788-c0b7040a8efc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

PCN-CAA250156-.zip.crdownload

Path C:\Users\Admin\Downloads\PCN-CAA250156-.zip.crdownload
Size 65KB
SHA256 768150f1e063fd293e7e6c1d93b3412432b07cc83eb12c9c0b2ac6424852e853
MD5 dc22f053f52a15694cdb5fe53756db5f
SHA1 f79e34596802d92bd5dce941f22bf413066bdddc
SHA512 57e194b8610d0d00549b510404f3d805bfca1bb909fd0dc8f2f7b132cd91b18d48eb38ebcf685628d57436463cd8c1eb72367ea977f414061a01497b4ce5fc38
SSDEEP 1536:38jjL6x7kvQ0BZk/SsLxZUpWubGwqImOzmUuvI33nQWt2A8ixS:Mny7ow/RLxZUrCwqImSovInQem
TLSH
T19E630202C2719ADF65B3C23A4CB3024DBE35C935099D96DA1BB12CAA71A5B74BC7EC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download