hxxp://flowcode[.]com/p/eMenkOInZe

Resubmissions

27/07/2026, 14:31

260727-rvn3lsgj5z3

27/07/2026, 13:39

260727-qx8pcstdmf3

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://flowcode.com/p/eMenkOInZe
Sample260727-qx8pcstdmf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296331857831164"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1EF3033B-05CF-4253-8112-4291ACF7C788}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5304	4116	msedge.exe	88
PID 4116 wrote to memory of 2012	4116	msedge.exe	89
PID 4116 wrote to memory of 4804	4116	msedge.exe	90
PID 4116 wrote to memory of 4804	4116	msedge.exe	90
PID 4116 wrote to memory of 4804	4116	msedge.exe	90
PID 4116 wrote to memory of 2404	4116	msedge.exe	91
PID 4116 wrote to memory of 2404	4116	msedge.exe	91
PID 4116 wrote to memory of 4972	4116	msedge.exe	92
PID 4116 wrote to memory of 5720	4116	msedge.exe	93
PID 4116 wrote to memory of 4972	4116	msedge.exe	92
PID 4116 wrote to memory of 4972	4116	msedge.exe	92
PID 4116 wrote to memory of 5720	4116	msedge.exe	93
PID 4116 wrote to memory of 5720	4116	msedge.exe	93
PID 4116 wrote to memory of 4812	4116	msedge.exe	96
PID 4116 wrote to memory of 4812	4116	msedge.exe	96
PID 4116 wrote to memory of 4812	4116	msedge.exe	96
PID 4116 wrote to memory of 3908	4116	msedge.exe	97
PID 4116 wrote to memory of 3908	4116	msedge.exe	97
PID 4116 wrote to memory of 3908	4116	msedge.exe	97
PID 4116 wrote to memory of 2340	4116	msedge.exe	98
PID 4116 wrote to memory of 2340	4116	msedge.exe	98
PID 4116 wrote to memory of 2340	4116	msedge.exe	98
PID 4116 wrote to memory of 1172	4116	msedge.exe	99
PID 4116 wrote to memory of 5028	4116	msedge.exe	100
PID 4116 wrote to memory of 1172	4116	msedge.exe	99
PID 4116 wrote to memory of 5028	4116	msedge.exe	100
PID 4116 wrote to memory of 2980	4116	msedge.exe	102
PID 4116 wrote to memory of 3400	4116	msedge.exe	105
PID 4116 wrote to memory of 3400	4116	msedge.exe	105
PID 4116 wrote to memory of 3400	4116	msedge.exe	105
PID 4116 wrote to memory of 1104	4116	msedge.exe	116
PID 4116 wrote to memory of 5924	4116	msedge.exe	117
PID 4116 wrote to memory of 5672	4116	msedge.exe	118
PID 4116 wrote to memory of 228	4116	msedge.exe	121
PID 4116 wrote to memory of 228	4116	msedge.exe	121
PID 4116 wrote to memory of 5212	4116	msedge.exe	122
PID 4116 wrote to memory of 5212	4116	msedge.exe	122
PID 4116 wrote to memory of 4704	4116	msedge.exe	123
PID 4116 wrote to memory of 4704	4116	msedge.exe	123
PID 4116 wrote to memory of 2752	4116	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://flowcode.com/p/eMenkOInZe
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc0e42c188,0x7ffc0e42c194,0x7ffc0e42c1a0
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12551880143061849580,13832195639631096924,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14448490011973640204,15140109609869244073,262144 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,14724338642068801171,11366142674056015175,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6873704145491596507,1264534797783350437,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13368831979279105003,7844112797902580026,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,13690325269882756663,7412272403540538637,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3672,i,7951319234803948382,4810555113574354103,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,1271702847968879709,12393649792191106908,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9993093930103254571,5773306719837737453,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9746835086064974019,7148641439031397868,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4662845560083977531,1536386397153681715,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4662845560083977531,1536386397153681715,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6468,i,3181769592173170287,13163937686057467161,2097152 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5432922955671832465,14404103721525037990,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15716861016666063620,872585171380677323,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,8897643612621714307,14856275202372223471,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,12940316944360660390,15522682935642858658,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,5194792475103165060,8667916071881480566,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,4734440548626535512,6016628249087632719,524288 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,10803398455854644261,7267807466915338333,262144 --field-trial-handle=2220,i,11594292073308087337,13352808428409026222,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 7205f82f1744667d1bed9ceb406eb9da8aa68fc877725e962bf31c18be42652f
MD5 d03e0ac61cf95cbf4f00b93a07e4a5a6
SHA1 a169d54ab4f579a22fe53ad4e9863f34b19b5a74
SHA512 8942bf3a5f68ee51f475790ec4a40db486179c0e6381e7c1ec3bc14f03eef2fffa3a69bbaadb8ac022d61a122139abc9d396181663d7af8203b08f823b4b389d
SSDEEP 192:Zjg0xqNUUZmmX66jZPMsL8BfFoIKLEGifuKqhAeh:Zjg0xqNUUZmmX66jZPMsL8BfFoIKLEGN
TLSH
T191F1578386D5D3DA9B25218A4DA8B35C50713709EBDCD608139CCDED718E8DBB6F2690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d72b1f4b7ab5a912dd00b7f54f3ac80a70c9dd5e90b61811322e25faf50b2863
MD5 ce83e3ba1e209609005dfd0e30ab16e8
SHA1 330c73672e70d68b86da958c91894de794235fb5
SHA512 d1b040c89cfd6ec40ceb8820329313086a6cf7039d35dd565e3360b4eb970c5a94f0cfbdcaefbcfe0ef76b12d7cba2e39f199171b530a7f2725f89d97afa4705
TLSH
T138E02B76C821EC3B0CFD471860498756E70113172644895F3A3D81898FB062A45C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eef800695aefc8aaf98cb27e9e65ba1d3a1d4e230c6e01fa22cc5974baf35b95
MD5 47ab0475b101637f242154db84b244cc
SHA1 6e433f8d60dc3b367791f81fa46aabab3a1faf3d
SHA512 06e823b3598f14740de44a67f45045130f2c0f81d115541455d30ffef9b971a4820f75ca4c904e0aa23243175ecaaa5e4e5e205521c1b0e7b123735c5176a5da
TLSH
T1078194380B960CA2E7534F3186D231E5F63A82FAFDEF4D971F20A8315409795897D92B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585e57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585e57.TMP
Size 3KB
SHA256 d47dba8ec1f200fe21523c5e15d3a215ecbca6cb21549df0b98690c87ee0681a
MD5 0c7760ee0a5319e4682428e3f53ca89f
SHA1 b629b6077a2598f69624f1a9ae66ba5ee43aff95
SHA512 5929f892107af9d1a05260ab4e81906b7f6fc2af42bebbc45b45e4a2aa7fa4db4c3fbf139c8a3294bf3977ff4967536d5fee0d6ca32865a7491c805489003832
TLSH
T1A981A4380B960CA2E7534F3186D231E5F63982FAFCEF4D871F20A8356409795887C92B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 adb91dd56df56d3004e32fcf3313803d0e3f4b10d0494d0a2ddd24f40418452c
MD5 25b46d13b52e8671acca58b5dcef50f3
SHA1 7d1cbcbc02c9caf7b4a3dbb54a43c00e7943bc44
SHA512 a0e15bbcc27b9f45b92bbf6922ebee38ee01b42174d75713ab84fbd01fba06b763ac7b8c7906b0e2c50100246ea34e7da850873565771a4014d38180314ed6cf
SSDEEP 48:YALlgyDPNsOPVbBENBEfPBEXBdZC8Nafo7gmgj6AsZPJsnBsswrBQsvVzEsoBVsA:D1uO9Y+PgZLaaij6xU4Tzk51flcGwQ
TLSH
T12181DFF3C6E8862DCC515AF4AB54BE2BCE2D095543283D5A89E4EF4BA3D2171D20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24f0292b6e0dee79377a3941ac474239a4f4f8e1a16f4ce87c0c23add7ec5a4e
MD5 d785881fee0b4f2f84926ecf3de9d824
SHA1 fd12de37405b5f53bad8616481cc5c2b32c7cba0
SHA512 9e6db31a638215450aae57934025547da66df08a68c9a9faf608125b51c21ccfcff93c6bcf02695fed1156e85ffec2435ed2c6e3deb77d2a8d0a08836c609992
SSDEEP 192:sxZdRQyMqZjK1Ml8UQvk3/fXsuazZd1zodpqbJHW6+WNtZZ/YvezNeQKIg5vaJ:sxZdBqc3/fXsu8zeuHbB/NqRW
TLSH
T1C862F81A6A34497B8CD7D209F545BB53E6F91533E2948E4499FCCA0C04E7BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a89931f4bc6cec1a04dda6378aba35c0754304a28e670caee8e564ba4e9ba5e5
MD5 e1e33b3f7c014bb7fe2a58785d06ba36
SHA1 f124f2dcd06a564d47f2ce906e3497885316231e
SHA512 c9e087b95cb483e14f4468839954c42e592c9eadab6d273e64febff164e21faa82737e3a65edf3f3cb2397efdceade41b554974e7b43709017396f6e98ec9d33
SSDEEP 192:sxZdRQyMqZjK1Ml8Mk3/fXssWa7aZd1zodpqbJHW6+WNtZZ/YvBuzUeQKIgjaJ:sxZdBM3/fXssWSazeuHbB/UqjW
TLSH
T1D062F8166A34597B8DDBD209F645BF53E6F91523E2948E4499FCCA0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 1446bf9916822086d6e551ed8395dfbbdae597cc2ba4e7e538f9dce06e3e6d6b
MD5 554c283eb0755fab176ad04130dcf605
SHA1 06824056531332a2e721f1863a1f2c76080c1baa
SHA512 1c0c69bf5ce0e932bbe317bc4667aeca4dc0064b9fcce70e6f66b38699a5e6b0a79eda98cf5b0f8a2c491becd3f36c34a81a48a15c0119fe5771a0f925e60306
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGz:05ppxnY753RNBvRJJdt7p5J9bPvYNg
TLSH
T1A7B2585A703E0211397E3988B39696364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 cd4d45a68929009e41efbcc2e2c15d961b90656a29f3cb948d2861e874f6c97f
MD5 606af0bfe63510a68c5d94f9f62b8d7b
SHA1 391b731786db007779322d7d5fed846baae1e445
SHA512 8d57d475de42c0ffedc17c59b60e395cd3d64bbd1fffaceffe899da1a66cc7f5c31b1e2d33b1f2d92d0e682cb246f9721e8f01aaac16af076409ae89b3ebec86
SSDEEP 384:nhiFiZcIVxDsNe8TUNTUlI4FQckCralApvtfxGp1UanuMX+jW9FOObjI9G6w7Eca:IFQjrwgckrGXGp1UhMXMW9F29Mk
TLSH
T150F2D4F698E78976E8AE4B97A77E2D029EFCC153B5884984B7D85D0CCC460BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 52802c8f3938c5894a435084cf153646378b58d5251671e14d78fad4a93e9e47
MD5 1bc430c02db698159d820de80dabda5a
SHA1 2ddb7da7ef1392f4eba14084fd06e06da3ee3512
SHA512 f5ed2d8cb85f02d7a6ff0b00c1ed1a60b70888bb9b80ce739b6b895a7098e790374f0dbb8304ff6f8e5c7b184dcb51e5c843bc178502ad45228f4639b7d848d8
SSDEEP 384:nUiFiZcIrDsNe8TUNTUlI4FQckCraOApvtfxGp1UanuMX+jB9FOObjI9G6w7Ectw:vFQnrwgckkGXGp1UhMXMB9F29Mk
TLSH
T143D25B36DC68CA7BFCE78B95B74A3903EEF45167C69C9AD4E5D85E0C00974AC030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4637d42d7c2c7b4acb76278b093cab04af22200d22e7f83b74e74185d83a67ed
MD5 6739d66a0adc4821f97d8bfac8c9d169
SHA1 ee2d8d3e9b07f0bf0529ea1ad0caef7475baffd6
SHA512 804cb73b30ea71d11ef16d211170587a0b604eb9afb5b0d6df71d7f4741f7b095d2aaf94b5e45bb406ff19d81579cac20982fbf1ab179c974b0e83cfd99a508f
SSDEEP 384:npaiF9CcmyWC1R3sNe8TUNTUlI4FQckCrkj7ApvtfxGp1UanuMX+jR9FjXaty/7x:pRFccp33rwgckX3GXGp1UhMXMR9FjXJ
TLSH
T12FB23A3ADC68CE7BACE74B89B74A7543EEE45153C68C9AE4DADD1D0C009B19D030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 82ba4f7c5b1aa029501ce1185de72035a86ac8998f56816b529c8f53d08d801e
MD5 712853242da9d210d82d78f01767e2b9
SHA1 c3a76abd2d9289e8de85d2fa21b91f367cd30fcf
SHA512 c2a6af2bc5e97604fd57e6631cf2e9f328d61ce319a3736821348aad2a733fe2fb46bd602c5762d0f7cfe174bb6b91ddac79c4f128324b0b9565cfb7c640a536
SSDEEP 384:npaiFiZcIrDsNe8TUNTUlI4FQckCraOApvtfxGp1UanuMX+jB9FOObjI9G6w7Eca:pRFQnrwgckkGXGp1UhMXMB9F29Mk
TLSH
T1CBD25C36DC68CA77FCE74B95B74A3A03EEF45167C69C9AD4E5D85E0C00974AC030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f382e45444e2c7438b1e6a380571c21e3bf221e8abb4086084fa86c3e3522f9a
MD5 d8307217aa7ac4e1838906275bbc3781
SHA1 7115b86c2521f0127cf2e279ac12573c51b1eb66
SHA512 c8015e1f1330e10be9cd4b29cb6cf12e9a2cefd821435f5ebd599f16fb679307d88514260efcb33fd2ad407609ff8b5c534f5864d35b7aa493d03c5cb2054c6e
SSDEEP 384:npriF9CcmyWCs3sNTQ8TUNTUlIm2QckCr9lBUKpvtfxGp1Uan1bhpye4KV8p00LQ:pGFccps3BwgbkUHUkXGp1UwbWI8p00LQ
TLSH
T117B25C36EC68CABBECE74F99B74B7A03DEE0116785D859E4DAD85D0C009719C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2aa8485c764b3727f5f5b1f5fe736992dc09ffd09df59175b19dcdaaef8f0484
MD5 fd9f35f2384ebc0dfb05e6cfc6670a55
SHA1 689c82c2fb4391f8782660e511d5c3725e03028b
SHA512 c2e17f0f124bea34c85c49493412b8f03f287aa986e4ee80144ea94b67bcf55d93aa0e2e9c07b91e1766bad2494f7b05b2168f87854317761ea0f30886a191ae
SSDEEP 768:ppFccps37wgbkUKUDXGp1UhMXML9FI8p00LQ:Ts310c1iX6I8p00LQ
TLSH
T138C24B36EC68CE7BFCD34B98A74B3943DEE45157868C9AE4DADC1D0C109B1AC530B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ad741a5b39e0e5d549c227288c4f4ad900fb3ffa911a2aaca1d338a70726848
MD5 6cd8be74801ddbc7d460e158f843a516
SHA1 4cc08b22b8a2084efe9a66a21845182df5235974
SHA512 fc166e5c038e722d4bfeaca426ff02f308a04e42e224ce1c144751792060aef93983e6447290c243c3abb75f4fca59c45ecff15d564c34128a140e0dd64e35db
TLSH
T15941E75CB6F91148F3B7BE5A6BF6A96D447EBC362E0BD09D00510D4E0A63A44C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2980-218-0x0000021BBE140000-0x0000021BBF140000-memory.dmp

Download