hxxps://trackingservice[.]monday[.]com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYWxwbmllY2FwaXRhbC5hdS9mbGllcyIsImVtYWlsSWQiOiJkOWE5NWNmNy02YTczLTQxNTUtYTBiNi05OGE0MDI1NDdlM2EiLCJpYXQiOjE3ODM0NjQ2NDN9[.]ka_Ev2FwM0_Jig9dmF7-7j-PpdVee3MMp_9g2E3QPiQ&r=use1

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYWxwbmllY2FwaXRhbC5hdS9mbGllcyIsImVtYWlsSWQiOiJkOWE5NWNmNy02YTczLTQxNTUtYTBiNi05OGE0MDI1NDdlM2EiLCJpYXQiOjE3ODM0NjQ2NDN9.ka_Ev2FwM0_Jig9dmF7-7j-PpdVee3MMp_9g2E3QPiQ&r=use1
Sample260727-wvb59sbl3v

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
79	4492	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296496699655652"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1428C27C-6829-4ECF-B392-5F5FBE08780C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4656	4648	msedge.exe	85
PID 4648 wrote to memory of 4492	4648	msedge.exe	86
PID 4648 wrote to memory of 1960	4648	msedge.exe	87
PID 4648 wrote to memory of 1960	4648	msedge.exe	87
PID 4648 wrote to memory of 1960	4648	msedge.exe	87
PID 4648 wrote to memory of 3008	4648	msedge.exe	89
PID 4648 wrote to memory of 3008	4648	msedge.exe	89
PID 4648 wrote to memory of 4976	4648	msedge.exe	90
PID 4648 wrote to memory of 4976	4648	msedge.exe	90
PID 4648 wrote to memory of 4976	4648	msedge.exe	90
PID 4648 wrote to memory of 1524	4648	msedge.exe	91
PID 4648 wrote to memory of 1524	4648	msedge.exe	91
PID 4648 wrote to memory of 1524	4648	msedge.exe	91
PID 4648 wrote to memory of 5964	4648	msedge.exe	94
PID 4648 wrote to memory of 5964	4648	msedge.exe	94
PID 4648 wrote to memory of 5964	4648	msedge.exe	94
PID 4648 wrote to memory of 1648	4648	msedge.exe	95
PID 4648 wrote to memory of 1648	4648	msedge.exe	95
PID 4648 wrote to memory of 1648	4648	msedge.exe	95
PID 4648 wrote to memory of 5216	4648	msedge.exe	96
PID 4648 wrote to memory of 5216	4648	msedge.exe	96
PID 4648 wrote to memory of 5216	4648	msedge.exe	96
PID 4648 wrote to memory of 1676	4648	msedge.exe	97
PID 4648 wrote to memory of 1676	4648	msedge.exe	97
PID 4648 wrote to memory of 3312	4648	msedge.exe	98
PID 4648 wrote to memory of 3312	4648	msedge.exe	98
PID 4648 wrote to memory of 5668	4648	msedge.exe	100
PID 4648 wrote to memory of 2320	4648	msedge.exe	110
PID 4648 wrote to memory of 2320	4648	msedge.exe	110
PID 4648 wrote to memory of 3840	4648	msedge.exe	111
PID 4648 wrote to memory of 3840	4648	msedge.exe	111
PID 4648 wrote to memory of 3840	4648	msedge.exe	111
PID 4648 wrote to memory of 5244	4648	msedge.exe	112
PID 4648 wrote to memory of 1208	4648	msedge.exe	118
PID 4648 wrote to memory of 2524	4648	msedge.exe	119
PID 4648 wrote to memory of 5272	4648	msedge.exe	120
PID 4648 wrote to memory of 3536	4648	msedge.exe	121
PID 4648 wrote to memory of 3536	4648	msedge.exe	121
PID 4648 wrote to memory of 2848	4648	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYWxwbmllY2FwaXRhbC5hdS9mbGllcyIsImVtYWlsSWQiOiJkOWE5NWNmNy02YTczLTQxNTUtYTBiNi05OGE0MDI1NDdlM2EiLCJpYXQiOjE3ODM0NjQ2NDN9.ka_Ev2FwM0_Jig9dmF7-7j-PpdVee3MMp_9g2E3QPiQ&r=use1
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0b8ec188,0x7fff0b8ec194,0x7fff0b8ec1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,9088069576325467899,10233916912192566763,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11100353012015284429,9353219354527795196,262144 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,2429460593865223576,16533532980325850512,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2188709339953026051,6528758803072675941,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,8070814725378327071,13757958738185511922,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4796,i,5521926664220028956,12910657458392072704,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3600,i,12904841826083001959,3632634543217628379,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,5960253505293698351,10974024687858813554,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8228820915160646857,16650063101854134339,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1067808430944807407,10681846257627111811,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9309743828945039162,887050678575799394,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9309743828945039162,887050678575799394,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6524491336043958155,14091905489980693847,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6716,i,14483355439082526583,7346840015140308332,2097152 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,5762894049821052979,18072844689702920292,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,5131368550507034836,18084854418122131314,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,4880875843141141949,10933956354490405341,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,14201767388810155673,491251733640208983,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,7390408715733321735,5505471049571093339,524288 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,3502700371276053575,1245437698820353222,262144 --field-trial-handle=2592,i,13279718552925270991,2721171342846867533,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ceaa64c-9908-422d-811b-5ce471b0aec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ceaa64c-9908-422d-811b-5ce471b0aec5.tmp
Size 28KB
SHA256 cb149a0a90dd9d7ffe9237be1bd26a246fb23d5a914d994872252935dd837032
MD5 83f6155cf56584349512b93b7c52f97c
SHA1 f4742c1b0b842374ba1d31f133a9e6d1656ec0bf
SHA512 37fa788ea0f4cb7af5cc0be567683531bbcf63f4c657e917bc312f8c985492f8c52848147b63dcad2c70ec793f17cdcbca7c59704f222050a6abd6ae5796f9f7
SSDEEP 384:np8iFiZcIu3sNs8TUNTUlI4Q/QckCrosHuphiftGgEM9Dg9gmtRFdhEQOObjI9Gu:pnFQu3twgHRkYwoGgLggmXLhEQ29MKT
TLSH
T11CD25B32EC64CAB7FCEB8E95B7493A13DEF44167C69C9AD4E5D95E0C00970AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 249211e054c20c78badc2ccd81cbe820fa3f1a56cd6ca07098fa0213e22a7221
MD5 10f490779614302eb4a365eb312858df
SHA1 e6f97362baaff999b8bda256cf5283fb94a507b3
SHA512 176dae61dab9a44897c043232154a5cae6ef392500a2edeaca0c9702ecbca51639b06c09697ab9ceb48157be0b401aa3e012ed79d2bfd74a07adf65f0764da39
TLSH
T113E02B7ADC61EC3718FD0758A1095B4AE70123272A41495F3A3CC20C8FB062A95D6D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d00c2548c4c6bfd3bf58bd36280aa336b503eeda13b29cda70effbca9f7a48c
MD5 6aca6d5b2626a9811406618ef064ef1e
SHA1 310d367a3d8564e21d039d27d61e984a2f378c9c
SHA512 eb9a0a1b553188a8c884c6a1b68e5789a52c9913652c68c2b2883798f9244cbd840a1d975e97c1c0c1390414a59edb88a71dd6d11b126b52f5d3248c2bdcce4b
TLSH
T1CB7150F929D224B0EB900631D2D115D93872CEF9F557DE96DFC46470260AB638DDC907
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 56fe09241929b6824644c413c4273207f96a8a5e54f05d12671a841fefd87494
MD5 ce38a2a6c21c2827810f9fd8c4b69b0a
SHA1 3ef4141b0a6bd4de2cd7d2ba3f5cca0e7614639a
SHA512 7f1e4adf5849c88a64679191a7ce743e0d6e63a3d8c0459ac150d9a81508d9faf4b38ba071f3bca726a4ec777f3d4e63856902fb9a9b4e78f256bdbef9be2010
TLSH
T139718DF382E88A6E891252F0AB15BE2FDE1C0914533C3C6AC9D4AF5BA7D7470D10565E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da4467bbf3b852cf466a9f6889e9a35ea68efdc534ce73fb803e746c70d265ca
MD5 d74833353fa7e98945ba7969caede027
SHA1 a269e228bed336008541b39f4add9733440a7dc8
SHA512 0ea74522c574e54a3c4117204bbd4181f67cb91c0e728ee043af3b9677dd9e2014e556f8f211d50b8ffafe2d0fa19b0af5a5ba69df98d249d1bfc6823d74caac
SSDEEP 192:sxZ7SR3yMqZjK1Ml8M9n/fHsExRO7aZd8zodp0kHW6+WNFopXYvUucx/SIg5RyJ:sxZu01n/fHsExc7azfZHbyXVabO
TLSH
T1A062E81A6A349977DCDBD219F645BF53D6F91123E2905E44A9FC8A0C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3f562c1ad345ab5231295a8b57204306d6003de901119fa869db1bf560ce562d
MD5 9d05ce36c023a5bc51d35338c9fb4efa
SHA1 0bee707a66888bfa7f5aaee11d4bed80422aafd0
SHA512 391c7fce64d3aabc8b62eed61e8ef4e3e7b84e7e02daf8aa0f9200383e5b4c7a0c1740548c66973654d4cfdee78a09196144e971b1d7cf79ce18e7e8c3473261
SSDEEP 192:sxZ7SR3yMqZjK1Ml8UQm9n/fHsExRO7Zd8zodp0kHW6+WNFopXYvxcR/SIg5RyJ:sxZu0qgn/fHsExc7zfZHbyXdabO
TLSH
T12D62E81A6A349977DCDBD219F645BB53D6F91163E2905E44A9FC8B0C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7b9a14a89a9fbc6b425d134e72ac54d637c12774f63df3f9008454b7a1351552
MD5 66fee6d0ad42adbef8dac64d3441309d
SHA1 0230300100ad30d690056a1fe3793f2387b6d7a3
SHA512 8ffef3d2c4c2f03c5954c6d021098982082e30e3b20fcc6222ca2931402e88a12d4a9544757ca3c9a415005a2ea5f0e73f42b2683703f25a5b280e313060a087
SSDEEP 192:sxZ7SR3yMqZjK1Ml8Mkn/fHsswxRO7aZdGzodp0vHW6+WNFVy/YvRucx/SIgjyJ:sxZu0Mn/fHsswxc7az9GHbS/8ajO
TLSH
T16462E8166A389977CCDBD219F645BB53D6F91163E2904E44A9FCCA0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 139a6cea8d44ed812be57d8af83956608a47c81e28fb4d54f3500c107aa1b379
MD5 e1ec6c3330c59878a6a71f06d93ba3c4
SHA1 ca8150b88b54581e59b9e5aae1d12066863abbb5
SHA512 726e0f1c16de08d061461adf5a4acf0785e39862ad60322a40c602f906b468c06a92a98d0861ca3c40d069e98ac1f64787feb4b63e460673dc3b2019a5b684f4
SSDEEP 384:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVBtTChBG7g:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVO
TLSH
T12EB27A5A703B0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6cedefecc0090727c0e4ddf323d703a0c14dedbe0fdd36923edb636b5bd71d02
MD5 045977256897380c75fd2af79d470dd1
SHA1 8c84887ce3c77950cc7fb1b56f7ec51ca0618f64
SHA512 e278f5af88ee260f842ee30d3bb1f4017f68315d5d4d40775775eae95ec1c8b275d3624f952c57d181e7831f94569bbf7ad0414d64a5ffcaa2729200b203f8c5
SSDEEP 384:nhiFiZcILI3sNs8TUNTUlI4Q/QckCrdvHuphiftGgEM9Dg9gmtRFd9YEQOObjI9D:IFQ83twgHRkywoGgLggmXL9YEQ29MKT
TLSH
T159F2A1F298D78976E8AE4B97A77D2D029DFCC113B5985A84B7D81D0CCC960BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5656f58f00232dbb0a9bc1c01de19370e691189b1f3ea1dc57c7330415979fc2
MD5 bb47fc4119bb08314fb86de09f8ff110
SHA1 b4236c9dae8f86b7a37e4b24b1861a32ac88a9a1
SHA512 ba3bb1cea66c8e07bc169eca0827f40d68fc5ca4f6df44b2cd6c7e790cb96fa9dc82d69fb48d499ad26f07202b21a000a160fd6906ab96f4b3de8f5a0f1793c3
SSDEEP 384:nHiFiZcIu3sNs8TUNTUlI4Q/QckCrdsHuphiftGgEM9Dg9gmtRFdhEQOObjI9G6d:CFQu3twgHRkBwoGgLggmXLhEQ29MKT
TLSH
T1F8D25B32EC64CAB7FCEB8E95B7493A13EEF44167C69C5AD4E5D95E0C00970AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 911c9ad8f12dfeca10a24629c64a1269b45cc7c29d4d03b1bcd1f6b4fde555cc
MD5 57a1d858c01f759b820335af1332bc98
SHA1 319ea2b5ecad2e4d2c457002ca7591ee4e07f53f
SHA512 c819cd3e18f5371aa8b1d0d5b64f783673828c94ca88197c368455519599f28611e0bdc746a39cd07d9d4ec81f05b9e46d85fe745b42034da6881b9df9b4c580
SSDEEP 384:npIiF9CcmyWCs3sNy8TUNTUlIm2QckCr9lGKphiftGgEM9Dg9gmtRFgIpAe4KV8x:pTFccps3DwgbkUUkoGgLggmXO9I8p0KX
TLSH
T121B26C36EC58DEBBECE74F89B74E7A07DEE41227859859E4DAD81D0C109319C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 652416bed85b9a9889864ece4b6c460e58abbb1f4f33f30c78a43fe918e313b8
MD5 5e6612eed9ea5c341367742a2293b73f
SHA1 44e32713166ff03be445ac1fcb525cf75f422b6b
SHA512 8155633a1fa308af1fc9f256f9d85e48bba1ad31ef7e300c8b9ebcfa1f97ddafe950a1ad6370ac391ce648eb58caffa9e26a6edb794378fb8d2b5dcfd9bac2bf
SSDEEP 768:paFccps39wgbkUyxoGgLggmXLfEQI8p0KX:8s3HaeX+I8p0Q
TLSH
T1CAC25C32EC58CABBECE64B99B74A3903DDE44267869C9AE4DADC1D0C10D71AD430F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eea5fe0a446bd1a6d9b6bcf9104baa5748064e417142d9886d8b7b99a1814156
MD5 797686a761a9c99e17ebc8e8d969881d
SHA1 913a7479e859c1ffd9868e019fe4b81f4474ea3b
SHA512 b41cff7e6a322e0457eaf3ff56e225c9bb1b9b660502cb4a21ab463915d975c8b4fd66aa0f51b00208b7232a20af5982fa5d3b6e9ca2c5a599d1e3469244e943
TLSH
T14E412698A7F91148B3B76E169BF7A8AD447FB8372E0B949D00010E8F0627B45C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5668-210-0x000002DF16EE0000-0x000002DF17EE0000-memory.dmp

Download