hxxps://web[.]plaud[.]ai/s/pub_b336e8aa-3e93-412f-afb9-a9ffb0a63f47[::]SW9mO0pYzcjrI_qED6ZRMxbsCMltzT0yldbIvAXSylLD-60_xPxxPhvjpBeEizcyIy3W8qjqn1K4D5wC

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.plaud.ai/s/pub_b336e8aa-3e93-412f-afb9-a9ffb0a63f47::SW9mO0pYzcjrI_qED6ZRMxbsCMltzT0yldbIvAXSylLD-60_xPxxPhvjpBeEizcyIy3W8qjqn1K4D5wC
Sample260729-tpaddabl7w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298152177631241"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{DC4B25A9-6097-4431-B124-24B859587064}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1500	2784	msedge.exe	85
PID 2784 wrote to memory of 4276	2784	msedge.exe	86
PID 2784 wrote to memory of 1988	2784	msedge.exe	87
PID 2784 wrote to memory of 1988	2784	msedge.exe	87
PID 2784 wrote to memory of 1988	2784	msedge.exe	87
PID 2784 wrote to memory of 552	2784	msedge.exe	88
PID 2784 wrote to memory of 552	2784	msedge.exe	88
PID 2784 wrote to memory of 832	2784	msedge.exe	90
PID 2784 wrote to memory of 832	2784	msedge.exe	90
PID 2784 wrote to memory of 832	2784	msedge.exe	90
PID 2784 wrote to memory of 4224	2784	msedge.exe	91
PID 2784 wrote to memory of 4224	2784	msedge.exe	91
PID 2784 wrote to memory of 4224	2784	msedge.exe	91
PID 2784 wrote to memory of 4728	2784	msedge.exe	92
PID 2784 wrote to memory of 4728	2784	msedge.exe	92
PID 2784 wrote to memory of 4728	2784	msedge.exe	92
PID 2784 wrote to memory of 972	2784	msedge.exe	93
PID 2784 wrote to memory of 972	2784	msedge.exe	93
PID 2784 wrote to memory of 972	2784	msedge.exe	93
PID 2784 wrote to memory of 2988	2784	msedge.exe	97
PID 2784 wrote to memory of 1808	2784	msedge.exe	98
PID 2784 wrote to memory of 2988	2784	msedge.exe	97
PID 2784 wrote to memory of 1808	2784	msedge.exe	98
PID 2784 wrote to memory of 3952	2784	msedge.exe	100
PID 2784 wrote to memory of 2396	2784	msedge.exe	103
PID 2784 wrote to memory of 2396	2784	msedge.exe	103
PID 2784 wrote to memory of 2396	2784	msedge.exe	103
PID 2784 wrote to memory of 2144	2784	msedge.exe	104
PID 2784 wrote to memory of 2144	2784	msedge.exe	104
PID 2784 wrote to memory of 2144	2784	msedge.exe	104
PID 2784 wrote to memory of 2124	2784	msedge.exe	105
PID 2784 wrote to memory of 2124	2784	msedge.exe	105
PID 2784 wrote to memory of 2124	2784	msedge.exe	105
PID 2784 wrote to memory of 4408	2784	msedge.exe	106
PID 2784 wrote to memory of 4408	2784	msedge.exe	106
PID 2784 wrote to memory of 4408	2784	msedge.exe	106
PID 2784 wrote to memory of 2212	2784	msedge.exe	109
PID 2784 wrote to memory of 3608	2784	msedge.exe	110
PID 2784 wrote to memory of 4660	2784	msedge.exe	111
PID 2784 wrote to memory of 4704	2784	msedge.exe	126
PID 2784 wrote to memory of 4704	2784	msedge.exe	126
PID 2784 wrote to memory of 4252	2784	msedge.exe	127
PID 2784 wrote to memory of 4252	2784	msedge.exe	127
PID 2784 wrote to memory of 5520	2784	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://web.plaud.ai/s/pub_b336e8aa-3e93-412f-afb9-a9ffb0a63f47::SW9mO0pYzcjrI_qED6ZRMxbsCMltzT0yldbIvAXSylLD-60_xPxxPhvjpBeEizcyIy3W8qjqn1K4D5wC
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff8e5c1c188,0x7ff8e5c1c194,0x7ff8e5c1c1a0
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,11169980685057832886,13093960667572112668,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,7766457110577734630,9908485704575954576,262144 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,8453432690631682673,3900186097629471482,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7730304178379838769,4967609011486705772,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,4810788418590787379,12966238975571341825,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,570300749801028376,1999006121033242406,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,16293424132011212284,3336375699538665041,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15515365675294760626,15604845184641711831,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15816423586683075707,9504610875780537265,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13538351821445958862,3954516300799256224,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13538351821445958862,3954516300799256224,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6284,i,6856082486213033186,17249524279425621687,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6428,i,11110048354863236339,1128604164646809985,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6592,i,14395678085152203037,3337484266636325817,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4748,i,14279523174204570271,3783120763089575309,2097152 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,14590350264653210325,8840685529066807378,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,18006779162652053063,1565612771352788817,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11332051952441134894,11489682306495669622,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,18305460077052600854,7533463835759125417,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,16576425576930519963,310913724073474807,524288 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,15838793094107104662,146801527507413207,262144 --field-trial-handle=2296,i,4771514219081906435,9600658897272876042,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 58bcf0870f44a736293272d512d49ff9ddc58e8003ef48e125a298df96aa7e76
MD5 a2c2d7e226dee34d48463a414a769a41
SHA1 c7353d8570d03bef975a0db58ba680d1681a210f
SHA512 a98c9a5e835d306a892720adefaaf9b5fab799a7a095b384de72504b30da8054f1011a37388bd1c3b7195436c87775a0e0a61c8f04814616bd831cc2265f5ddd
SSDEEP 192:ynYGLlinBgHD8cVATeDh9CbR/ClA3EbhH7qppWPcWIdxuwRPd0hbyiuoGKl7tiCu:yHV+6A9KNu
TLSH
T1A8D14F3302A309EDDB95413186D20DFC7C7549E5F7073EB7A984C9BB96BABE1A01D406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c5ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c5ac.TMP
Size 3KB
SHA256 0ab6915caa87082e85a9e3f47c9ba30ac98942c529e7cc9f3631d68a159fcfb1
MD5 ffac76522a06161d1871edf711940b14
SHA1 0c2e846a8f12cbf46ebc48a0fbf0ec289538709f
SHA512 94d59762caec2cdf6c55d2b10eb3ce703a77ffc24e6eabc13d0785221456112e1d244aace02c7a1c089662a44c7d8ef9f20de8d7bef6844515a79d7475fdbec2
TLSH
T19C61E834022146F5D3EA113298D30E8C75B586F6F8077E0B69D4DDF7E7A9F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 943ae2fd4729b5e2005191c0d8c55d0faed6d5aa4707f90522d316563b2dc767
MD5 3fe67d938e240e6df5cd2585bd05c73c
SHA1 7ccbc05686cb19f5215fc96ed627c745bf3b4cec
SHA512 9af3f6a132f81c66f2c2eecb50e6042805fb2315591746eef42a9321574bac2b3ec84690d285365c6f50eb183b85520bd47cf060da3ee10e93b5dfa361ff2e45
SSDEEP 192:Dk9d95S9C9D9V9Y916979T9NSI19AW9r9M9AVR959w949V69g9r9hG9g9o969598:DkHOIhru6Z5zSI1GWF2GVRXWCamVDGGO
TLSH
T1C2F1CFFBC3F8862DCD1252F1BA543D278E6D0A15426C7D5BC9E46E8B63E2430E29194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3874f09e28342653892dd484268fa27a75a16c385b10906cd8fc584d545da67f
MD5 332e427d262338228902254be0dee7f4
SHA1 ea31a06761261dd60b239a02ce2015d73074b08f
SHA512 1e66e9cd6f8f8a2f90795e04d40eb1c05a9dc5f6121d4dfb2800b6226b44206cc62e4d281cf5cebb9d099196681c8f9b2f2a67687c0ebbbd3899e0e51b98d86a
SSDEEP 192:sxZNRPyM/jK1Ml8Mk5/fgspjw23Idp1pHW6+WNY9Iw/Y9IsWYCIgrJ:sxZN5M5/fgsp0bDHbY5/T9
TLSH
T1A642F8166A349977CCDBD309B995BF63D6F50572D2900E44AAFCCA1C00E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ec0c15b5bed2a5f9cad64e40268ff2fde7e03c05795cb562476d718cfe8c9e62
MD5 c45b1dffb7754114c8d62be20aceb1d0
SHA1 120a881efdf71c20f4a253329ce2d5508175a424
SHA512 0c661332da2d3dd0882ea24f63eaf6a8d207988ab55d47c524979935dbfcae9bc9efe2e5d9a3cd04b96e4a0dcca4111dcf44244b30c97e0d20c5b0a73ca9416b
SSDEEP 192:sxZNRPyM/jK1Ml8UQIk5/fgsx1w23Idpb/TcHW6+WNY9IJXY9IFtYCIg5QJ:sxZN5qr5/fgsxKbrIHbYCXTm
TLSH
T10F52D6166A345977CCDBD209F985BF63E6F54572D2900E44AAFCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 eba8e2c57a55f3b01432e56ee82474e89d140661c0fda46d672217d0408dbd83
MD5 5a2bb07d43a6a9a3167f530e6028dbba
SHA1 e018d662adad2518d8aa379eb53028bb31f871c4
SHA512 9e16fa6e4d1ab8e372c01fa37c67469b72c64377377d9a4b882fe601e7f28ff2a2c03ca48d7ecb5e53ab36ad56a21e797ca80da84ea790c8aa521acc76606bfb
SSDEEP 768:GXcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproYg6F:GXcv21wWvu+Z+u1jaeFLeRNCYV
TLSH
T1E3D21B2B280CCB7E0F841E9CED2A6F966ED801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5949ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5949ff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f7fbbe1f060764f602a7f27b6b9393fd944c3644f6e13440230b5a8fb0410ac0
MD5 a6f179e0aacf448a5d37a5a2511205ee
SHA1 1a9b24c25670dbcf935c16c69f94633a8e4baeba
SHA512 284444fa25b038671798d1a4fad0d588af5d01b5bea9217140166278d6c3327b36605d56376ab611d1a52143704e7c0eeeaeed97e90dd10aaef5b76e91b6a7e6
SSDEEP 384:iZcIhsNsHJU4szioRb2e+C6BRuxMrJrZd1+LScjmwV:QhDC4Y3bBi4MrhLA1jB
TLSH
T1D1928D77AC645C7A5BF7A101F88726239FF89073D7D51B8089ECAF1D01DA6AC130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2401b09acbbcfd3e4a09bebefa535a58e7838603bd742d95188ccbd06f9f38f6
MD5 664549d83abf913deb6aba2bbada14a3
SHA1 82de8bf7f1370f8141a3f42ab1d6fd3ca94de8f5
SHA512 2d5a1101b22bd297f6b0c27227e9483e2f96e6ecfdecad60964716ad0dea548086bfc704560284146d0593ae10921135788bf5f371d07d91c8b3398a1ba5c846
SSDEEP 384:wCiFiZcITvzsNk8TUNTUlIlHJU4sziofb2e+C6BRuxMrJrZa1+LScjmwV:wJFQTLtwgdC4Y1bBi4MrhcA1jB
TLSH
T1A5D217F758D7887ADAAE9703B77E2D128EBCC063B5815680B7D8591CCD961BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c9fdbf8077795ff55ff53387c3260aadbb92012d7ca5507a91d682e96edd77e
MD5 680a74804d00259bcdfd301a110ddb3e
SHA1 1916545271309f45c88cb1976a428f637718e470
SHA512 2f9cd63d3b76cf759e58d45fc6e9460a6693df3a8f21dd0d3f85f0d0867cebb1ad6391ef4127fb0d29baf7ea60354522f09dc291958e1c51b5a73b1f1e61ebd5
SSDEEP 192:JONx6v+YLNQmiUyibZh+CG66BMAuxYuszlU6:JONx6vz/3Zh+C6BRuxuRU6
TLSH
T17002E93AB8681C7B9FE26E05F58727275FE81137E6962F80D9E81F1C00D764C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 07ad8763717d33c36dad71b7f836fda2ac5589b0c1d44f39cd890b5e3124c0be
MD5 94a11380dcae126f960594a12451da74
SHA1 e6db564f67ff5ad7ea8c228669a541cd0440d362
SHA512 be15a9d9f4f25f6654c3d179a6c9536c372f8d8168914524be5d27532f241bab754c6e011458871fd2a23763e9dd7485f5ee6067391c980d60ec4e14d19fb6af
SSDEEP 384:PZcIhsNsAJU4szioKae+C6BRuxMrJrZd1+LScjmwV:HhkC4Y4di4MrhLA1jB
TLSH
T14B928D37AC745C7A5BF7A101F88726139FB89073D7D51B80C9ECAF1D01DA6AC130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 611992b49d98e1fb7e296e52a5618b8db57bc809049d0bb4e409d1c217bf63ed
MD5 b910cc3ff4a64d325466b2074371d0f1
SHA1 676a2eb3c0cf8ea260d01f264532f34ee33744f1
SHA512 32d968cb34504147e4db1b237bb670f2708832eadd35d179ba972843c81a78045cd9e3ee3eb94eeaf242f9fe2d480397c20f674fa4f7f2c239b26e73b4a5e2eb
SSDEEP 192:qON96v+YLLQmiUy1bGh+CG66BMAuxMcSJrZbCH1hqXLU6:qON96vzxKGh+C6BRuxMrJrZo1+LU6
TLSH
T11B121B3AB8645C7B5EE2A541F48735236FF94137EA8A3B80D5DC2E1C02EF25C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9120be7-833e-45d2-b261-3097caac820a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9120be7-833e-45d2-b261-3097caac820a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4fa7b022da4a4e47d4fd19e64ddf78b78352eef0724a8a7e2f2f476407efcbd2
MD5 9854d946ee4ac59a17df7953732f0542
SHA1 ec3c0ef7f0b5391f8f3d2a796aade3da68244b76
SHA512 b02ebb129483c8906b9abfdcc7ffa7b45f6cffc16fc7154309703ae3950b3643845d60abaa4fbee0be9fda34cd6158fb2a6b71de12d810d7536745747a40573c
TLSH
T102412A58A6FA114CB3B76E5AAFF6A46D587EB9372E46C45E00110E4F0A23B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download