hxxps://storage[.]googleapis[.]com/workshops--team--2--5889c0d56a3c488ca8c4/index[.]html

Analysis

user interaction
yes
max time kernel
69s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/workshops--team--2--5889c0d56a3c488ca8c4/index.html
Sample260731-carknstybz

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	39	https://my.workshopslearninghub.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a238f79a0e26ef40	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2544	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299363836959098"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4BCF8B38-B996-44ED-9D2A-75EE1A039560}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4940	3852	msedge.exe	85
PID 3852 wrote to memory of 3924	3852	msedge.exe	86
PID 3852 wrote to memory of 2544	3852	msedge.exe	87
PID 3852 wrote to memory of 3924	3852	msedge.exe	86
PID 3852 wrote to memory of 3924	3852	msedge.exe	86
PID 3852 wrote to memory of 2316	3852	msedge.exe	89
PID 3852 wrote to memory of 2316	3852	msedge.exe	89
PID 3852 wrote to memory of 1860	3852	msedge.exe	90
PID 3852 wrote to memory of 1860	3852	msedge.exe	90
PID 3852 wrote to memory of 1860	3852	msedge.exe	90
PID 3852 wrote to memory of 2496	3852	msedge.exe	91
PID 3852 wrote to memory of 2496	3852	msedge.exe	91
PID 3852 wrote to memory of 2496	3852	msedge.exe	91
PID 3852 wrote to memory of 2288	3852	msedge.exe	92
PID 3852 wrote to memory of 2288	3852	msedge.exe	92
PID 3852 wrote to memory of 2288	3852	msedge.exe	92
PID 3852 wrote to memory of 4312	3852	msedge.exe	93
PID 3852 wrote to memory of 4312	3852	msedge.exe	93
PID 3852 wrote to memory of 4312	3852	msedge.exe	93
PID 3852 wrote to memory of 1812	3852	msedge.exe	97
PID 3852 wrote to memory of 1812	3852	msedge.exe	97
PID 3852 wrote to memory of 1812	3852	msedge.exe	97
PID 3852 wrote to memory of 4488	3852	msedge.exe	98
PID 3852 wrote to memory of 4488	3852	msedge.exe	98
PID 3852 wrote to memory of 4416	3852	msedge.exe	99
PID 3852 wrote to memory of 4416	3852	msedge.exe	99
PID 3852 wrote to memory of 4548	3852	msedge.exe	100
PID 3852 wrote to memory of 4548	3852	msedge.exe	100
PID 3852 wrote to memory of 4548	3852	msedge.exe	100
PID 3852 wrote to memory of 2140	3852	msedge.exe	101
PID 3852 wrote to memory of 2140	3852	msedge.exe	101
PID 3852 wrote to memory of 2140	3852	msedge.exe	101
PID 3852 wrote to memory of 1236	3852	msedge.exe	102
PID 3852 wrote to memory of 1236	3852	msedge.exe	102
PID 3852 wrote to memory of 1236	3852	msedge.exe	102
PID 3852 wrote to memory of 3512	3852	msedge.exe	104
PID 3852 wrote to memory of 764	3852	msedge.exe	106
PID 3852 wrote to memory of 764	3852	msedge.exe	106
PID 3852 wrote to memory of 764	3852	msedge.exe	106
PID 3852 wrote to memory of 2096	3852	msedge.exe	115
PID 3852 wrote to memory of 3832	3852	msedge.exe	116
PID 3852 wrote to memory of 4052	3852	msedge.exe	117
PID 3852 wrote to memory of 4512	3852	msedge.exe	118
PID 3852 wrote to memory of 4512	3852	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/workshops--team--2--5889c0d56a3c488ca8c4/index.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,1222983881573322143,9321985677462756762,262144 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,14303181801939584260,11054559548218918121,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,12993560321286092540,2564218510249519684,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,9341897063576022742,5885110649578191929,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2471366386592771077,8182187471478274766,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,2321839111460890793,14723944300233630913,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,8136067803474293605,8679096842598642079,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,11782620093352572684,5189752862178609667,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12870523381446981029,15841429952416434521,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13526575744178578053,10170009054778624989,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,17346906175000353424,16928620404512956414,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5972,i,16462873202558370434,2945616969295182813,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4220,i,11615344605769387755,1530126819057246640,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,15509861241940696431,899886364706473272,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,15509861241940696431,899886364706473272,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4252,i,14329186110431619074,9154456727559337667,2097152 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,13332165328495730261,2607590539452449746,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,17054842711771425136,12950022066857581258,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,16919843005285277938,9797424540296106473,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,3872763531844888700,2551046033938432735,524288 --field-trial-handle=2284,i,13312288454158542088,16105109733888007047,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 795f525234e66b2a768cf209e9c60c2367bc93147d77ff7f41e1ab7f4b7d4df5
MD5 692c8ce8fbe9ebc7a44d061eefcdad38
SHA1 35b78fa052a088f492b7b85736bddf3b8abb493b
SHA512 56d7d52f423d951a69696ccbcc46bc52fce6c66fa02ad4ad2853cd8bd884ff2db3bcbb401d9781311a0361d18412d589605e410982d4044ba28a79992290a89b
TLSH
T1A9716FCB0E364980E7912730C0C1374471FC88B70B1F9E8C4A649BBFA40A7F18E22C18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be69.TMP
Size 3KB
SHA256 5bf461c8483c356e04f6f7f71870cfda87db5d82e3b28649172ee719293f6599
MD5 60695ebcf1ff7d9e1c701c912ae7b9b0
SHA1 0c8b4d2c529a584ce704769427856374a741e6e4
SHA512 194d9fcda6a5303ae312c1c2147c9f48edf2d862c45dfc90beaa2f7a58f51e68c67ad7e514322668869032f1d226084323b5f9f9e6aecb8f501165aa00e5a6dd
TLSH
T105713CDB0D324981F7912730D0C1374871FC89A70B1F9E4D8A689BBFA51A7F28E26D18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3abf1ca08ac8edd2e3f57f462ff2fd138cec2d553f21b273f1bd00f2a3264523
MD5 a7e558dd128b0e9b8f9657cb2944d26c
SHA1 63b637f8c68b9da017d6641ddbca898ca3431738
SHA512 8ca62bdcd4129487f2db3c3d5c530906674e13b13b7c05a75c912fc3b95db0873c3999fcde193ede283525e22b57200bfad04e1f18f4115d53a0f42890232657
SSDEEP 192:sxZBRryM/jK1Ml8MkG/f8syZu7MIdpTBns9HW6+WN5psMC5h/YLjqC2IgrJ:sxZBhMG/f8sykVaHb5tG/59
TLSH
T14B52F7126A345A77CCD7D209F941BF53E6F81462E2940E44AAFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 caf781cd4d2360a1789eec1206118824f4aa2d1576860b4aefb68b124c8aed86
MD5 dbc32d68b737a538f0b708622f33e1f7
SHA1 2b5ee3d0764fc97c62478b104539b94baf14ccd6
SHA512 2d7a4353392ef6e0802789d07c986381fc113fa57ad636617b946304cdcbec3ec92c86e3b4e715128f93b44610af84536cc9683f9b901f296b2101a84401d285
SSDEEP 768:DTs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNJroUc:DTs6pD1WvxzUju1jahILIsNiUc
TLSH
T12CE20B3B680CCB7E4F844E5CEC2AAF967DD801CBAB54895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 adbcd3871a940cdea61d2eeb9a184890e11929526fe74a044ba86945a5a5c566
MD5 188d2f95beea6284acbd2020f049495e
SHA1 0b82f65fb75b8f64185e728ea8ad25ed13e059d9
SHA512 4591f0ee69679d3c8884d0c653bf70def4ba91d2a7cee2006a9bcf17849e39e09d00ec75933969245df4abef00a4fa8fe571b0e0b9f5af53a21d9b0f4049268f
SSDEEP 96:KUAAKteP6OYKTCEK4K3qmq0gK9KmNw59zH:iivGr3XNw59zH
TLSH
T18BB1F31271BF06022D7E2A0DA2549727A7427163301DA42B3BE950B51E6BE384DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eacfb6f-2d3e-4496-91b4-81817bf06e64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8eacfb6f-2d3e-4496-91b4-81817bf06e64.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f86b05d6162163e9568b1bdf3a8e60e74daba58e0be2ec8b5f2214236be819e2
MD5 038216e927b69821baac9ee982e9f4b7
SHA1 04d466540f3b9bcc1cb11a6bae6f6ebdc0c24581
SHA512 1fbb6eda903198589e8263f581abbed331606d88c4163516917b2a7899cc9deae83e30ffb1fbca6778f0f28e82205f22131b0def40f2ac4c28f84dc03c67e3c3
SSDEEP 384:UZcIhsNoo/8CB2a95OVnuzJrQuOObjI9G6w7VD:Shc3jOJ2hQu29Md
TLSH
T14C927D366C285C726AB3A416F5C735275EF89077E7991A44D0ECEF0D05EB9AC0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a262ed40b6f787f433fc5ad3cfd3c2605b6c839ed60fc9260ca275a34d813e45
MD5 f2cca890d8ac6fc8035272ba5b12a362
SHA1 73b64a57168ff37c9a1ee471f232c43a34f9965c
SHA512 8fa1dc9cd98f04bced933db638169922884681f2afbd20c8863f53e127411ec56153a814e063eef4acb7183153e547d4b4dc8c039c7d9c0f1a13d9fced88db44
SSDEEP 192:qONi6O7+3hQmiUyG6Gttb0gO2KDgGLqdU6:qONi610Gt95OVHmdU6
TLSH
T1A502D73968286CB78EF2AD45FA8727175FA5113BE9952F40D9E85F0C00D769C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71a37c84e98ca13070bc628528d18dad5272632e0470d680927ea9438c699d06
MD5 17051dfd8fa2e4a7b7a41d89e827311f
SHA1 888711f50be0d39672213c25d8f3f7f4d94ec9e2
SHA512 c6dee7eabefe13851011b23e403b830dc2c0ecf446084d54b60d318ac2be158020281c50cc095a68287f1f196781e17cf247b143f8ac647d7fe60a0446f41e3a
SSDEEP 192:AONp6O7+3sQmiUyi6ittb0gO2KnyF0SJrXcNSq6BU6:AONp6Kuit95OVnuzJrEuU6
TLSH
T1A3123B3678289C775EE2A445F9C732179EA54177EA862F80D4DC2F0C01EFAAC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7a57a65be410ba5e72bac1f7276c5a858c4ec671fd5949f6324e83eb9d66c614
MD5 9c12984e6d3972f4bc51104c7d7a30c5
SHA1 d33420d0a78d3c98b9bcb70422fb6061e8abce4d
SHA512 1501391786af2761d8bca3ac4fe309a6427c1e377d375873a6e17b01c90c97d87e5da6d302faa3cd336e046f9c9e6302081f227e1ba6eea839100c4274207fa7
SSDEEP 384:5ZcIhsNoR/8CB2a95OVnuzJrQuOObjI9G6w7VD:RhZ3jOJ2hQu29Md
TLSH
T168927C366C285C726AB3A456F58735279EF89077E7991F44E0ECEF0D05EB9AC0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e9c1cb20a7e631e08632634cd1687b263f80f3f167d6be0bb8c559c894e43fc
MD5 448061c72af54ca20ae46ec7fbdddf5e
SHA1 17e5c39e4d49bc4afcccf4d054e0b418b41fea65
SHA512 7f117f69c462eb1cdcb6762e6884db3593cf59de19ebf4bbbc3e2f02193ed37a246ed95ca26978bbd6420a4204a2831924c8554de8577d9daa6b9a7ff8ae8db2
TLSH
T1FA41EB98B6EA1148B3776F56AFF6A86D447EBD772E0AD49D00010E4F0A63B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads