b5ed61e58265729f0e12f5792c622b91871b68dd3346cf00c92d3b8570633a34

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
altrasa/index.html
Size 72B
Sample260802-afvheazfkh
SHA256 b5ed61e58265729f0e12f5792c622b91871b68dd3346cf00c92d3b8570633a34
MD5 b2cd18c36f45ba0aa0493fbb24534377
SHA1 6319fe90d0350716487641128eaa0d31a5dc178a
SHA512 560e9c38cb7b6ed9610b2acb50760701ddaf1b2cc497b58f50d5ebc3abb7799c4f0193d118e8aa088a8d3efdc417505368c9dd92917950c934d710225a9dc92d
TLSH
T1CCA024F70C40C10037C301045151F10C3153104D0C50C105C3D3400534313DFC747400
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301029928970829"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{A1624565-96FA-428E-A6D2-FBE59E28F88F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2748	2952	msedge.exe	89
PID 2952 wrote to memory of 3512	2952	msedge.exe	90
PID 2952 wrote to memory of 4708	2952	msedge.exe	91
PID 2952 wrote to memory of 3512	2952	msedge.exe	90
PID 2952 wrote to memory of 3512	2952	msedge.exe	90
PID 2952 wrote to memory of 1112	2952	msedge.exe	92
PID 2952 wrote to memory of 1112	2952	msedge.exe	92
PID 2952 wrote to memory of 5132	2952	msedge.exe	94
PID 2952 wrote to memory of 5132	2952	msedge.exe	94
PID 2952 wrote to memory of 5132	2952	msedge.exe	94
PID 2952 wrote to memory of 1968	2952	msedge.exe	95
PID 2952 wrote to memory of 1968	2952	msedge.exe	95
PID 2952 wrote to memory of 1968	2952	msedge.exe	95
PID 2952 wrote to memory of 2276	2952	msedge.exe	96
PID 2952 wrote to memory of 2276	2952	msedge.exe	96
PID 2952 wrote to memory of 2276	2952	msedge.exe	96
PID 2952 wrote to memory of 1584	2952	msedge.exe	97
PID 2952 wrote to memory of 1584	2952	msedge.exe	97
PID 2952 wrote to memory of 1584	2952	msedge.exe	97
PID 2952 wrote to memory of 1108	2952	msedge.exe	98
PID 2952 wrote to memory of 1108	2952	msedge.exe	98
PID 2952 wrote to memory of 1108	2952	msedge.exe	98
PID 2952 wrote to memory of 3552	2952	msedge.exe	99
PID 2952 wrote to memory of 3552	2952	msedge.exe	99
PID 2952 wrote to memory of 3552	2952	msedge.exe	99
PID 2952 wrote to memory of 4648	2952	msedge.exe	101
PID 2952 wrote to memory of 4648	2952	msedge.exe	101
PID 2952 wrote to memory of 4648	2952	msedge.exe	101
PID 2952 wrote to memory of 2156	2952	msedge.exe	102
PID 2952 wrote to memory of 2816	2952	msedge.exe	103
PID 2952 wrote to memory of 2156	2952	msedge.exe	102
PID 2952 wrote to memory of 2816	2952	msedge.exe	103
PID 2952 wrote to memory of 1448	2952	msedge.exe	105
PID 2952 wrote to memory of 5880	2952	msedge.exe	108
PID 2952 wrote to memory of 5880	2952	msedge.exe	108
PID 2952 wrote to memory of 5880	2952	msedge.exe	108
PID 2952 wrote to memory of 4748	2952	msedge.exe	110
PID 2952 wrote to memory of 4932	2952	msedge.exe	111
PID 2952 wrote to memory of 3844	2952	msedge.exe	112
PID 2952 wrote to memory of 4292	2952	msedge.exe	113
PID 2952 wrote to memory of 4292	2952	msedge.exe	113
PID 2952 wrote to memory of 4292	2952	msedge.exe	113
PID 2952 wrote to memory of 3764	2952	msedge.exe	114
PID 2952 wrote to memory of 3764	2952	msedge.exe	114
PID 2952 wrote to memory of 3368	2952	msedge.exe	116
PID 2952 wrote to memory of 3368	2952	msedge.exe	116
PID 2952 wrote to memory of 3368	2952	msedge.exe	116
PID 2952 wrote to memory of 3644	2952	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\altrasa\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffbd05ac188,0x7ffbd05ac194,0x7ffbd05ac1a0
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,8352324973366624485,10709832824915473024,262144 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11275408569553161452,18045561116212263629,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,8721268485639934352,5478726669744898781,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,12851146591356535310,6514258927931708810,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,4319712894299405477,10454565436231630999,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,16810756557304923195,1917496968293155703,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,14084531330475855431,840707195132823060,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5408,i,5735455078138411429,9437776632144927718,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,9336529521737805920,5995271833716704171,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4992,i,12991346933314326283,17952609850991404958,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,600323042579678042,2642838204944512016,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,18373119892287957209,8257661471969080375,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3352453660748045840,2389116653065244567,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3352453660748045840,2389116653065244567,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6484,i,6598683126463824600,17781895303404041830,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,17928500042069181055,6253737749753797439,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,10260106084744082334,6438212541229096256,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,1529163814698407861,16062510728776664653,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3868,i,13778260181846864375,13688576261697451027,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,297349939952745945,687180974260528779,524288 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=816,i,17362447680833889449,12124789072737402789,2097152 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3704,i,14561377557884032598,4449463573354812194,262144 --field-trial-handle=2336,i,9410921743078302475,16875120544320990095,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2f826a8d-b6a5-472c-8547-47f11a647e7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f826a8d-b6a5-472c-8547-47f11a647e7f.tmp
Size 37KB
SHA256 c95dd4d34b709280591b0010b00c6a994ad6baa80053cb0356b86ca071cd6dde
MD5 24c19c0060314c42ebbe388aac20fb94
SHA1 6de9eedac70c1217315b626c218ca874dcfe7725
SHA512 0edc83d5605c2f7911e127f74443d01fceb88f9121f1f2b9f5331009857bb05c3e39c9a4be4435ba6ad73eacaf5af900a790d6bbf81d38b57c24bd90ba9eda40
SSDEEP 768:fFQv3twgPNeqGDz9DLtm2K48dHeByERRFzjK3Yx2ewBKZOan:iv3zNnG5U48dHSyw/H2evZPn
TLSH
T10A03AFB158A4AD778DABD789BA477357EEF04163D4D4AA64D7CDAE0E00870DC030BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

5b47daae-2f85-497d-874c-37a165f1d999.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b47daae-2f85-497d-874c-37a165f1d999.tmp
Size 11KB
SHA256 3fe224d05c6b23ff87d6e76a41f14a90c336ad954695c4ba0057917c31c9dd6a
MD5 0eaec558a41e4eb7f9985029182bf9a9
SHA1 ab70c95c0d6b743caec8d162b0f7be1a4dafa812
SHA512 2d03f9b1e1aa3343b25d655310f2ac3851799bd09dfde9d072d044446a99ffcd969cb718a179d20db8eec12ad8dea33a769ab595def52622092df2d5e25be2c7
SSDEEP 192:sxRGRjebh/f3sRgKrjDazoA8p4C3/g6+WNIYEBiKbGbIgDNJ:sxRGNAh/f3sRgmH/5I4V7
TLSH
T1DD32C8166928A97B9CC7D21DBB65BF53E2F9503261D01E58B7FC861C04EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ec9dd5d329de6ef475e8aab26b31b0c23ba075360dbcc816114d9e4345699f51
MD5 6f04043e2381139207ffe5c683ff97c0
SHA1 5efe46e3c72fe84fa7a3a4c45c1d06497c46373f
SHA512 cb74b14c9474f4b06ec6312e2b73f0ba6344704116795d098d44396bab1c310d42837d264773c4c057148ef0b3bec28831f7545b0b93fb9b987693522e4bf069
TLSH
T16351CD90A32511E9EF6042FE48F42A7673F881944A831E81F85A7DF83481F35D2F4A1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5951df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5951df.TMP
Size 2KB
SHA256 cc2ef8c9b7f13658ce227dae3f3edbb152d116daadee159c40357d3b6863cbcf
MD5 573d0ea17daf403c3dbdca247691a9cd
SHA1 ce75b1b4e1edb96f3401ab3ea70cb1fac8e43052
SHA512 c4dcb121bda5a8aff65a1ea6d1343821b17d679b125321bb83f48605dbdd380aa5c9158ccea8def08b850591dcff8c7ca3bdcc7b26304e70f7026d57f71eb932
TLSH
T12E51CB90A32511E9EF6042FE48F46A7673F881944A831E81F85A7DF83881F35D6F4A1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 96b8d217a9a10d1bf4d0a88b5479e812f4f753d06ad5081ca960ad4b2390e53e
MD5 71739506905883c4c1fb6acf2d7617b3
SHA1 82f56001abb754beacd02c2e71f6f2bdd33d0b7e
SHA512 0b867815f28bb6204270e5a477e0706458977c9469e62fef21421488f534038f2f04eb0f15f78c66afabaaa008138d10bf226faed29110e73eea29e4f9f2c0cc
TLSH
T11F41BEF3C3E8967D8D0146F4BA146E2BCE2D0915432C3C5AC9E4AF5B97E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46fb65a6a81d3e384db735cb7c4ca521f1d1db86dc3bf73c3ab7488280b6300b
MD5 4acc03184d16f7e6777454720761c54c
SHA1 6aa0c77a7d81375225aced2ce969930e342d31b7
SHA512 448bdf44689ce4f35d228e0ae4a3bbcf47442d3cada6be47bf252d791739a7bf0f4e9f205be685f649730ce9c6a17de2ca556b19b72d44cfeef11140ce1fd9ae
SSDEEP 192:sxRxRjebh/f3swgKrjDazoA8p4C3/g6+WNIYEBiKbGbIgIJ:sxRxNAh/f3swgmH/5I4Vs
TLSH
T1BC32D8166928A97B8CC7D21DBB25BF53E2F9503360D05E58B6FC861C04EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c550421bafad51efeee382d1d60c96e5c3f4410d6e15b7e004f116b4c1f585c
MD5 4f0ed52f0087b03947f9a7657e53d1a1
SHA1 918d991e3abfe6a19a9c5a7d5aa7b2c2b7fffe03
SHA512 c3d89b4b78fbdf36849b1fc3233edb111700b5b455243520c154e2b70fc8d1aeda87ba93eb65cce7b5abce5b41c796639237130df7f5ffd3b0d6f04b0bc84186
SSDEEP 192:sxRGRjebh/f3sRWKrjDazoA8p4C3/g6+WNIYEwiKbGbIgDjJ:sxRGNAh/f3sRWmH/5I1Vp
TLSH
T1D242B8166928A97B9CC7D21DBB55BF53E2F9503360D41E58A7FC861C04EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d95f3333-7f15-42a9-b36c-30f81cf6513f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d95f3333-7f15-42a9-b36c-30f81cf6513f.tmp
Size 23KB
SHA256 a5597e4c9e57366c6a9bc124a33770212cd170c09e0cc150194d609800f28898
MD5 efd9d1696b9e55c9a3e28dbb8c02de28
SHA1 aeb75628bc2e626ca62cd187239370faccb5b591
SHA512 010f891693fdc7fb388f70352a19b080f6ef31b9adbe1add4cef5e5204b2dda89cd15a6803fcca51f5bc424a730f96414d7afeef0e1d096592fad7c0291119af
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAJroZCN:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0VT
TLSH
T17FB2FB2B600DCB7E8F805AADEC196FD76D9802C79A588D4047FE994C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a6d334-a0f3-4569-abd6-491ea1b3fa3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\56a6d334-a0f3-4569-abd6-491ea1b3fa3b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c15cc76c235d2f1cfab0ba59a2bc5bb97a19ca8333e8df19c2e6ba12309ac613
MD5 557a5978714427c5a0e4cfd932e2cbbe
SHA1 d2364c955168bef2cbe9073e76e3adef0fe2cd12
SHA512 380ee983feccc8e2106f98561d026ac6cf27f0ed4359a4b38baaf9c75d1728021dd8b7ba6f3ffdd58a33357c733971bca08efc83f8557d14be28bfc0dc0203c2
SSDEEP 768:irv+4UNbdG3iuNeqG9z9DLtm9K48dHeByERRFzjK3YxEnI:ibsbg3lNnGTB48dHSyw/HEI
TLSH
T17D03CF70A8A86DB34CA7D289B6437B53BFF0411385C81BA4D9CD7A4E458B4EC170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4ed9f842f14df64da081bbb8ec2b71f368a091f88bf1aeebaed56ece3364b676
MD5 2af54a2f64f1ba57012f7f8bdb611457
SHA1 fd409476f760b453329ba3370ac88df9477a5066
SHA512 20057a3fb8790c24be76e44bf3fdefea994b790b3695c7c2fac305b862a34766c764a66e60b86a38c7254ab858c2a900bec00cbc9323ed56737b5441d17699f2
SSDEEP 768:153hNeqGDz9DLtmeK48dHeByERRFzjK3Yx2ewBKZOan:153hNnG5848dHSyw/H2evZPn
TLSH
T1CDF2C0B068646D734DEBE28976437357EEF08123E5D82A64D6DDBF0E44864EC070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 71f549b65c67f3179bbaef5b65b39750dfd1cdc0278e8311711a57f0d89301d6
MD5 6c7df66c95f4767ec29b904670dd338a
SHA1 3dae898d923f741f5798bd39b47e6cc9358ac26b
SHA512 ef5081c950f830adbb2c48c88da86ccb9077884bb742ff17fa3e7d4eef8eb8e36c0890d63f534f0d684c028fd8ea5a3c9507812ad87a19ff311a3bfe78386278
SSDEEP 768:G53CNeqGDz9DLtmeK48dHeByERRFzjK3Yx2ewBKZOan:G53CNnG5848dHSyw/H2evZPn
TLSH
T1ACF2C0B068646DB74DE7D28976437357EEF08123E5D82A64D6DDBF0E44864EC070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 489272ff8ce7d9a781963f35101c7d3bccdbc7fcedd81eb50b49d1d4a16e2d8e
MD5 295c2ec4dc01c61c9c8718fb43c6b145
SHA1 e8baa43c45f2c5d90c7d6dda11d91ac1dcdb5954
SHA512 b98018ec58359953c72d8b29dfe5bce5ef39af9525e2faeb06dac8ec150f5901b6f716651fdbe530478a32c23bf59af16cff72712be9613a76128d6fb8fca285
SSDEEP 768:Qrv+4UNbdf3SqG0rDLtgK48dHeByERRFzjK3Y9eVH1SCj:QbsbJ3DGEX48dHSyw/TEH1Z
TLSH
T1B103BE71A8A85E734CA792897643BA17BFF4411386C41BA4C5DD6F0E86874DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd37e9f7-20c0-4f70-9b61-aa76481d5957.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd37e9f7-20c0-4f70-9b61-aa76481d5957.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download