hxxp://www[.]otimo-group[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.otimo-group.com
Sample260803-shbgesek3x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302432363201628"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F6AC32AD-597E-4759-AA53-BF52B49C69E0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1400	1088	msedge.exe	85
PID 1088 wrote to memory of 4304	1088	msedge.exe	86
PID 1088 wrote to memory of 4108	1088	msedge.exe	87
PID 1088 wrote to memory of 4108	1088	msedge.exe	87
PID 1088 wrote to memory of 4108	1088	msedge.exe	87
PID 1088 wrote to memory of 4528	1088	msedge.exe	88
PID 1088 wrote to memory of 4528	1088	msedge.exe	88
PID 1088 wrote to memory of 1460	1088	msedge.exe	90
PID 1088 wrote to memory of 1460	1088	msedge.exe	90
PID 1088 wrote to memory of 1460	1088	msedge.exe	90
PID 1088 wrote to memory of 1528	1088	msedge.exe	91
PID 1088 wrote to memory of 1528	1088	msedge.exe	91
PID 1088 wrote to memory of 1528	1088	msedge.exe	91
PID 1088 wrote to memory of 3312	1088	msedge.exe	92
PID 1088 wrote to memory of 3312	1088	msedge.exe	92
PID 1088 wrote to memory of 3312	1088	msedge.exe	92
PID 1088 wrote to memory of 2696	1088	msedge.exe	93
PID 1088 wrote to memory of 2696	1088	msedge.exe	93
PID 1088 wrote to memory of 2696	1088	msedge.exe	93
PID 1088 wrote to memory of 4500	1088	msedge.exe	99
PID 1088 wrote to memory of 4988	1088	msedge.exe	100
PID 1088 wrote to memory of 4500	1088	msedge.exe	99
PID 1088 wrote to memory of 4988	1088	msedge.exe	100
PID 1088 wrote to memory of 368	1088	msedge.exe	102
PID 1088 wrote to memory of 3980	1088	msedge.exe	109
PID 1088 wrote to memory of 3980	1088	msedge.exe	109
PID 1088 wrote to memory of 3980	1088	msedge.exe	109
PID 1088 wrote to memory of 3456	1088	msedge.exe	111
PID 1088 wrote to memory of 3456	1088	msedge.exe	111
PID 1088 wrote to memory of 3456	1088	msedge.exe	111
PID 1088 wrote to memory of 4172	1088	msedge.exe	113
PID 1088 wrote to memory of 1384	1088	msedge.exe	114
PID 1088 wrote to memory of 568	1088	msedge.exe	115
PID 1088 wrote to memory of 5244	1088	msedge.exe	119
PID 1088 wrote to memory of 5244	1088	msedge.exe	119
PID 1088 wrote to memory of 5244	1088	msedge.exe	119
PID 1088 wrote to memory of 5420	1088	msedge.exe	120
PID 1088 wrote to memory of 5420	1088	msedge.exe	120
PID 1088 wrote to memory of 5420	1088	msedge.exe	120
PID 1088 wrote to memory of 5708	1088	msedge.exe	124
PID 1088 wrote to memory of 5708	1088	msedge.exe	124
PID 1088 wrote to memory of 5708	1088	msedge.exe	124
PID 1088 wrote to memory of 5776	1088	msedge.exe	125
PID 1088 wrote to memory of 5776	1088	msedge.exe	125
PID 1088 wrote to memory of 5908	1088	msedge.exe	126
PID 1088 wrote to memory of 5908	1088	msedge.exe	126
PID 1088 wrote to memory of 5908	1088	msedge.exe	126
PID 1088 wrote to memory of 5404	1088	msedge.exe	129
PID 1088 wrote to memory of 5404	1088	msedge.exe	129
PID 1088 wrote to memory of 5404	1088	msedge.exe	129
PID 1088 wrote to memory of 3664	1088	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.otimo-group.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15856769438556878055,2090391950550790554,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,11142800437313804352,3858953146876360495,262144 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,14562663427558385762,13831452895319208986,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11512179111851659590,10529258091566113475,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12812483453519072973,17495415207605516086,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16220367403255766043,17190241032871108133,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,4527899211753947998,3440186320573161331,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,1506477520115941763,6979564943755776105,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,2614938772690725370,14697824179823045337,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7247454989579046672,4006449636172225380,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7247454989579046672,4006449636172225380,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6288,i,7004809019024526909,11102118695323471424,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3556,i,17058457445666116536,3296572938092195032,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,12975222919750283964,10399973180860926560,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,580024582851061679,3377234706217871208,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,13963558137361930009,16864466382923345749,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6384,i,1480068887399929614,11375406415538645302,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6608,i,2529923021969879433,12279796575438291403,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6388,i,4796850779065977296,11387143445231295033,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,17497245473075110982,1398774606458059535,524288 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5992,i,12623644444395782578,14559602994918159008,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6756,i,6914090889871388593,12552840193994229389,2097152 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,17338060476139747037,4852345162698368260,262144 --field-trial-handle=2348,i,10240406944568185574,7260319434953495232,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ef4e0e1bbcee0e96be8a679acc069777f85e225ffc19f0f22c02542837af679
MD5 9e22390221f7e7b478f218ddd3d38e74
SHA1 b204dc37d34241348e59a7f7faa05490987ea939
SHA512 d5daaf7ded3ab7eeeee3fdd9f77c0d0d24757b64ed687db8d18ee721766f1465113e31b359c28d3c92089f6fe6534b2c5055d83857fccd70298b60306c7d6f1f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T19FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 628551d350fb470b78ff5a79235efbdbf22e4201440511189aec63d50484ce25
MD5 b8f057b973c7633f77bab3e8b40c5566
SHA1 eba94f9cfc5fd5e86097b8e95555c0f15df4d17f
SHA512 f3195a65bc7b80b683103c76a665ea95003953a4b03552b78cf45aad059a796a5ff675dfa48bd8236822877904fe70d1621aee072cb346f6e6035bc7ab722c27
TLSH
T16471706F8D4201D3EF611131D1DA1A03373E8DA94903BED5225498BDB82EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ae1d.TMP
Size 3KB
SHA256 62dfdf0c28a3b9350270fe56dcf723aaa1998408161313fa2de10c272f90c710
MD5 8784c31df0f054b2b6e39f09382dba2c
SHA1 a7b85f44279e641c690544791fc5349529b28ca5
SHA512 e4543acae3a7f798ea3c5f9e83796862991fbadf45597428aaf8424c4331f1ec3fc5c4b6f268f4921e330bba3a948c637fc66274e8870b4623d3943e91d515d2
TLSH
T1F371706F8D4201D3EF211131D5DA1A03373E8DA94913BED2115498BDB91EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 bab3dbda05a733919dd827f8a89ad41adba582a00f1829c9075504243aa58e2e
MD5 4c2deac423296558db73cb0381007fa1
SHA1 30b4d5dd959c4573efdc7f188cc0c1665eac1f38
SHA512 f54163db91a217ada7b60f17efbe36ab038a0cf365d759433bfa18b59a5c76b1c7226da25fc4e55467bfb6da2098e12922af229aec6aff7c5ea6e37e15e84cf3
TLSH
T11111D0F3C3D5856E894116F09A28AE2BCE2D0905421C7C29C5D4FF27D3E3475D00155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f228111e6da8cb5e0946ab74b517d991e0a9f825e7706cdb27d9de57ed47f445
MD5 0aea1e06f04761897a3976e8842b4f38
SHA1 04d2f55baada217c99f5f0db281b15baeae04d0c
SHA512 bd6eaa83a3e28244dc5f711234a3539dfb940aa031675d8f7531d5191b4f603e73f6d39c02ee60154738fea2c7b68e30d6d98556188c766bbf9cda4cf5a2288b
SSDEEP 192:sxZeRZyM/jK1Ml8MkB/fsstBCIdpJH6w6+WNGYw88i61oIgrJ:sxZehMB/fsstBrJHIG49
TLSH
T19142E7016B34A977CCCBD219FA45BF53D6F95472A2940E44A9FCDA0C04E6EED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a8a724cb44c9d4e6e03e02f55929ea28e68b7581eb1fe997cb647f6bcdc3df0c
MD5 666e67349c6082ddb65add9bba0d8d21
SHA1 d3a1d981e9f1fff001cd182498a19f6dff410bbf
SHA512 3aafa1ba86d6632ac8b3d9ca8d45448ccd5ab9bfaeb790f10a764186a537d688a79b52a6195d9a3ef99339f11980a9580b6d97508c4a9635d32a99fa6dd93fbd
SSDEEP 192:sxZeRZyM/jK1Ml8UQdkB/fsskI3IdpFHH646+WNGYwQlj61oIg5KJ:sxZehq2B/fsskIYlHoGwQ
TLSH
T1E5521A01AA349977CCCBD219FA41BF53D6F9447291940E44A9FCDA0C00E6FED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 76caf103e15372f4a99091cbcb0407fda7b037366049e5060435c23d0d991dfb
MD5 ea91d50c52a698e2481614a86fcc1d31
SHA1 9ea8c24c9470b39fb1a9a4071ff8237c38f6d706
SHA512 2488ba7b5a041ebd65869cd60c886db7fb9ea55541623e8ac32363d38ae57815044bf557868b358a91b76fb4d87d4edb60cbe075451d0d4abeceb50dafaae7cc
SSDEEP 768:c54jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dLrohO0cdaC:c54jeXmWvmKLEu1jacPLZQd4MbX
TLSH
T1FED20A3B244CCB7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db39d1e458b013d9cfdee20cc702ddde6f3a9b2ef7567318846d8e4ecd488e8f
MD5 79edafc6884b7aaf3a4e18a524b47b9c
SHA1 9cf713a2f7b4fc4c66903246cefdb6bc041f219f
SHA512 ccf0f888042b494aba043ffde17a5d415274825ac2aa526575c0a2b33aa1c8c88dfd527f71ad6697042659d8b289546ac8c9e9e33a3c4b3ad36e61b6aff57268
SSDEEP 48:KMUIjKJSUjyxEIHK1+cB5I1KKIQvyTt0p9XLX:KMUAKJSayEQK1+i5+KKIaat0p9XLX
TLSH
T1A89173223ABE0A416E7E350D91A58B175A53BAB3340DB52B77BD00A64E67E114CFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5595910-84ff-4bb5-8c60-4a8d097dd8cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b5595910-84ff-4bb5-8c60-4a8d097dd8cb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a49c2472d7cad0661068b16ab50e8399a9544b83c25b33ae08d31e26769e529d
MD5 cdf90b609d77bd680cfce7b28248aea1
SHA1 8daae36ca9f173c9de035503d9edfcc95c66bab6
SHA512 aa899fa22e7b6b61d41b7007995eb6a470dd1a944925547575e287976b3977716ba2d459975033932892115c361fb62d3e1f8c356788becd32fd92e6747181f7
SSDEEP 192:uaLsNr+Qs7ZEjZQmiU1lhBy4H/+jVIjzorR+XKFuSJrEW5cFTpq2gOpb:DsNr+b6bRB9f+68R+XGxJrEZF/Fpb
TLSH
T136423C36A878AC375DE2FA51F14731139FF4516B9AC93FD4D6EC6B1C00DAAAC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c086735a476a51317b99db31536401be9b0831708c3f2b771396aeb278abae41
MD5 06b5aca7a17a34313accf9e23eccf37a
SHA1 1c6a3a60d9aecbd7d561a79924b262bb645d0e28
SHA512 651c7477d4d49ffc8732bbff3d9c3a311d8d674f168764741348f987dd346a2e820fd10405d8ed1ffe69a050278a4237ad6f457239b379d8d62edbec30c7317d
SSDEEP 384:ZiFiZcILzsN18TUNTUlIl3b6bRB9f+68R+XGxJrE9F/6HlytEDq1UWqj:wFQfQwgMB9ZEhG/oy6Dq2WG
TLSH
T1F8A27E3388A8993B9EE6BA40F44A35138FF55067DAD9BBD4E3DCAF1C00965AD130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c1a4d18993a940333b89f7cd5ff45f4fca045ff4e0d6ef44a81615e6bffb244
MD5 1566741dfed8b800138946ce2a7b5340
SHA1 958a4bbca69dde0ae645eca525b4d55ded804ceb
SHA512 4b5352f27d8797c9ce5ec3ff134fcb411fd45e05f5aadc9b71e013a8941c1a04b5aa5c8bf8a1c5edd464c93dc81c0fc1d5e13b91bf588789b6e6bf4cdbd7d947
SSDEEP 192:EON86hZ0QmiUyg+pc/+jVIjzorRV5wOZp3U6:EON86oOpu+68R025U6
TLSH
T10602E935A8A86C778EE2AE45F48727135FE4212BA9956F94D6E81B1D00C7B9C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d32110502556d250d400319ae177018ceaa9475c49da5d6a4100183119a9e4d
MD5 09b00317d321c2da79b7e06d3c079c68
SHA1 36ef0334c63f762d53c3d72070f692de5e9fe3c3
SHA512 248ed14de65aba63bff56b6993db3afa706629f0b1d83f583c988ae659d11581e473f93248481b51a37d59cd6ccee6fc881742670721a27d3d4aee30f67b44ea
SSDEEP 192:1ONu6hZMQmiUyg+Bc/+jVIjzorR+XKFuSJrEE5cOqpq2U6:1ONu6gkBu+68R+XGxJrE39/U6
TLSH
T133120C35A868AC775DD2B551F48731139FE51127EE8A7FD4D2EC2F1C00DBA6D130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1a04dd852d73956c4d86089149f35bae195b516f7eac251b20d70d73286dd869
MD5 0c3d4e85497dbbd74f72e0c3c1748252
SHA1 bc3f103fdf6dc1d5dff341b61fdf58df8658574a
SHA512 5b8a279810768b41a98bcdb8647d6c25c37ac22e0c2c254e7752c58e602511da14ec7b05a77a8d12b413210638373b23ebf6e200c36890659f0e3c6819053ae3
SSDEEP 384:ZZcIhsNr3b6bRB9f+68R+XGxJrEZF/6HlytEDq1UWqj:xh3B9ZEh8/oy6Dq2WG
TLSH
T1A9928E3198786C375AE6F541F48A35138FF85027ABD96FD4E2EDAB1C00C9ABD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c56fd82-9d50-4716-ba69-9f39aeb82550.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8c56fd82-9d50-4716-ba69-9f39aeb82550.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f2a13c899363619b18a122c0e50c46f643b412b3ad392065d836bca9cb4a3e38
MD5 a8dcd0d47036e8c5663e252f70c09aec
SHA1 ea3edf9049e515ef882ef6295a075f0f5bad3827
SHA512 ffdd6798751336403c70b393173bc8bacac3facf4e96c3a9b3169cd906aa0cc77ab227b5c441ccf057abb534959f9b4a8c57072aafd6237117b06adf27e51f9c
TLSH
T1B9410958BAF91148B3B77F5A6FF6A86D447E7C332F17849E00110D4E0A36A40D862737
MD5 SHA1 SHA512 TLSH

Submit Download