hxxp://whitetruffleproject[.]co[.]uk

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://whitetruffleproject.co.uk
Sample260804-lysmbahb76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1924	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303110352260227"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{135E23F4-08AC-4C83-B1E6-B0E733E5754E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2384	1308	msedge.exe	81
PID 1308 wrote to memory of 1924	1308	msedge.exe	82
PID 1308 wrote to memory of 2408	1308	msedge.exe	83
PID 1308 wrote to memory of 2408	1308	msedge.exe	83
PID 1308 wrote to memory of 2408	1308	msedge.exe	83
PID 1308 wrote to memory of 5000	1308	msedge.exe	85
PID 1308 wrote to memory of 5000	1308	msedge.exe	85
PID 1308 wrote to memory of 1156	1308	msedge.exe	86
PID 1308 wrote to memory of 1156	1308	msedge.exe	86
PID 1308 wrote to memory of 1156	1308	msedge.exe	86
PID 1308 wrote to memory of 2352	1308	msedge.exe	87
PID 1308 wrote to memory of 2352	1308	msedge.exe	87
PID 1308 wrote to memory of 2352	1308	msedge.exe	87
PID 1308 wrote to memory of 4392	1308	msedge.exe	88
PID 1308 wrote to memory of 752	1308	msedge.exe	89
PID 1308 wrote to memory of 3532	1308	msedge.exe	90
PID 1308 wrote to memory of 3684	1308	msedge.exe	91
PID 1308 wrote to memory of 4392	1308	msedge.exe	88
PID 1308 wrote to memory of 4392	1308	msedge.exe	88
PID 1308 wrote to memory of 752	1308	msedge.exe	89
PID 1308 wrote to memory of 752	1308	msedge.exe	89
PID 1308 wrote to memory of 3532	1308	msedge.exe	90
PID 1308 wrote to memory of 3532	1308	msedge.exe	90
PID 1308 wrote to memory of 3684	1308	msedge.exe	91
PID 1308 wrote to memory of 3684	1308	msedge.exe	91
PID 1308 wrote to memory of 5080	1308	msedge.exe	94
PID 1308 wrote to memory of 4916	1308	msedge.exe	95
PID 1308 wrote to memory of 5080	1308	msedge.exe	94
PID 1308 wrote to memory of 4916	1308	msedge.exe	95
PID 1308 wrote to memory of 5112	1308	msedge.exe	97
PID 1308 wrote to memory of 5068	1308	msedge.exe	98
PID 5112 wrote to memory of 3452	5112	msedge.exe	99
PID 1308 wrote to memory of 3900	1308	msedge.exe	100
PID 1308 wrote to memory of 3900	1308	msedge.exe	100
PID 1308 wrote to memory of 3900	1308	msedge.exe	100
PID 1308 wrote to memory of 3320	1308	msedge.exe	101
PID 1308 wrote to memory of 3320	1308	msedge.exe	101
PID 1308 wrote to memory of 3320	1308	msedge.exe	101
PID 1308 wrote to memory of 4496	1308	msedge.exe	102
PID 1308 wrote to memory of 4496	1308	msedge.exe	102
PID 1308 wrote to memory of 4496	1308	msedge.exe	102
PID 1308 wrote to memory of 224	1308	msedge.exe	103
PID 1308 wrote to memory of 1660	1308	msedge.exe	104
PID 1308 wrote to memory of 1128	1308	msedge.exe	105
PID 1308 wrote to memory of 1036	1308	msedge.exe	106
PID 1308 wrote to memory of 1036	1308	msedge.exe	106
PID 1308 wrote to memory of 1036	1308	msedge.exe	106
PID 1308 wrote to memory of 2144	1308	msedge.exe	107
PID 1308 wrote to memory of 2144	1308	msedge.exe	107
PID 1308 wrote to memory of 4744	1308	msedge.exe	109
PID 1308 wrote to memory of 2168	1308	msedge.exe	110
PID 1308 wrote to memory of 2168	1308	msedge.exe	110
PID 1308 wrote to memory of 2168	1308	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://whitetruffleproject.co.uk
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffdf824c188,0x7ffdf824c194,0x7ffdf824c1a0
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,10551555913949804541,17814975352634886341,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,10489120053438402277,15414648193043878567,262144 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,7785694249163760675,11277628409371883322,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11957732926291736888,17731587409668654238,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,969262268418596436,3097145156751223979,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,9057700839330794346,223625947484308618,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,771753791088416330,2825459123978060404,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4136,i,3613405115960800781,16738097159828314457,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4148,i,2151906045671569551,10782311989133958133,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,441978099693322969,10954691646475698010,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,16062623998134835982,17351644066262173394,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9622735479802691563,18024871074398344489,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1803461371209443176,9397965425545041906,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9622735479802691563,18024871074398344489,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6608,i,8548055325680810191,15332973285529391036,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3496,i,3168835392270317210,18002928547681915660,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6636,i,5477243765724581562,12828504671914505574,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,4224555943151275132,13052133885268509427,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,7559833300926341122,17055633874267991632,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,18025369669195640869,6420389754918338208,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2780,i,15557186889102909322,8450671046496188357,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,4169045213427209243,12612670573362489802,524288 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6432,i,1577443161169373773,10137365742374665677,262144 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6088,i,3366009644467762772,3942963251080628414,2097152 --field-trial-handle=2100,i,2156585492219755062,15615835733070158212,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e5d2e24e72f8c60d0184cdeeedc01662ec646a62e8805f8aa962d8f8ea55e77
MD5 b55c5a3436a04de937c808eba8ba4e4e
SHA1 37630d9241688c10e0591f7e502ebffa08edf3fb
SHA512 443e43d04e25c9cd30dd314f5eb4955205985f00d9dd0cecab4512add8129c60c552473d415156ee25fd504979261ce2fe07c893a642de7dd04fa71cbc37026e
TLSH
T146614F1A0FD303A4F3610B30B7D151083B719031CAAF9E763FD446B6ED05B2D612650B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587961.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587961.TMP
Size 3KB
SHA256 de9f29941cec419adbdb744fd237f9014e019896bddce99563d56913386ea64a
MD5 95e162430436b8a3d2b5bc6b625e4ffb
SHA1 7b2785b2df4f533c0965e32ffaf07535d8bfe3ec
SHA512 b649ed322d5ff083d7bb4339ef77d29f483dd1dad31b5f8c03e6214a14b4ce9064749f6276e85cb2e7962cfddd4821e63a92a136dd9ed5f27a7394a41e308b02
TLSH
T117611E1A0FD313A4F3610B30B7D152183B719075CAAF5E763FD446B6ED05B2D612614B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 43909e36f19ef6bb38949356498e3383a8f9c0a366df88a60998bfa757852ae5
MD5 02ed55dda583883385ba80dc85f65116
SHA1 a564013fdbd781d6e271feaa0b6e0bd90a71635e
SHA512 b48bf06465d96ce7ffe40ee5067cc9b790ec355981e6d453bb78c0b6e06f2328c52377110d4e41cf377016607404e76dd1f6396ad007babc9e4b917a6abcc807
TLSH
T17E117DF3C3D5856E890116F05A24AE2BCE1D0606431C7C2585D4FF2BD3E3075E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8a08987b89d690c41b24f40c3ac5af4e822bd9ed2e096330770b4be341a7865b
MD5 7ecc2a09497f32e440d366edb3b81e48
SHA1 9aa5b93433489d3b3f1fdd031ddab8f230d7b0c3
SHA512 279d0fb9418fd6483a630d4431b10fc69ccc010f60af72f9a3a2fcf572dbc4ba231890c191f9d47ebdce37f3d6150bc71415d9ad6e8076257474e3b18ea2345c
SSDEEP 192:sxZIRKyM/jK1Ml8MFP/fWsfwS1IIdp0i8/SRo6+WNGY057e+MiAIgrJ:sxZIwdP/fWsfwS150z/SrG5Zy9
TLSH
T15652F801AB34697BCCDBD20DFA45BF53D6F514B2A2900E54A9FCD91C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8905beb81ee3fa49852d77ea2c897cb9db28be029dd2caafecc780f096ef2e96
MD5 5b748b05ee3fa629a6dba5d9ffab34c0
SHA1 018047f8540372634865d40f70fb90b108660d0b
SHA512 9a3b1c228f168aa344d488947efbf5acd56907784d2393cc70c38e7e05ad57d345e45d7c5605107886b43d34ea6d84927c621bd18044288c4b618f82654d037f
SSDEEP 192:sxZIRKyM/jK1Ml8UQDFP/fWsHwSsIIdpei8/SRQ6+WNGY057B9qiAIg58J:sxZIwq5P/fWsHwSs5ez/SzG5ZC6
TLSH
T1D652F805AB345977CCDFE20DB951BF53D6F614B292900E54A9FCDA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 54b7c118c31b0523dc2fe1daf71414104bcd86225c0349b8013fa03ad2a29090
MD5 c0ce43868cf188db934f6989491efc8e
SHA1 9085c19961ecdf196891d7e3a0f9602668b1d8ff
SHA512 99f2cc6f9795446ace670cc53f86ddbb73f2168c00859e0296537e2d86806d5982343b70053b98c770f3fba9b35a83cc647eac17f9d8035b2597c31fd608ffb1
SSDEEP 768:OxzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hh9ro0c:OxzXl8pZ221WRmsYQL0u1jaKu/Lpd8hq
TLSH
T175E21B3F244CCB7E4F844E9CEC266F966ED802CBA6584D5447FA494C03C67DB522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ec8eb6e62e24e3aef054125d92ce1e052655e9ffd4a6b6f8773dc513a13cd07
MD5 c42d2a77ff92925e091dfc6b569a8e33
SHA1 c6569629251621759df7a2b21821dbb827189f6a
SHA512 59529407a6dd4c1152a2097923cc9c842b9ca14b69190a6b96b226b8ed6b6709a193676a13bcc04d3bfe868b32ea48d5346fcbbf222242a1995a35703a3e0ac2
SSDEEP 96:KJwbpmKTCkKvqeaSMKbKLK3G68QEkUQJPmCkK+Bmkkl:ujnuK3G68QEFQJ+CeBmkM
TLSH
T1A09121D234BA02112D7E355C82A697560A82B2673714F93F7BED10B24E6BE114CFD9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc242ddb-4234-4725-85ac-bd1f0deee195.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc242ddb-4234-4725-85ac-bd1f0deee195.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

996b2027-2ebb-4c5c-aba2-2c548da79943.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\996b2027-2ebb-4c5c-aba2-2c548da79943.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c949b3229b20bb2186b6dbc3bc25b6e4e51bc0b041a2f26de9c4783d61b8d887
MD5 2b31042e403917440457205ade8dd245
SHA1 24299967c40bf215987d10653bcb8ad6c48ddf42
SHA512 73e06b709302e56480004b5b853c69af94cddf9b5f28257c92978ee16c11af92fe23f97160f388b634250c5d48ebfb8439915d85b4469b632b40e622d4eadb67
SSDEEP 384:JZcIM8N7boUEEQc4K/h89Xqt2BeRs9JKgqijUc6:BMGNL/Yqt2TjKgqmUc6
TLSH
T1A8929E30A878A93E68F6F549F48736175FF59067E7C46FA4D1ECBF1C009A598230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f389b3f1ff2b1b42a8de45bbecd012a839c80321e40a13f563e92abb69ac286f
MD5 7c25ccc53b53f32e3d93d3898b7aec78
SHA1 a6018e643e8b81673bfacbaa7dec3c2d16e4f856
SHA512 772b39691999af6a9deeab0d7d30fae3df9f49b9424965424cd57f85e360a3925592450774a94c24c3519fecab80e5f8dac05a8bd659ce108929b1f4d5a743ce
SSDEEP 384:1iFmZcIB8NF8TUNTUlIlQUEEQc4K/h89XQZ2BeRs9JKgqijUc6:8F0BMwgDL/YQZ2TjKgqmUc6
TLSH
T13AB27D325864D93FADF6AA45F54A36178FF550A7D6C4AFA0E3DC6E0C009B5DC130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b7c1bee242a3db4e965dcafa488900529b575b77335d933dada864d03feec2fd
MD5 4f603010ab9648ba9b9d6970265928e1
SHA1 370775b1b0d173095f270df46f280c74ac90cd27
SHA512 d0908a7c1f65ba3059669ecf2e52159386de3b60cbe077dee4976a4f53deba41f8dfb17c5784795cc954b55b8695a6ea34fdf945092650168b1aa97bb728fb2c
SSDEEP 384:dZcIM8N7QUEEQc4K/h89Xqt2BeRs9JKgqijUc6:FMUL/Yqt2TjKgqmUc6
TLSH
T1EB929E306878A93E58F6F549F48636179FF59097E7C42FA0D2ECAF1D019A598230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b38ed54db338aa99138420eda5868803fcb6e0c0981c72219a6ad03ba439988
MD5 0063eb574b2120e15dc48d06c47dcc55
SHA1 c7615379dcfe3ba1b0cac621e2ac88cba874f019
SHA512 065ae3c5cc4ba90298dfd6a66d91bc2c1eeae8411e003888592023444532b47895826f5e690038a23069a2f80a01bd80af51f62028556de1036b5c4781649231
SSDEEP 192:HGNe6fN8QmiUyRSEIL/GPTKjzor5XRtXV8V3ZNqA8U6:HGNe61McZIL/h89X6L2U6
TLSH
T145122A35B8B86C3F1DE2A545B48736239EA61157EBC96F50D2EC2F1C01DF69C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 90acc5b86d822ca6dd62a2b65877dfc5eaef1a8e97026890c0cb259cac8bd4f3
MD5 d9a9671ad6c581424204c8643b07a7d3
SHA1 3d8322ca0444445c777d460afb49e6a1abc4970e
SHA512 ea8ce17ad1479298623ea85d5bc53a6e6ac690a30ff793f2ff24e73d7e9ae12da7f7325088f3a267fb2bcea8b444e6893fe107d988c45f7e97f3c4afcafdaf0e
SSDEEP 384:/ZcIM8N7DUEEQc4K/h89Xqt2BeRs9JKgqijUc6:XMzL/Yqt2TjKgqmUc6
TLSH
T13E929E30A878A93E58F6F549F48736179FF59057E7C46FA0D1ECAF1C019A598230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c3f635e90586826b83b05c1cf52c931fc40f7235c72450b02638f74e3b3c7e6
MD5 a46e8eb42ea6068f8d8d44e0033fad83
SHA1 22c13398df6fda83c9e7aa0f6bff367da6b71a40
SHA512 44a9b9d34685ca3cfe7efdc2cecbe47f8c33a38e154094be74155067045373eb4e2be8c4742239ba20a08dc002b721be08ca4594f9df77f51c6b713672cfa9fc
SSDEEP 192:7GNj6fNNQmiUyOzHEPL/GPTKjzor5XR6V7qnQU6:7GNj61L1zkPL/h8qUQU6
TLSH
T1C502FA35B8B86C7F8EE2AE49B58737239FE5116BA6951F94D6E81F0C00D769C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcc0e403-e60a-4aa1-93cd-2a0593b87eef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fcc0e403-e60a-4aa1-93cd-2a0593b87eef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download