hxxps://pdxparent[.]com/admin/advertise/parenting-pros-print-submission/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pdxparent.com/admin/advertise/parenting-pros-print-submission/
Sample260806-rj2vbsshkg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304992633363570"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{6BA1B194-E114-4E93-9B46-DC254AA7E120}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 432	4108	msedge.exe	85
PID 4108 wrote to memory of 1708	4108	msedge.exe	86
PID 4108 wrote to memory of 396	4108	msedge.exe	87
PID 4108 wrote to memory of 396	4108	msedge.exe	87
PID 4108 wrote to memory of 4816	4108	msedge.exe	88
PID 4108 wrote to memory of 4816	4108	msedge.exe	88
PID 4108 wrote to memory of 4816	4108	msedge.exe	88
PID 4108 wrote to memory of 4984	4108	msedge.exe	89
PID 4108 wrote to memory of 4984	4108	msedge.exe	89
PID 4108 wrote to memory of 3376	4108	msedge.exe	90
PID 4108 wrote to memory of 4984	4108	msedge.exe	89
PID 4108 wrote to memory of 3376	4108	msedge.exe	90
PID 4108 wrote to memory of 3376	4108	msedge.exe	90
PID 4108 wrote to memory of 4936	4108	msedge.exe	92
PID 4108 wrote to memory of 3676	4108	msedge.exe	93
PID 4108 wrote to memory of 4936	4108	msedge.exe	92
PID 4108 wrote to memory of 4936	4108	msedge.exe	92
PID 4108 wrote to memory of 3676	4108	msedge.exe	93
PID 4108 wrote to memory of 3676	4108	msedge.exe	93
PID 4108 wrote to memory of 1804	4108	msedge.exe	97
PID 4108 wrote to memory of 2268	4108	msedge.exe	98
PID 4108 wrote to memory of 1804	4108	msedge.exe	97
PID 4108 wrote to memory of 2268	4108	msedge.exe	98
PID 4108 wrote to memory of 4024	4108	msedge.exe	99
PID 4108 wrote to memory of 4024	4108	msedge.exe	99
PID 4108 wrote to memory of 4024	4108	msedge.exe	99
PID 4108 wrote to memory of 4420	4108	msedge.exe	100
PID 4108 wrote to memory of 4420	4108	msedge.exe	100
PID 4108 wrote to memory of 4952	4108	msedge.exe	102
PID 4108 wrote to memory of 1892	4108	msedge.exe	103
PID 4108 wrote to memory of 1892	4108	msedge.exe	103
PID 4108 wrote to memory of 1892	4108	msedge.exe	103
PID 4108 wrote to memory of 1032	4108	msedge.exe	104
PID 4108 wrote to memory of 1032	4108	msedge.exe	104
PID 4108 wrote to memory of 1032	4108	msedge.exe	104
PID 4108 wrote to memory of 1252	4108	msedge.exe	105
PID 4108 wrote to memory of 1252	4108	msedge.exe	105
PID 4108 wrote to memory of 1252	4108	msedge.exe	105
PID 4108 wrote to memory of 6056	4108	msedge.exe	117
PID 4108 wrote to memory of 6064	4108	msedge.exe	118
PID 4108 wrote to memory of 6072	4108	msedge.exe	119
PID 4108 wrote to memory of 3076	4108	msedge.exe	120
PID 4108 wrote to memory of 3076	4108	msedge.exe	120
PID 4108 wrote to memory of 5852	4108	msedge.exe	130
PID 4108 wrote to memory of 5852	4108	msedge.exe	130
PID 4108 wrote to memory of 4204	4108	msedge.exe	131
PID 4108 wrote to memory of 4204	4108	msedge.exe	131
PID 4108 wrote to memory of 4944	4108	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pdxparent.com/admin/advertise/parenting-pros-print-submission/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffcf538c188,0x7ffcf538c194,0x7ffcf538c1a0
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,12315920182792636919,10479251033950614511,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,16649047739326536158,15674555668517501077,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9484962513968998322,7690804880690952918,262144 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13108176055231948890,17291830233450514391,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17114561104212744812,10376977836223696854,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,7741901619639621766,10534041912947424894,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,6234455751263848757,11283786542392020105,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2863295846041392699,2735641645261543100,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10484040750515018681,16058132326339659156,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5640,i,6066461184020294163,7884161932243317604,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18272664427710493334,15724707532649161909,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,925152291822397134,5435182321251431270,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,925152291822397134,5435182321251431270,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6200,i,3347228224451904858,14330963518370878348,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6672,i,8173496301419640730,15012188437318318156,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6396,i,9474262890063121201,175972666743060109,2097152 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,6483038480007784148,12269730143182415277,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,9176870487179319778,138479268241826481,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,233635721437421328,9948431683082933299,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8435074643763861084,6353180561436841530,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16879937474797034965,14892582105428712103,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14115669263757806725,10676958278626680546,524288 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4508,i,16186316271237793063,15614754958188030150,262144 --field-trial-handle=2576,i,14146830384688013756,15455379190822695590,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 99b92bea0c76e67d703768c81244b0a4e72e2563f777a9295ba73738f892d97e
MD5 1ac3ee05e1ec0fc5223f0518e108ea7c
SHA1 1d69092615a0e78f9e5e599f479e16e4bff53965
SHA512 906ee52922db1fce2d79d22268a716eaeb3907481bcf375efb7da668b860dab4b2b2f48f1c84cc83b24ac9658173cf976928cf248d934757eacab86752b056a1
TLSH
T194E026C905CBC2AEB660A48752B8934CD3E03B8B9ACCA90E270484CD7405444A7D6AE0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7231b26257790502c37529f4b7bf20461a4afe97095c540caa5d8915ec46508d
MD5 d836ddd7c6b2504e287631aeaead4fe0
SHA1 2da599920278f80da8746d7fbd39d0031e582ca5
SHA512 ee77f0829e69643416cc14d01cd51d0fc43a311d0e4d19bc0fba72b2426574786edb1f281c7f1dd765b80036c7af1880bf6490f29143770b4bc64a70f9058e53
SSDEEP 96:xeg+j6pipwbTEKgOmoMehIJPMH35PE5lpRZ6kS/t9UW2rwcf1GtCnNi:xRYpwbYKgroThIJP635s5lpRAkS/t9Uy
TLSH
T11EC160340ADEC4B4FB715AB9A3D10E403C3961EAF587BE975BC76A72350F7E0628A414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c176.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c176.TMP
Size 3KB
SHA256 45d07f8f3f0179de9af55d4cf76dc4fcbf18d9f8cbc4a042273d39fafb50e9b2
MD5 680fa530eedd7d180dfb6bad23723e2e
SHA1 a162053c793a5a336ff61a64f60b9173c0dd2f0c
SHA512 d70db5aec2f07d6467d22a9a8e40f7ce8b9d52f699094fa857c3576b61242782ea220d22b63b04b20be42d27fb6b31b8caf4ac62e6024afe2fb3b8e976fc07a0
TLSH
T14981A7380E6F00B5F3B11FF2B3D14B45747E82EBF993BD9A62816A74790A761B2D9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 270706202be06c80126dd83aa2a7a54b900de6f212b324edbaaed3e458ea3d3e
MD5 85728f58e277f8f04992682bb5f5bb19
SHA1 4d2c3a17b7e6eb9982df59d742f03e5f4a692ebf
SHA512 bcf62364d5ebc8da27a698b6f0418900fbbd79d3427f76b53170bea9e4a6dcdb5a351800e041caad1b7bf953e308749acef8fc4bd9606c285344a107b1ae0d52
SSDEEP 192:D8G2cFb/pd+QVuIzmBP1v+zj1GiRzYAsMWYUkwl:D8G2cFb/pd+QVuIzmBP1v+zj1GiRzYAM
TLSH
T104D18CFF97E48A7EC8025AF15664AE2BCF5D0619421C3C158DD4BF87E3E3462E21158E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2b3761c133108d6631b86d7eae1f17b1bfb9614b6a1c14bd7764a4bdbc4245b8
MD5 88f9b0234c71a832130fc33499ee8d01
SHA1 1888626351702646272bdc35b99b30f46f0879d5
SHA512 4d8cb8950f53a90e13d39083079f9ad484fd5d672752d3028ceab6a6117befadfecb1dd983c5b0b2894d438e4137f9dbd611770fad176c69612c66efadcc3f52
SSDEEP 192:sxZCRfyM/jK1Ml8UQkk4/fSs4NAlIdp6yHW6+WNJJOOXYzqvQbIg5XJ:sxZClq/4/fSs4Nd9HbfXen
TLSH
T15552E8116A34A977CCDBD20DBA41BF53D6F5457292940E48AAFCDA1C01E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb1e177d957f3aee6c51fcb739cd22c3056503c5f2af67dbbd0ee2ae18aa94a9
MD5 5b398d9f1376fc880c23d9c834af0230
SHA1 4ae288893de378dcaa43642f1f2d40e21637b05e
SHA512 3c9a8ecea56df9d865aad7e5c2b5b725cb1bb28d1d898f188e84221677141a2c1192ee472311d2e71727d90680108de9b8586c8651156405b2bb368eaa976239
SSDEEP 192:sxZCRfyM/jK1Ml8Mk4/fSsPeAlIdpQyHW6+WNJJP8/YzbsQbIgrJ:sxZClM4/fSsPedbHbM/u9
TLSH
T19652D8116A34A97BCCDBD30DBA51BF53D6F5056292940E48AAFCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 656fc07328c6644f0e6c4eb247b5163031643d27845d081a4a495928c44cfed5
MD5 45995a8c25264d6f4bf9a9bdeacbd5b6
SHA1 306bc537987e8b5323da91aa8a9bfcb6ad4e868a
SHA512 af8a2548d5476f577703374485bf6ac3edb4ca252e15a29ac984f30e7e98f3835e039d06ca984a55cc30488200533eecad209784183db25ff05998415db59ec2
SSDEEP 768:WJW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjJroIs04YQ:WJW7kf0Wvqinau1jaa5LA3jisQ
TLSH
T125E20B3B680CCB7E4F841E5CEC266F966ED801CB66988D544BFA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6a95688e0c4c3f0d3b31033bcea87b74b99e52e0d9bf0226d21a85446b7462a
MD5 9a7c6ce7e3995933c4948e48ec5ffc26
SHA1 6be0e0a69931f963aa2b29ea03ef9724dffe2888
SHA512 c00f1b65aafd3a1f316be33b056a3eea8f451b9c3ffd43707d4825adf30759f7b3d7b9a693761f3e8ddb59b650260ad8cd01ae86ddc553963b38033f84840070
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEc/WgKLimg:sCFpfDg
TLSH
T114A14E05703F460138BE281892BAC9665E4372A73518A4FF7BB910E31E66E114EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b274ffd2-a464-454d-8b95-3d031bc6888a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b274ffd2-a464-454d-8b95-3d031bc6888a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 be8cc145622a29f776ebf846e7fa8537dc0488ceb11c0656f721b22ef77851ab
MD5 49bfb2a59f2ca40e90c44f2ba44488e1
SHA1 def51b6af00c09aa9eadd35289aa4650cdbb273d
SHA512 3adec26bc642cf57e3a10a9cccfb15dc1eca36165c71c471a72c4ef5750eced559f5ec1f9c0163b526832a89320f868542ec606874f0c9c847641ae3d965f7a9
SSDEEP 384:PiFiZcIhzsNe8TUNTUlIlCcUlusYb9c6IdEaACEJr1u3nTKwBODNZOCb5o:aFQRXwgo07yPyh1QnewBKZOgo
TLSH
T114D23AF248E75836DAAEA707A77D2E024EFCC163B5806954B3D8AA1CCC561BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6454a26b6e72b1d3ecdddaa9c6b9e8178c35d45c5e957a0e7f7db8a756cb36ea
MD5 433a97175d4b1527f369fbc86343b6f6
SHA1 d417f8058086acdbd602856abe5f36a040a594d2
SHA512 d3a3b5f2fa5daefb518f9b64a7c9404b7ccf489a549b0aa72037bdb5a8929ab240f2f224578ec673cc09061ed95f32778e2ea9aa80a86df6fc20b4917d17bdbc
SSDEEP 192:MON664BAQmiUyi1dW5GBPKXo+FdGJaraDu/hLU6:MON66eAxzWTdEaQupLU6
TLSH
T19802E935AC786C7B9EA2AE45F48737175FD8113BA6C51B84EAE85B1C009764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72bc643f42c80660b39c7e2be13de5c99b25cee51b6419d5f002b1c711ab1c3f
MD5 acc86ac970578f4a9f7197fcb0450543
SHA1 dcc66e9bb937f3c5c9fafe28713618aa392aaa50
SHA512 27a1de4c2408682edda393ca283657720b946006fba0fa47772677271eb71c832a5a6516f8fb9ebe784bf9fbf4c1b9e0621569677fb6cbacce199a57aee90eb4
SSDEEP 192:wONH64BTQmiUyQdm5GBPKXo+FdGJaV6FC1SJr8WwukqdU6:wONH6eFjmTdEaACEJrSu3U6
TLSH
T103121A356C646C3B5EE2B541F48736039EE4423BEAC96F94E6EC6B1C01EF65C230681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9ee8e8747e4a0745650f61886035647dec9394a68bbb1720dd56835ba0c44647
MD5 7dcbc5c7e7cc70486add2e4a5a8c821b
SHA1 6fb1efa6117f88b88c5c936fcda912d4261bb196
SHA512 ce0e53f2fe55fa61d53e1caf04bd62003a3a5b54553b4132c1a97842aa70b7c5e31999f347ee4a28389fd905ee976b80caabd263c5da5ebf94e8304fe2e84943
SSDEEP 384:mZcIhsNOPcUlusYb926IdEaACEJrSu3nTKwBODNZOCb5o:0hZ07UPyhSQnewBKZOgo
TLSH
T1F3928E715C786C379EE7B245F48A32075EF88177F6C42E98E6EDBB1C00A66981317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e195f9b3e3fff3dc0ddf0c12718b26dfb130d307c06c5d9c5e313991ea7a24ae
MD5 38a86dae1ecceba3f4f46b8d8162db48
SHA1 a263678a7e32ad5a4038c6a13db16f92466021df
SHA512 64872f4f4e9c773b41c1a703a9ed8381e1cd0197549de466bd7eeaa9c5fe91d812327e448a5b762aaddb290e92cecbdd79cd1c14cb22d64320908ecd2a8b5cc7
SSDEEP 384:RZcIhsNOCcUlusYb926IdEaACEJrSu3nTKwBODNZOCb5o:5hQ07UPyhSQnewBKZOgo
TLSH
T115928E715C786C379EE7B245F48632075EF88177F6C42E98E6EDBB1C01A66981307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fd3750ddd7996475bd79b049ff7de62d4736c147393461a9833316b61919dd8c
MD5 b276add97d4696474916ef19cb0b1bfd
SHA1 defb859b00eff7ed696cee75f6668f372ed88e41
SHA512 1c990b1865732c8c211b35f47900da13ef6b06ccf641b69cd998c7e4b206a9175c1ae99823bcd6595d47ee8e9dac5db07306ba465df9e9e2d9e96abe0b4c4163
TLSH
T1A441F858A6E91104B3B77F5AAFF6A96D447EBD772F06C09D00110E4F0A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download