hxxps://bgp[.]tools

Resubmissions

07/08/2026, 23:31

260807-3h4s3svgpf3

07/08/2026, 23:30

260807-3hl82ax1dv3

Analysis

user interaction
yes
max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bgp.tools
Sample260807-3hl82ax1dv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306190660994213"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{8008C618-A44C-47CE-8A10-89A019EF4A82}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 2772	3788	msedge.exe	86
PID 3788 wrote to memory of 4736	3788	msedge.exe	87
PID 3788 wrote to memory of 2892	3788	msedge.exe	88
PID 3788 wrote to memory of 2892	3788	msedge.exe	88
PID 3788 wrote to memory of 2892	3788	msedge.exe	88
PID 3788 wrote to memory of 2112	3788	msedge.exe	89
PID 3788 wrote to memory of 2112	3788	msedge.exe	89
PID 3788 wrote to memory of 1844	3788	msedge.exe	91
PID 3788 wrote to memory of 1844	3788	msedge.exe	91
PID 3788 wrote to memory of 3492	3788	msedge.exe	92
PID 3788 wrote to memory of 1844	3788	msedge.exe	91
PID 3788 wrote to memory of 3492	3788	msedge.exe	92
PID 3788 wrote to memory of 3492	3788	msedge.exe	92
PID 3788 wrote to memory of 2900	3788	msedge.exe	93
PID 3788 wrote to memory of 1876	3788	msedge.exe	94
PID 3788 wrote to memory of 2900	3788	msedge.exe	93
PID 3788 wrote to memory of 2900	3788	msedge.exe	93
PID 3788 wrote to memory of 1876	3788	msedge.exe	94
PID 3788 wrote to memory of 1876	3788	msedge.exe	94
PID 3788 wrote to memory of 4672	3788	msedge.exe	98
PID 3788 wrote to memory of 856	3788	msedge.exe	99
PID 3788 wrote to memory of 4672	3788	msedge.exe	98
PID 3788 wrote to memory of 856	3788	msedge.exe	99
PID 3788 wrote to memory of 2428	3788	msedge.exe	101
PID 3788 wrote to memory of 3632	3788	msedge.exe	110
PID 3788 wrote to memory of 3632	3788	msedge.exe	110
PID 3788 wrote to memory of 3632	3788	msedge.exe	110
PID 3788 wrote to memory of 1008	3788	msedge.exe	114
PID 3788 wrote to memory of 1008	3788	msedge.exe	114
PID 3788 wrote to memory of 1008	3788	msedge.exe	114
PID 3788 wrote to memory of 2428	3788	msedge.exe	117
PID 3788 wrote to memory of 2428	3788	msedge.exe	117
PID 3788 wrote to memory of 4448	3788	msedge.exe	118
PID 3788 wrote to memory of 4448	3788	msedge.exe	118
PID 3788 wrote to memory of 4448	3788	msedge.exe	118
PID 3788 wrote to memory of 4420	3788	msedge.exe	119
PID 3788 wrote to memory of 4420	3788	msedge.exe	119
PID 3788 wrote to memory of 4420	3788	msedge.exe	119
PID 3788 wrote to memory of 2076	3788	msedge.exe	122
PID 3788 wrote to memory of 3924	3788	msedge.exe	123
PID 3788 wrote to memory of 3948	3788	msedge.exe	124
PID 3788 wrote to memory of 4336	3788	msedge.exe	125
PID 3788 wrote to memory of 4336	3788	msedge.exe	125
PID 3788 wrote to memory of 4336	3788	msedge.exe	125
PID 3788 wrote to memory of 2368	3788	msedge.exe	126
PID 3788 wrote to memory of 2368	3788	msedge.exe	126
PID 3788 wrote to memory of 2368	3788	msedge.exe	126
PID 3788 wrote to memory of 1624	3788	msedge.exe	127
PID 3788 wrote to memory of 1624	3788	msedge.exe	127
PID 3788 wrote to memory of 1624	3788	msedge.exe	127
PID 3788 wrote to memory of 2628	3788	msedge.exe	128
PID 3788 wrote to memory of 2628	3788	msedge.exe	128
PID 3788 wrote to memory of 2628	3788	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bgp.tools
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffef85fc188,0x7ffef85fc194,0x7ffef85fc1a0
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,7115838905000535164,12590557951560496870,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8036578805540773372,9310654611797041720,262144 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7258449831678800312,12841560669657399770,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13472149202495635162,86766979511205476,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8009513057231146777,11938721360733204388,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,5285795805246929942,4320883821864556519,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,7915160389311234527,1654820861517125306,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,13225073475463898986,17883522810826880910,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1832487439699090867,3221491243699482195,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10084228151516685605,2387329643918358071,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10084228151516685605,2387329643918358071,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4268,i,541910065872355963,4497002872009677461,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3536,i,3004627884084835324,3167498177713858842,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,16916645440827856902,17285021352990559394,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4492,i,14336920535354993045,13736368564073279856,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3492,i,11116101996147404971,10778783151853945808,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,1916383727057695844,2411163847493802759,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5646529765838131338,1454131492248335472,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7440543609938057250,18190241642226702911,524288 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3676,i,7938767339276977171,14326053311102769325,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5040,i,16886663049671210045,16144188125466508828,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3712,i,7859124198965346292,2550595352291496293,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6492,i,18396419207799184372,4242254541434576300,2097152 --field-trial-handle=2192,i,4149819570740177119,11998693234632507163,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8d8ecd351f359aa78da43f50092a55081b9cf052235a684da86e07f0a412fdab
MD5 747a27ce8c855325cd24f9df95e8018d
SHA1 94c9415f1560aa52af4b981b0f7feb8a356a0fa5
SHA512 57c76e074301a27787d28be711418654ff00a03b3106ac0c33a737601110713da1e1e56a898de3d283f1a309c328b51a37c5ad747a982eb6d77ffc52586cc2cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a7e2854504e9999ef337047e5f6b3d98f0b526be92093057537491002dc1376
MD5 a9e52e6b00929d5b48e4a07066d7d8b3
SHA1 4751abebd77a68765b8621023b2115950f8e5985
SHA512 fd0731878729d9cd95f6024dbdf0c920e83f05ed68960005c878989b07c4261a3fb5cda263e450036cf8f2e0a6fb79d01b32743ca06b2c25f686164da053f1ac
TLSH
T130713A39C50E48A5E7D1133291E20157B83D86CBF803FE8542A0BBB757E4713828EC87
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a6ab.TMP
Size 3KB
SHA256 66a766e0eb1e44bde3331ddc5f326aad4c2526835cb222e6286bca098b353e37
MD5 9830e34cc363a951a512bcb1b8f86c83
SHA1 cbb441ddffb838336a54a8e1b47b4b106bc362eb
SHA512 a34984395c9d6d83dee1fb166f12c44ec646e2b029b35a4d985d8d68a564e5e3073d052a165350c7463b87740bff93c578e013d9cca61b98a424f7048dd52cf8
TLSH
T18C713A39C50E48A5E7D1133291E10157B83D86CBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e3ab3663adbc2435ae138c72a78844c798ac1fd434ed5c95dc7da07b35f0fca9
MD5 8455699653dddb64c5434aae524fb064
SHA1 95b0a7e2db24b7af5bfc409267468abe61aecd82
SHA512 9544d84f5a4122fa3756e5b08c36953272ee2c06f49077bb956ee4639589c4e5b48077a0dd7f4224b1bc0e98f9c39281dbdb7304aa3bf1ec21016c0ad835692f
SSDEEP 192:sxZ2ax/yM/jK1Ml8Mklg/fFqsMNQXGxE2IdpJHW6+WNGYzcsXEIgrJ:sxZ2ax5Mlg/fFqsMNQXG23JHbGP9
TLSH
T1DB42D7126A34A97BCCCBD209FA557F53D6F5147392900E44A9FCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a84901e27ff5e392eb46e84d34630c5fd07963d7efe64d0048796641892f3e3
MD5 fca47a34759d18ba2b35e930f77631ea
SHA1 124aabeae23d6897ff7361535dc050dfcaafc7b5
SHA512 f43f74e5604e264b7fd46eccb329af5949bc40ef7cc8370862b43ebcd5660c40c3da7f84ce15af86f90097b8a6741db21c490676d4cd68d12a572dc95f12f8eb
SSDEEP 384:sxZ2jx7Mlg/fFqsGNQSGY3uHb9/4TIM/N+m2:sujxAlg/fFcuSGYeHb9/4cuNz2
TLSH
T1A752E852AA34997BCCDFD209B941BB53D6F5147392900E44AAFCDA1C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 77f1aee5ccb79e65f41357b9f753642450c7d9fbdc7b50f49dfd5d0f26a3cc9d
MD5 b6e155d48e20bc491b34279942100a7e
SHA1 577e6f9c5d111dd2837596c8c188702150532f20
SHA512 00a5d81cab65cfd8417ebc80aaada1e397edc0cbefb21643794b03d25dbd76669b145bfb52ee82d871b356a999ee931810a5e45a3c3a459db21002a6ca78631c
SSDEEP 768:EHW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjrroIdi0Yh:EHW7kf0Wvqidau1jaa5LA3jYTh
TLSH
T1F0D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a5aa97932824e246372d81e7a688fd92a6ad14da9bb1a90f6024d5bc83bc241
MD5 a364efc4907de0e3ef3ef58fd3af7dd0
SHA1 ca05db60003e059661ec15ae9bebeb5be6207e9a
SHA512 6b9ccc91ccbb74e6ae996f54074434548f8c83034752a191bf8de86eaa29c4d6225e12646f088962c2057c53cb1e8e1055cb8dba5c9e7639894f86942afb9e88
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTWVce7I1KcEI7y1BItKC4AW3ItKJ:KIbCKcWVce7KKcE2WBiKC4J3uKJ
TLSH
T1AA91C51AB17A1601387E6C58B66B86774F4336A33108A4AF7FB814A70E66E114DFCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2ba251b2332d21291d9c9ac4f74238c2cce8f6bd6c976da936333e2b97fa7a10
MD5 baeb9bfa3a7f8e53aa5686d8ae4d6d7b
SHA1 2ad1f26637742b8cc43323dc92a1e7c2bf741769
SHA512 1ca4abd405cab2968dbf2f0a2faa6b8d506ccd907deeb0f628b47f66323cb65c9d2a3afb85ffef57e1f3998f52d428c1f3b6182ecac2a1869027f1b483a61640
SSDEEP 192:uGLsNtkQUz0gBbMRZQmiU113z4aGBPKRV+FdGy5gk+2+dNbq1nU8:hsNtkXz02bMVb8zd5L+2cMnU8
TLSH
T129322A366C78AC7B4EA2A151F04737039FB4416BABC46F54E6ECAB1C05DB79C231B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9acfa3854376bdadd767ea77774d357a4d7e053974905428223868fe54fb6943
MD5 16603cdea5391c663167ca7b0eefc50a
SHA1 9ea170a0239e5f30bed16f295cbb800939447d60
SHA512 d62909c376b4795bb30051311f69dbdae0734ea64916372ffc2944d8ed79a512da866fd90516924d9d7396320f786c2abef82216178e1335817c96617750b8af
SSDEEP 192:MONT64BAQmiUyd1cW5GBPKRV+FdGy5LaDtvPSU6:MONT6eA+SWcd561SU6
TLSH
T13B0209356C787C6B9EB2AE45F58637175FA8107BEA906B44EAE86F0C00D764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61c093232c7cf091b79b8079e90e425ed766cdf3ad2be2d17f267acd64548d59
MD5 8860e09720b6167b007499484a9e57a9
SHA1 de4d5b4e27f8f5d82f02bad4f5725481035467bc
SHA512 42f3f7bfc6b52a03735c60c4a710f388e10fc0ed51c1c4f410fef0a3f8d77f881b28fe4d696cdef83bf66cbbb2ea75907ae33e366cbd5cb72ec7af57c755f0dc
SSDEEP 192:DONQ64B7QmiUyUcs5GBPKRV+FdGy5gk+2iWwbq1nU6:DONQ6et+scd5L+2AMnU6
TLSH
T138121A36AC74AC2B5EE1B541F08737035FA9426BEBC46B54E6EC7B1C05DF69C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5b4756728c8a0d9c1c34211b0a04f2735e82543cb8b454d12712f0e144928f20
MD5 a309ee5b6d9bb070ebcf1a5b5a2aaf99
SHA1 55607473b212a363c7dc3073b6e031348e9b8133
SHA512 e933c73ed18d70fd954c06e1e9352bbd566360ece1d374a7987954623d8b593e524fdbf1d5896dfc392d6916686bf8735c41195fe9360f43d9382e037bd2a5e2
SSDEEP 384:KZcIhsNtHXz02bMVd8zd5L+2cMnnTKwBODNZOCA30r:ohV2AH+rlcWnewBKZO330r
TLSH
T16E927D326C389C7B4EE6B145F44636074EF891B7F6C42B54E6EDFB1C01A9698230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 544eda2408b68a3bc0271e8e3bd83b06bdfb0505c3fa703f822452327db3b31f
MD5 d77542d5e4f4f929d3c18f0b1ce093be
SHA1 fcf18e736a1d8d8ab7013da91418e226c187bae4
SHA512 f3ddeb2edb2241c71181b51846f5910b7f0761693b3a6c4b097b0d1803ea44ed434c97b978fa9fc653e77d4dd3020303f40aafb6b6532193e63fb5ba3d03786e
TLSH
T162412858EAF91144B3B77E5A9BF7A86D987E7D732E06C05E00110E4E0667A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads