3bd79bdac1090b1ed880f511214df6978081abbb0aada22d02eb45d303e41561

Analysis

user interaction
yes
max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MzU2LVVWSC00MDMAAAGjfTdnFTqU1CM4pa6TRzoKWXeKhpeiCxyF3ZMGk8A_9eAwmPjEfN7rKz_BX3eqQSqJu0d98FM=.html
Size 516B
Sample260810-s6sqlshb74
SHA256 3bd79bdac1090b1ed880f511214df6978081abbb0aada22d02eb45d303e41561
MD5 c4e31bc30bf1614462241d17aeb9c286
SHA1 441a4a66e11f85264bebed13dbe7e564037ebb91
SHA512 df9f94bf130c7e2211b0309f9866b1dbc8726a63da169016f6218541acc6207bcef4babbc397666d3856847db1983a8b78089c327419c4b1454e530b37d3fd4f
TLSH
T11CF005D33C40D11235968728369FFB1DD0339464000DF504F1D2D4174D82B9E46AF5EE
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
257	api.ipify.org
263	api.ipify.org
256	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308502906981980"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A63D0F6D-0053-42F9-90B7-2F87938F1C87}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1744	2648	msedge.exe	88
PID 2648 wrote to memory of 3612	2648	msedge.exe	89
PID 2648 wrote to memory of 3480	2648	msedge.exe	90
PID 2648 wrote to memory of 3480	2648	msedge.exe	90
PID 2648 wrote to memory of 3480	2648	msedge.exe	90
PID 2648 wrote to memory of 2656	2648	msedge.exe	91
PID 2648 wrote to memory of 2656	2648	msedge.exe	91
PID 2648 wrote to memory of 4512	2648	msedge.exe	93
PID 2648 wrote to memory of 4512	2648	msedge.exe	93
PID 2648 wrote to memory of 4512	2648	msedge.exe	93
PID 2648 wrote to memory of 1780	2648	msedge.exe	94
PID 2648 wrote to memory of 1780	2648	msedge.exe	94
PID 2648 wrote to memory of 1780	2648	msedge.exe	94
PID 2648 wrote to memory of 1232	2648	msedge.exe	95
PID 2648 wrote to memory of 1232	2648	msedge.exe	95
PID 2648 wrote to memory of 1232	2648	msedge.exe	95
PID 2648 wrote to memory of 836	2648	msedge.exe	96
PID 2648 wrote to memory of 836	2648	msedge.exe	96
PID 2648 wrote to memory of 836	2648	msedge.exe	96
PID 2648 wrote to memory of 456	2648	msedge.exe	97
PID 2648 wrote to memory of 456	2648	msedge.exe	97
PID 2648 wrote to memory of 456	2648	msedge.exe	97
PID 2648 wrote to memory of 1064	2648	msedge.exe	100
PID 2648 wrote to memory of 3680	2648	msedge.exe	101
PID 2648 wrote to memory of 1064	2648	msedge.exe	100
PID 2648 wrote to memory of 3680	2648	msedge.exe	101
PID 2648 wrote to memory of 3192	2648	msedge.exe	103
PID 2648 wrote to memory of 756	2648	msedge.exe	104
PID 2648 wrote to memory of 756	2648	msedge.exe	104
PID 2648 wrote to memory of 756	2648	msedge.exe	104
PID 2648 wrote to memory of 1548	2648	msedge.exe	105
PID 2648 wrote to memory of 1548	2648	msedge.exe	105
PID 2648 wrote to memory of 4284	2648	msedge.exe	106
PID 2648 wrote to memory of 4284	2648	msedge.exe	106
PID 2648 wrote to memory of 4284	2648	msedge.exe	106
PID 2648 wrote to memory of 2020	2648	msedge.exe	112
PID 2648 wrote to memory of 3928	2648	msedge.exe	113
PID 2648 wrote to memory of 3944	2648	msedge.exe	114
PID 2648 wrote to memory of 2132	2648	msedge.exe	119
PID 2648 wrote to memory of 2132	2648	msedge.exe	119
PID 2648 wrote to memory of 5072	2648	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MzU2LVVWSC00MDMAAAGjfTdnFTqU1CM4pa6TRzoKWXeKhpeiCxyF3ZMGk8A_9eAwmPjEfN7rKz_BX3eqQSqJu0d98FM=.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffde1fc188,0x7fffde1fc194,0x7fffde1fc1a0
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1888,i,12004094313281711214,13344061717536267357,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14452584566220221731,3986463311557930985,262144 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2592,i,6564197547475016824,361296550572715752,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,1153124367044589808,9300673102056153020,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16133258769917792833,7398594287074586208,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7577703439611603229,10813587714043826862,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,9524792657041336858,4140033490295903643,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3784,i,15285510779669474941,3092741160747565245,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5348,i,9821937851901496148,13814603932473456713,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5440,i,8223804164811600495,1596181129788105647,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6232,i,15354406015559536114,544074721574061372,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6232,i,15354406015559536114,544074721574061372,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6072,i,3112846339935243327,6077591239642834739,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6496,i,16990352919272631187,5476962693528470619,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4536,i,6584978366231620066,16422053854710489911,2097152 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4320,i,15489898601118316588,1434205557072046277,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4300,i,13233890365513265261,15417817814461649238,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5128,i,7623111044354565466,6302336358859183402,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4840,i,6185934376813702317,13694716644264284538,524288 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1028,i,12828970472967516648,7659906860415630085,262144 --field-trial-handle=2132,i,17452677870659702922,7447019753105573042,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 255deeafe48e1abddf8d523cfd86b560f79efc5f09fdf23b02fb60dbe9892f74
MD5 5a7768fa8a9cd2394dce45ae7789be6b
SHA1 0efff7ef9d9541bd6ea38b1c9153561bb23c7ee6
SHA512 df8e1d1e286121c7539d72fe176a5a9ef420bb750f843239ccd09506074811819012dc4de001886f137b2e637f4ae034c2bc29b74d3dd19dd017cbd9dbdae31d
TLSH
T17981C91809D1254EEB34D230C0E01B137E36D5FA85779E3A86A0ECBF96173D7AB6501C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594c61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594c61.TMP
Size 2KB
SHA256 1935fac2932640666f0721dc2bc436e3adcdcbe3262f7afa4e28aec6958e8e6a
MD5 4606ddf197ae39a7a5a5ab6bb73632e5
SHA1 3aa9b9c14f42edf69ee669543884949da0775bd8
SHA512 2287c268df284f32e9b50e676c8bc0ea526a1083139278d58c91c18dde2cd61e177b3823f80b6291a7e68063e7563da5665f16d1b947d0db501761c36fc98049
TLSH
T1F5514F180651649EE730D231C4E01B03BE36C1F9897B8E390250D9BFD7277E79B6901C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67544a19-b90c-4bad-a4b6-79066dda6a83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67544a19-b90c-4bad-a4b6-79066dda6a83.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 6c9497cfc6313d5942538da3b09a2a97b4b90d639b7caba0298f3f9b759d8577
MD5 51f2d9937fdebfaaa74dca67f679b570
SHA1 f95f3e23b5e26592a6493c084f5d45e2fd441445
SHA512 c35fa0d9f81fc36f728341db35aacb942f100b84072713f5574ed1f04f929d047bf4d8285c2a3f507e161b8c7cfb6cc94b3a62adca35de755989a9d80658888f
SSDEEP 384:DmRJZ/cEDlEePEe8e+e+zJ5cvuU8uqIhK5o0fzrMxnsQ/Ibv+i9uYrxI0RdeEVRZ:eSYhE
TLSH
T160527CBB83E9852DCD121AF95618AE1BCF1A0624431D3C2BE9D57E0BD3E3072E11675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 be0a9ad0b57a2884873eae0f9738383e29df2aab2f65aad382ee4668b61eef1e
MD5 c5062f2ecabe993ed2180a5682522f9f
SHA1 9247b9f54989d31ddd64284cef5c48e41cf3b179
SHA512 e79a559a37c8da3004bf4c40e5171451e4ff77b5d72b90d842c9d169b8d59fe9d19862757b40bdd86d58340646b171068a8a6e71a1a1b0b247bb9177e1ca2890
SSDEEP 192:sxZ1RqyM/jK1Ml8Mk5/f4spDe2Idpdo6EHW6+WNGYwKZ3GIgrJ:sxZ14M5/f4spS3+HHbG/9
TLSH
T15742F905AA34A97BCCCBD209FA55BF53D6F9447292900E44A9FCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6fbfaf1e0db3bcdbccc463943bea2768991f8a8ae30a5f005582eb9ab8f71fc2
MD5 9e743add2533c4c7b491db77e5ec7aaa
SHA1 e2bc4edeaac661597e197f5f5f14fefa58ffa190
SHA512 cc25baed2c9275ec6c241ef998dcb433047501c52bc8bd3c7757fba8aeee9a8b897ef7e0ffcd2bf7d17d8db818bf08579ca3f0d7d229e2865fb1e6a2a79b1923
SSDEEP 192:sxZARqyM/jK1Ml8UQok5/f4soDbpY+AfpHo6EHW6+WNx3PlYwY6GGIg5BJ:sxZAYqL5/f4soHCVBIHHb1l3p
TLSH
T11C5209056A34A977CCDBD209BA55BF53D6F9547292E00E44AAFCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32f23f4d9ce6d706ca316cdfc38e765265f8ac53b6c0edcbb5df69b3cc4da7aa
MD5 1cfbf026befed1254a81754b6a6b5c4c
SHA1 9c36832fec5a6555c445fdc9e6a073abc17679e2
SHA512 4e3ea01c237383dc8c1387e3de045e95d6cba73b283761e0b920b8dc7aea670a1650c2d0e910127cb1d29173661b5a253d6cc1e9c56a4b7189f28fba489e47b7
SSDEEP 192:sxZARqyM/jK1Ml8Mk5/f4soDepY+Afpdo6EHW6+WNxUV/Yw0Z3GIg5zJ:sxZAYM5/f4soSCVB+HHbC/h3
TLSH
T1F452FA15AA34A97BCCCFD209FA55BB53D6F9447292940E44A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 088912edfd27ea97e79a25fafd63646b9e9e385647dd4fed8ec220cd6857ace7
MD5 17fa51421d3398cfb6ea0c716b0c4793
SHA1 4191be5fad8f92303a5049cca3207ddc46986bb5
SHA512 07f903c606998ebbc49e5db86e17703e0198e3cba6e84c863214d2f519607ca42c2fa26e5f0a498dfc3c7059250bafa40a7986adc556a9b68a81f8f5faa34c9d
SSDEEP 768:ER4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dzrohMNGKaT:ER4jeXmWvmKxEu1jacPLZQdAl
TLSH
T124E2093B280CCF7E4F844E5DED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0fe123974cd908893314a6465d997337260559d73887ec29da20044b9641f3db
MD5 b80a0dd8315b9ce25b7d19111b9f93ef
SHA1 67e0a6d8363e6605e07062c8ce6568ca90cd3b4d
SHA512 d531b7dd875c6bc9659867992f28856bfc442d7b44895e3f3b3abdade24dbf4f17307474cba3826c46cae438bf7225e8bd798d6227f8d2f3a4c45b9abd25e7b7
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCcVaR1PR:WvdxjfnVaR1PR
TLSH
T164C1F29A30BF02163D7D2519A2A4C7674F417AA33019E42B7BA940B20DA7E350CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ac7a626-6bf1-4c67-bc84-3fcff8f1a729.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4ac7a626-6bf1-4c67-bc84-3fcff8f1a729.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1b6c05e1e7e0e2203c314737b232924bc641c7610e72f570eed31ebcaab05254
MD5 b11e28f0240d6d0868cd26ffdf9fdc2a
SHA1 d770d0bbb876e32dc043e582622522e652772040
SHA512 98bc385a76e063917cbaf6e10fc1316a6cad9b67ec20b1dc7ff85ce5bdc6b663804ec6fd14b5e8ba8e9a9354eb8ca39acb145b5fa43a056e092a7d73bb7699be
SSDEEP 384:rZcIhsNex2P771yf+MOetB+2LFW6HlytEDq1pYWn:zh+P9ahOqBl5Woy6DqcWn
TLSH
T107927D3159386C364AEBA551F48B36134FF99127ABD86FD4E1ECAF1D04CA6AC230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb193940221b39b3bef684de71d706d99af57cc9a54fdc4ac137069d393ff47f
MD5 a08c6bda193def82282f49a57d651f23
SHA1 86be8c03dede90c2d5cceaef6a2f84b2876de113
SHA512 f301589b679256f4edda64067b60f016704a18af5db46f5505e4bfe828f174ec6e05ccd0d1a36e0cdebcbc0c76ab14abdfec6b4bd68fd128490a41e048a0587d
SSDEEP 384:z0iFiZcIAzsNu8TUNTUlIlJ2P7i7yf+MOetB+2vFW6HlytEDq1pYWn:DFQczwgSPAahOqBltWoy6DqcWn
TLSH
T14CD219F244D79836D9AE5743E77E2D134EBDC027B594AA90B3986A1CCC861BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35ecfd987a6e58b93f3fd59057d311f9a3b9028812e529a81b520d148ca30917
MD5 aa17338b6ba1c34edb4652c4a499c693
SHA1 23c27baf4a08e186e7d5c0875a28fd91ef79bae7
SHA512 bb86a7c7bc1d546b39ffe0da82908294597fb2a50eadb5f1e1d5487497818db0b7c0f7b604ca56fb267be4ae348a38fbe9c3b5a1d5e9803de30ede2c05475498
SSDEEP 192:EONg6hZ0QmiUyoGpc/+jVqO1Qz5wOZcT9U6:EONg6oqpu+MOeK2cBU6
TLSH
T1C102E73968686C778EE2AE45F48737235FE4112BE9A56F84D6E81F1D00C779C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0802c7cad5336fe6dc8fe43ca7705f2848599cf80f9e4ed32a00dd59fa433101
MD5 415aaa84bde04ce8d01d3443663ee867
SHA1 239f83a5d251880b53b936e813f90fec50c239af
SHA512 3ca218ea86d26f917973395bf5b52b67bf8e79e3528d7a3df204011516e079f6703815aac565f2101a709717018839e57f51a604482ec6b8b7afed796d2889c9
SSDEEP 192:9ONH6hZXQmiUyOGuc/+jVqO1QtB+2bU5cOquqCU6:9ONH61Guu+MOetB+279WU6
TLSH
T19A12FA356868AC774DE2A551F48736134EE9522BEAC9BFC1D5DC2F1C04DB6AC230BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4bb813dad3e1ea48295fee5d4292b0f13db33a07ad971f5a5d7ff7d2a4b55cdc
MD5 cc1d55c41b6df654790621202b28161e
SHA1 ffc2b37e004b4c71e43cfd38c8df61532001cfb5
SHA512 e2e519dc5e27bfed265f5739ef148983760e1fbddcf9c2b22215d6631689534c61a49d0ea82ff99afa2698bf51c9b3d468f01cb6088be796344017919ff12c4a
SSDEEP 384:7OZcIhsNeJ2P7i1yf+MOetB+2LFW6HlytEDq1pYWn:ghuPKahOqBl5Woy6DqcWn
TLSH
T12A927D3155386C364AEBA551F48B36134FF89127ABE86FD4D1ECAF1D04CA6AC230BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f1350578f55b367884eaa16dea575cc6f07eb383e25fd51a18b9ebda9fb8421d
MD5 05c24530ea1c5794aa303c9e1677da18
SHA1 897ed93047ea5c4570b6ae55c84d9c0144f135df
SHA512 44a52747e3ba654991099b6d779fcc3ca0951d0feb7fd69e0f9da8ed5293a45394dc36aa01012a64ddbdc9298e86dfd64512c058de8f1e869a27695a51d08e56
TLSH
T1FE411959B6ED1148B3B76E4AAFF6A86E447EB9722F06D49D10100D4F0A27B00C962733
MD5 SHA1 SHA512 TLSH

Submit Download