a3ce30f85628f0a9d71cfb70962c308f9f905538add940ef8a74e4a2074dcc05

Analysis

user interaction
yes
max time kernel
27s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NCH.Software.Activator-DVT.html
Size 441B
Sample260811-fflhdswdld
SHA256 a3ce30f85628f0a9d71cfb70962c308f9f905538add940ef8a74e4a2074dcc05
MD5 6fe0a1cd11d2f4c3ffbc8fc01976fb20
SHA1 c759bc27ab673bc8df21c0f5b5881a08632b6235
SHA512 895c1a110b5081a17aa50995864541ab0609134efb6800684994b68e6f41f1601ddaed6bc4a58c1ef80a3f0e42be06d3e3c40d3f603b5fe4e68fde163c801ffe
TLSH
T1D5F0559E2C11D20B914135F2E0B2E14A088AD7ABE858896065C51CAE63E0BAECD42299
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs

phishing motw

flow	ioc	pid	Process
162	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	6012	msedge.exe
170	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	6012	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308973632882217"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{11C29CA4-207D-4881-9A98-696B890B5C43}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5332	OpenWith.exe
5332	OpenWith.exe
5332	OpenWith.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 6112	1656	msedge.exe	84
PID 1656 wrote to memory of 6012	1656	msedge.exe	85
PID 1656 wrote to memory of 1220	1656	msedge.exe	86
PID 1656 wrote to memory of 1220	1656	msedge.exe	86
PID 1656 wrote to memory of 1220	1656	msedge.exe	86
PID 1656 wrote to memory of 1900	1656	msedge.exe	87
PID 1656 wrote to memory of 1900	1656	msedge.exe	87
PID 1656 wrote to memory of 4352	1656	msedge.exe	89
PID 1656 wrote to memory of 2308	1656	msedge.exe	90
PID 1656 wrote to memory of 4352	1656	msedge.exe	89
PID 1656 wrote to memory of 4352	1656	msedge.exe	89
PID 1656 wrote to memory of 2308	1656	msedge.exe	90
PID 1656 wrote to memory of 2308	1656	msedge.exe	90
PID 1656 wrote to memory of 628	1656	msedge.exe	91
PID 1656 wrote to memory of 628	1656	msedge.exe	91
PID 1656 wrote to memory of 628	1656	msedge.exe	91
PID 1656 wrote to memory of 2132	1656	msedge.exe	94
PID 1656 wrote to memory of 2132	1656	msedge.exe	94
PID 1656 wrote to memory of 2132	1656	msedge.exe	94
PID 1656 wrote to memory of 3876	1656	msedge.exe	95
PID 1656 wrote to memory of 3876	1656	msedge.exe	95
PID 1656 wrote to memory of 3876	1656	msedge.exe	95
PID 1656 wrote to memory of 5280	1656	msedge.exe	96
PID 1656 wrote to memory of 5280	1656	msedge.exe	96
PID 1656 wrote to memory of 5280	1656	msedge.exe	96
PID 1656 wrote to memory of 4036	1656	msedge.exe	107
PID 1656 wrote to memory of 4036	1656	msedge.exe	107
PID 1656 wrote to memory of 4036	1656	msedge.exe	107
PID 1656 wrote to memory of 5856	1656	msedge.exe	108
PID 1656 wrote to memory of 5856	1656	msedge.exe	108
PID 1656 wrote to memory of 5856	1656	msedge.exe	108
PID 1656 wrote to memory of 2292	1656	msedge.exe	109
PID 1656 wrote to memory of 2292	1656	msedge.exe	109
PID 1656 wrote to memory of 2292	1656	msedge.exe	109
PID 1656 wrote to memory of 5816	1656	msedge.exe	111
PID 1656 wrote to memory of 5816	1656	msedge.exe	111
PID 1656 wrote to memory of 5816	1656	msedge.exe	111
PID 1656 wrote to memory of 2404	1656	msedge.exe	114
PID 1656 wrote to memory of 2404	1656	msedge.exe	114
PID 1656 wrote to memory of 2404	1656	msedge.exe	114
PID 1656 wrote to memory of 2272	1656	msedge.exe	115
PID 1656 wrote to memory of 4504	1656	msedge.exe	116
PID 1656 wrote to memory of 2272	1656	msedge.exe	115
PID 1656 wrote to memory of 4504	1656	msedge.exe	116
PID 1656 wrote to memory of 3856	1656	msedge.exe	118
PID 1656 wrote to memory of 3236	1656	msedge.exe	121
PID 1656 wrote to memory of 2940	1656	msedge.exe	122
PID 1656 wrote to memory of 3236	1656	msedge.exe	121
PID 1656 wrote to memory of 3236	1656	msedge.exe	121
PID 1656 wrote to memory of 2940	1656	msedge.exe	122
PID 1656 wrote to memory of 1156	1656	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NCH.Software.Activator-DVT.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff97c22c188,0x7ff97c22c194,0x7ff97c22c1a0
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12693808819620947041,10253161839511393230,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1367335194704388642,1899187652419216419,262144 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3473818579502161633,7032811274046767919,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14956200720145826284,3973295956888713480,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,17511314670186707573,10114087430055894807,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4888,i,6098915774003686987,6597802993063404114,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3720,i,5018215832043199112,7254171612677212304,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5136,i,10443016346260398142,2163577106583415063,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5308,i,12106406340178848463,6046871236691281935,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4888,i,17276373079043327388,12905464641883499254,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5836,i,6100993388819049417,6066098749482158865,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5088,i,11124389927177449803,11289201769671507570,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4792,i,17692600236258746732,6654318183036392408,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5864,i,5262705646654356648,2300629991940055945,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,8581949581083505010,12824498087311720878,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3368288696728176140,11175615947414382787,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1323397414418671131,18259754666352376227,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1323397414418671131,18259754666352376227,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5756,i,14285777824759868937,4015756024353889849,2097152 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8127491811312045881,9860920862220528325,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,741832446097192522,17470948239580444600,524288 --field-trial-handle=2364,i,16229318652567614842,16515879307348090154,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 59b873b55fc6abb4047305267187a82ec6ea177945210ac37863b527ea6d6c24
MD5 80158e2eb3c4cca14bc04703d6fc9b4b
SHA1 f5d0b411bb05aa3479a9527bc9cf13717dada9bf
SHA512 cb0f640d5ba503a7b16e29be09e20cbe8a691c20cfe6c0af6f804a2fa6cd84ba9f4f660af878a9bcf8b8da33de0131eaa0cf959a11bde6c3ae75af7a5733c7fe
TLSH
T178E02B65C821FC2708FD1B58A00D8656EB0113573650995F3F3CA2098FB462A45C685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0ebed0728b69ebd8a2813f8bc1fb9b054e707862a925233b74c80c8a57f54554
MD5 01488615ad31f834cbd88a5cc718802e
SHA1 b70cb4ccc6ecdaf172f0ad786e9329919470b1d5
SHA512 049af9871446b0053ce429dbae9ecf4a348db8f212c55ea0c65e1a88985d590e38fc2cedf96079836ae2b87be1ec9f121a0b373144712a89ca7beb103c44690d
SSDEEP 192:sxZRR1yMqZjK1Ml8M9J/fjsq6aZd/zodp+x2n2xeTC0HW6+WNv9pNbOYvIuVXPE/:sxZRu1J/fjsq6azU+a/HbvgOQr7
TLSH
T1CF72E806A6345D7B8DDBD219FA45BB63D2F8143292945E54AAFCCE1C04E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 880a2b9bc551549688c98ee5d924927f077e078d1234812da31dc83d15077d1d
MD5 815ab66794b89c58efbd071d30c44126
SHA1 ccdfe9b7002b8225b50ac3d140c480d737bb382a
SHA512 4ac0d1185cc8de9f6dc8df9c018a670e5a4240a43a99a56538c5d8c90432971ba27c26320823dd872df36f413e7bbb1f292f937f837ab6c47b05f9a0161bb36f
SSDEEP 192:sxZRR1yMqZjK1Ml8MkJ/fjssm6aZdDzodpCn2hC0HW6+WNtNUyYvIC+PEIgjxJ:sxZRuMJ/fjssm6azYNHbXrQj7
TLSH
T13A62E8066A345D778DDBD219FA45BF53D2F81562A2945E54AAFCCA0C04E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 205387cc36b42162429509840fe65e56204ae6f7449acb1a7664e4ade465bfa6
MD5 db3a73693f681fdbd7f69b1acdb80827
SHA1 1a3211689b384f916210ebbbe72eb671bdb5c26b
SHA512 75cea87389b84bb08440c21758e853d6e5d9d67ed127407805b83a02036a08e9d684025d09c520a8513cd00be5e7564d0b7aad35cf194d86c6ddd2d5f4a41d40
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrz:0LppY93PBZJPtN53Jpw
TLSH
T178B27B5A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d2c5d0955933d203a8d2b166262b34c5b474d4a0bf32bcc41df399e2bdf5c415
MD5 d1782b6955174c10955c2c3c3f3cb31d
SHA1 4ba0e6fd5471e9ac3fdd45b6d7b0df225ce518eb
SHA512 91f9ef7ec02fb621ef3d257364d379e4384b7771502ca04b677cb3f3ee313d9c217b154dd4294f64035cdf1a576c0c23cf33c6cd9b993c496866ff7b7da2c9d9
SSDEEP 384:np+XiF9CcmyWCs3sNY8TUNTUlIm2QckCr9jFFTpvBftGp+Mgj4Q4LxIse4KV8p0M:p+SFccps3BwgbkUjbdjGPVQmIsI8p0PU
TLSH
T11AC25B32E864CABBECE74B89B74A3903EEE05263C59C99E4DADC1D4C01D71DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 40aec36b5144a3d79a935e224a0e0f98d7218a28e0a8479ec8fd883ce6fe01de
MD5 c0a1e985ad637e686df3e7d1b962ee5a
SHA1 97d361b0c99b8297006dcdd35105fb22b0b19fb9
SHA512 42dcfa3a8a7185dcb3d310eaaa191892d367cf7d97b0ace467d0115fa68806ef87153d3a22ef1195ccb12c4d8032e24b407db5f3557e82363aa3c26ec5761636
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lqKpvBftGp+Mgj4Kqphe4KV8p0PHTt+:pAFccps3iwgbkUUkjGPVKiI8p0PU
TLSH
T1A4B25C36EC68CABBEDE74F89B74A7A03DEE0126785D859E4DAD81D0C00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8cbd50257c37a7d64ab5672125846370218715ad3838cd82e362bcea709c3a26
MD5 4be8e68e3fa42896a87c338109ff2b2e
SHA1 ed5876ab690fb3c4c443e75502e2f62b8bf0d7c4
SHA512 531432bab962752dd417744a303e1578c87f92eab6a35e2f87d6d74c6a7e8720736d9140094ab321a7a6d74f5069e5d7c4c6dc0b1b0dc45b6cac4e5408811c35
SSDEEP 384:npgXiFCCcmyWCM3sNs8TUNTUlI4FQckCrl6XrP2pvBftGp+Mgj4Q4L0IsOOPrXLt:pgSF5cpM3xwgEkc4DojGPVQVIsOi9P7
TLSH
T1E8D25A32E8A8CAA7ECEA5BC9E75A3643EEF44163D5CC5AE4DAD81D0C01C719D530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9494b85e30b4d234df7d8294bccc68c791ca4d296844d5b7e902554ec1f8760d
MD5 d068fe03e9e4543d76c9489cb83f7041
SHA1 37d68bd394d323c3ae6825c4eb295ad6d7550d14
SHA512 7198f864ffdba81eb118a35b892a0edefebff399f40c9238df930298a232b98dc827bc3bb8fe93c59ae813c00230fc0e187f6988d5d11e72ea091155637c54e8
SSDEEP 384:npgXiF9CcmyWCs3sNs8TUNTUlI4RQckCrlaDJrP2pvBftGp+Mgj4Q4L0Is5dty/E:pgSFccps3xwg+kcaNDojGPVQVIs7
TLSH
T106B23936E864CAB7ECEB4B89E74A3643EEE44263C58C99E4D9D81D0C01DB1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba178b4dc6b8eaaa0c0f4d0473c052df22baa0ed63ea57d2d35dcfa64134dce4
MD5 202d9697dbe2a32490315e9417ee4076
SHA1 957bc54ee37dc85cff7afa6f5718329526301895
SHA512 de0b1ec5115ba10cc114b24cded208a3e73d0d3a99622606305aaf2f16f41a4defc218e769476b0da1ae723fc58796975a686266896701d3fee3793f3f6d2188
TLSH
T1C3412858A6F91144B3B7BF5AABF6A86E447F7D372E0BD09E10110D4E0622B44D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

NCH.Software.Activator-DVT.rar

Path C:\Users\Admin\Downloads\NCH.Software.Activator-DVT.rar
Size 79KB
SHA256 28c606bff3678f8aabff9ec719630d2f6d3a4e876d4516099d20c67769b40381
MD5 ea74c7a649fdc7a35f026622ccecabb6
SHA1 ed52b3eb1ae50b8652b5e33af114dd944b23abc8
SHA512 332e52bf83ca33ef3cc7c5c8bcbb12a8af355d43702172c88f95cdaa36fc4b2a4397f8a148bb1a30baa180a281a858d372a2aff300409470f4a9fdd496cdacbe
SSDEEP 1536:cXWKEJiWghlI1k+OggNBUy8Mvti36/wTVmbX9TZwZJ0j2uMY/8I:cXQJ4muqgNKyYYX9TC0yuMYUI
TLSH
T1A783027264B9B1364B88B5049CB9D234EBB04E504587AD9671FF60F4F7BDA09812EB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3856-294-0x000001CCA0810000-0x000001CCA1810000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads