hxxp://vericredi[.]com[.]br

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vericredi.com.br
Sample260812-kgsqbasele

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309972933348617"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A626C7E8-39DC-4137-B619-4786BF2FCF7A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2768	3544	msedge.exe	86
PID 3544 wrote to memory of 2808	3544	msedge.exe	89
PID 3544 wrote to memory of 2200	3544	msedge.exe	87
PID 3544 wrote to memory of 2808	3544	msedge.exe	89
PID 3544 wrote to memory of 2808	3544	msedge.exe	89
PID 3544 wrote to memory of 1608	3544	msedge.exe	90
PID 3544 wrote to memory of 1608	3544	msedge.exe	90
PID 3544 wrote to memory of 5084	3544	msedge.exe	91
PID 3544 wrote to memory of 5084	3544	msedge.exe	91
PID 3544 wrote to memory of 5084	3544	msedge.exe	91
PID 3544 wrote to memory of 2968	3544	msedge.exe	92
PID 3544 wrote to memory of 2968	3544	msedge.exe	92
PID 3544 wrote to memory of 2968	3544	msedge.exe	92
PID 3544 wrote to memory of 1812	3544	msedge.exe	93
PID 3544 wrote to memory of 1812	3544	msedge.exe	93
PID 3544 wrote to memory of 1812	3544	msedge.exe	93
PID 3544 wrote to memory of 4016	3544	msedge.exe	94
PID 3544 wrote to memory of 4016	3544	msedge.exe	94
PID 3544 wrote to memory of 4016	3544	msedge.exe	94
PID 3544 wrote to memory of 1360	3544	msedge.exe	99
PID 3544 wrote to memory of 1360	3544	msedge.exe	99
PID 3544 wrote to memory of 3956	3544	msedge.exe	100
PID 3544 wrote to memory of 3956	3544	msedge.exe	100
PID 3544 wrote to memory of 2920	3544	msedge.exe	102
PID 3544 wrote to memory of 3508	3544	msedge.exe	111
PID 3544 wrote to memory of 3508	3544	msedge.exe	111
PID 3544 wrote to memory of 3508	3544	msedge.exe	111
PID 3544 wrote to memory of 1340	3544	msedge.exe	112
PID 3544 wrote to memory of 1340	3544	msedge.exe	112
PID 3544 wrote to memory of 1340	3544	msedge.exe	112
PID 3544 wrote to memory of 3304	3544	msedge.exe	115
PID 3544 wrote to memory of 3112	3544	msedge.exe	116
PID 3544 wrote to memory of 4248	3544	msedge.exe	117
PID 3544 wrote to memory of 2564	3544	msedge.exe	118
PID 3544 wrote to memory of 2564	3544	msedge.exe	118
PID 3544 wrote to memory of 2564	3544	msedge.exe	118
PID 3544 wrote to memory of 4712	3544	msedge.exe	119
PID 3544 wrote to memory of 4712	3544	msedge.exe	119
PID 3544 wrote to memory of 4712	3544	msedge.exe	119
PID 3544 wrote to memory of 5016	3544	msedge.exe	122
PID 3544 wrote to memory of 5016	3544	msedge.exe	122
PID 3544 wrote to memory of 4300	3544	msedge.exe	123
PID 3544 wrote to memory of 4300	3544	msedge.exe	123
PID 3544 wrote to memory of 4300	3544	msedge.exe	123
PID 3544 wrote to memory of 1340	3544	msedge.exe	124
PID 3544 wrote to memory of 1340	3544	msedge.exe	124
PID 3544 wrote to memory of 1340	3544	msedge.exe	124
PID 3544 wrote to memory of 4756	3544	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vericredi.com.br
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9095ac188,0x7ff9095ac194,0x7ff9095ac1a0
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13746576071079147786,6787446822860005417,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10443597384702640064,5347811924568046522,262144 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,2335373981706328940,6146463914644576026,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1351931099403379169,14143085695427854875,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,6816353579398928280,13766122749861334270,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16387563738847162628,15112646093776186833,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,5708461327142514804,9667519665262122578,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,13293299470036662312,11048868782741873970,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14899471867384209363,16825057056543341779,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,8454304044836929709,16810925027805784748,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,8454304044836929709,16810925027805784748,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5952,i,368310225732826270,16473704629106798926,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3744,i,11807810205656785057,14120858247644795057,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,17496526624226507343,12732470036175189320,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,6200298795657399668,7045024803285829826,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,1433250993227872281,1161621431933321041,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6264,i,7229115246520079113,8589314805110908978,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3708,i,2581558382966400736,8571551470581924611,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,17407728615768462173,6861502292111635228,524288 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5920,i,9849140404878841636,2732426885932171947,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5888,i,16751162343074714327,15895807089640205323,2097152 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,9717275320036217977,969113493108790784,262144 --field-trial-handle=2472,i,14487581084176255706,3480775510681792033,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a26e5f7921ccbfdef041532affc7e3df9b3ea3e010dd62354be4dcd052ea170
MD5 9c75525d91e91d024832f780cf4e1aaf
SHA1 1e0e30c70f6f2c86f994420d5d78890a9deb9021
SHA512 31107b6308d889397b01a2934e7a32f08d1cd09aec08e6cb223785f966b247a3587d2022b8ea4d43384f692a3b726fad932cf58368fcee28f8765f92a488f4c3
TLSH
T155713B360087DCAEE71D00B06CC181F334718DEAF9471E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589863.TMP
Size 3KB
SHA256 7599d5a6c93ded0bee12048436e7afbcd6cb320a9b9db4bb97981b1777be754e
MD5 ee223af730663dcebb792dfdf824d90f
SHA1 094cef8f4ca4a448e32cff718e52484217f03bce
SHA512 da946f8485fcd208c455ff32ebb30e38c7ffaa0a2b297fb9edb0de5a56363ca7117668583274c5333880d6306feb6bc2e5b9ddca565e72f95a6d096dfe89720e
TLSH
T14C714D361087DCADE71D00706CD141F374718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 a37121dc64fe30f6d3c521b1ca5d5e8de56713ad4bc53b2fe3ef108d3dcd14da
MD5 c553bd2fb68c700b7530ff99094092f9
SHA1 fce43d91f34556ba8653ee85d66c6b2e133ddb76
SHA512 fc58416311dbed6e932447d3865f8d61df0ebe1afc465a4579eeaa48689724371f3338a08e6bbe7876df1e2e29b8090cec63c10aab04f100dffbbc8ef86bbb5c
TLSH
T1380140B3C3D4956E8A0156F06614AF17CF6D0546431C7C5AC5D4AE2BD3E3475D50185B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a9b308f0b58924248c50360f64c80b67deffef86a1e726ad02a980d470cbf7a0
MD5 ecf994f07df82beb718230b74fb83b9f
SHA1 cfa140306745b289de3696884aa16683c4df394e
SHA512 b70326275d771308c766f43c3696e8cffa687f00098d487be533523b720b353715db27fc8233e58fc629a4b66ff1ca2587d658e201bf58d93b48df90c62afb47
SSDEEP 192:sxZJRGkR/fZscZREEIdpJHGK6+WNGYzcZgTIgrJ:sxZJ3R/fZsORKJHOGI9
TLSH
T1F922C7126E28A47B8CC7D219BB15BF53D6F9503291D41E58EAFC961C04EBADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fc2fb375c65fd1ca83f889314fa74d33f2a917d70dcbba6f59019245089cbbdb
MD5 11082c5e94667d23b451244e69387b26
SHA1 d0618801f937710a162dee6a6951a5cd3de8cca5
SHA512 f153f159b23630a89b366914025b4a6b290419021ad78008b15107d65e8390056d22b11b988fd24308dccbec3eaa93682fe60b463b865843bbde8318352236ac
SSDEEP 192:sxZJRGkR/fZsLqZ0+jEIdpkkHGy6+WNGYz5jgTIg5lJ:sxZJ3R/fZsg0+JRH+Gt1
TLSH
T14622C8526E28A87B8CC7E219BB15BF53D6F9503291D40E58E6FC961C05EBADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 399b580b44c3ea6730828484c5e27fada29a5f77c84eb7312243412444b9e5c5
MD5 fa0fdd5631019d015474eb249f72f61b
SHA1 d20c067525954f8eb599ad0cc434a54f02a1e9e1
SHA512 f89d3e67e6d493835af091391f0e753bf2a603b9c08a19fe032c4bddcab3c675e245590b9680a47c374742697edb724dd5b3e0ddcfbfe6c4ca10edcbc840c380
SSDEEP 192:sxZJRGkR/fZsLqZRjEIdpkkHGy6+WNGYzQZgTIg5XJ:sxZJ3R/fZsgRJRH+GeD
TLSH
T18122D7126E28A87B8CC7D219BB15BF53D6F9503291D41E58E6FC961C05EBADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b5fd82ae76de7b6843b5aecaa5970c21ea9c44199a234c16bfd3115187b68ee9
MD5 cefa1fd53c9aff356abcb6d77f51e25a
SHA1 14e626ff804d3fd40c99160b0d8f611562e5b0f6
SHA512 cdf556447c4a8f266eb01b1cfb1baea91dfd75f9b18ec4ce11009bffb5f9d5dde829cf64dc966752047733bc0b892aeb660e0dcb0e1175fda8242ebca7901ef6
SSDEEP 768:2wk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSB9royoY7:2wk7u70WvqiEau1jai5LA3B2S7
TLSH
T18AC2E93B740CCB7E4F801E9DAC566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e350e0470e0b3421b9af678974136d4688ebdcd5dbf4c3765d9a9fcf27e6e3d
MD5 c2965366ca1e418159177b1e97daa81f
SHA1 bb55f87f2a03400d544a288a7a5831252b9176b1
SHA512 b751632a608ef9d7226dcb53a3eb8f2aeb4f8857110ba4163660c314508bdba2192c329479fca6717b50eb31264732aada34b9a152e842ba98796c427e9889a6
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcM2WLI8WY4x9ctsIG0xKb4z2xHuhwF04Sy1hI:KIbCKcvNSKWcZPSKkga2h6KCA6
TLSH
T1C391722934BB12103C7E695C9159B62A4E423A633518A67F3FA804A74EE7E114EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 676B
SHA256 4369a875c34b452b6cb84990d4df4383b1157165022d07ecacf0c421b273b8af
MD5 86c6953acce09677b7d8cdfc9ceed87c
SHA1 8ef3a0cd206ce99c8d9931f7435dde4d192828fb
SHA512 2e494258156dd47eb7639b17d26c55d7892aa89a00e593ff826a68d81905859a45ab23e5d97e02e74070ccf1b86fa6d5fa5683e0b46c3a64e4e3c25b36f4e397
TLSH
T1FA014490A6E560645E4AF55AC20E700354A23F76131D5831135D88F10FC4C100B2FD5C
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5933f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5933f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a8fb77df5517392e36838afcaab5bfa2f3a7da4b89091188342f59a1cd3cead3
MD5 625b1c8492b16846190bece9dd6eda99
SHA1 5e7606427bd91c7449274694680d40a6c14afadd
SHA512 8c205be1fb089ce8d047bb6567ace78049fc563577ed77c3bb75d59357aba45c0f19f348eb6edb5538f1a9c5b81cb16eab1495e51a0bedd4aa9acd6e4ac32786
SSDEEP 192:uGLsNChQdEuxjfBbQ+3QmiU1Lfn4aGBPKIOCHrWTPNcdN9bqELIJw:3sNChru5pbX947LCO9jLAw
TLSH
T140424C356C746D766D979141F48A3703AFB8817BE6C42F50E6ED6B1C01DF2AC230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4564b0dbbba8d6b2954159edfc8809ae9c8920854ab72b8f3306b84ecfdc22fd
MD5 bdb6cd0613176eeeff9c735266e46d3f
SHA1 b58feca60ee63569bda9aaaee31bf8db8e9a1967
SHA512 2b8d9aac8a532ade754d6d88ba7c8992dadd89d0a468cd47b5541e82fb6c3d724f7c51f116395cc74e697b44619e737822821b1aaa14b54587b0fd4e713ca64a
SSDEEP 384:tOiFiZcINsNa8TUNTUlIlHru5pbX947LC/9jLAcGq:HFQNPwgmpBqCVA2
TLSH
T161927D735CA4993EBDAA9A41F98922179FF48077D6C4AB50F7DCAA0D00AB19C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0723348840dd1b3b769abb2e6042159f00db19408978e3212c863d8b6659861
MD5 b6c1d38296a6d299823f375f62aa7879
SHA1 e274efd5b7ead096d4cf760f833af7e70c237c2f
SHA512 1d0944a2fe1907d0d5731d6513036c899629b2974612cd5452a91c515d5dee659f4751de6b7fbbb6c45dbe505aed13f3ef4cc8b584f5230df20ea5ce0a41ee7f
SSDEEP 192:MONx64BAQmiUy017W5GBPKIOCHruaD8jU6:MONx6eAvdW8LL+U6
TLSH
T154020C396C796C7B9EA2AE05F88637175FE4113BF5945F44EAE42B1C00D764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 ac0d99db49e7568a97eec871f82c4b1589f1f7fa42739f0971f692344c89358c
MD5 4103e43f5f6a596ded1b321f40417c46
SHA1 38c276222107eecf2434e09958a257d3cca84798
SHA512 4e9e68a9c522b72eab5a35decfbe3a6226643b10d821377f283892dde0cc2ac79393f75bf3fd3e18053e05d3c8540b65b84beb60ed95e21a01b3662cdf5fbb80
SSDEEP 192:uuQm+xasuheOwQxMGsNCHQdEuxjfBbQ+3QmiU1Lfn4aGBPKIOCHrWTPNcdN9bqEf:lTZcIhsNCHru5pbX947LCO9jLAcGq
TLSH
T11C728D716C746D3A6DA6A101F8C537175FF8803BE7C85F40E6EDBB1D01AB2A8230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3305283c6afbd64cf14cd96e8fe0d5082cfb1b7b71451ae8a1a260915249ef98
MD5 50a3c3f23b7ad3648c28dfd55c427356
SHA1 d86a8326a75e121689828c67728e89a04ebd919b
SHA512 ec0755f92e02d0d0c118ebe871bc67a2cdf8069df96f08e6784a7ce1658d4c073acb1197b845a8e27435f6eb007232e7bcc9a08e725e5bb20de0f3389beb6bf4
SSDEEP 192:eONT64BJQmiUyQ7I5GBPKIOCHrWTPNvWw9bqELU6:eONT6enpI8LCb9jLU6
TLSH
T151120B35ACB5AD2B6E92A540F4C637175FB8413BE6846F40E6EC3A1C01EF69C230691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a0aed5b9fec98fcf74a3739ace6b4ee2ef6355e74ccf4c09bf14b1e814b4d38e
MD5 4965a18f2b7fe5acd12824cf9425836d
SHA1 b6246c3fbdaf112a065ac6d27e2acb95ee689a38
SHA512 3de32fe0ee0ed159bf449739b6001b071fd711b1411d31e227fd0599a77342552a03f073fdaabf49f598987568994f204ab3b40544fc37c32358e3196c8db3d5
TLSH
T11841D758B6F91148B3B76E4AEBF6A86D447BBC772E06D45E10110E4E0A27A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download