hxxp://hornbeamcairn[.]top

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://hornbeamcairn.top
Sample260813-qsm7vsak21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311015023566923"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{EBE9721B-3D70-4932-B46A-FCAE3EC01CD3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3064	1812	msedge.exe	83
PID 1812 wrote to memory of 2708	1812	msedge.exe	84
PID 1812 wrote to memory of 4984	1812	msedge.exe	85
PID 1812 wrote to memory of 4984	1812	msedge.exe	85
PID 1812 wrote to memory of 4984	1812	msedge.exe	85
PID 1812 wrote to memory of 2020	1812	msedge.exe	86
PID 1812 wrote to memory of 2020	1812	msedge.exe	86
PID 1812 wrote to memory of 628	1812	msedge.exe	87
PID 1812 wrote to memory of 4836	1812	msedge.exe	88
PID 1812 wrote to memory of 628	1812	msedge.exe	87
PID 1812 wrote to memory of 628	1812	msedge.exe	87
PID 1812 wrote to memory of 4836	1812	msedge.exe	88
PID 1812 wrote to memory of 4836	1812	msedge.exe	88
PID 1812 wrote to memory of 2248	1812	msedge.exe	89
PID 1812 wrote to memory of 2248	1812	msedge.exe	89
PID 1812 wrote to memory of 2248	1812	msedge.exe	89
PID 1812 wrote to memory of 1628	1812	msedge.exe	90
PID 1812 wrote to memory of 1628	1812	msedge.exe	90
PID 1812 wrote to memory of 1628	1812	msedge.exe	90
PID 1812 wrote to memory of 1376	1812	msedge.exe	94
PID 1812 wrote to memory of 1376	1812	msedge.exe	94
PID 1812 wrote to memory of 1376	1812	msedge.exe	94
PID 1812 wrote to memory of 3512	1812	msedge.exe	96
PID 1812 wrote to memory of 3512	1812	msedge.exe	96
PID 1812 wrote to memory of 3512	1812	msedge.exe	96
PID 1812 wrote to memory of 3084	1812	msedge.exe	97
PID 1812 wrote to memory of 3084	1812	msedge.exe	97
PID 1812 wrote to memory of 2416	1812	msedge.exe	98
PID 1812 wrote to memory of 2416	1812	msedge.exe	98
PID 1812 wrote to memory of 1552	1812	msedge.exe	100
PID 1812 wrote to memory of 1660	1812	msedge.exe	102
PID 1812 wrote to memory of 1660	1812	msedge.exe	102
PID 1812 wrote to memory of 1660	1812	msedge.exe	102
PID 1812 wrote to memory of 432	1812	msedge.exe	109
PID 1812 wrote to memory of 2292	1812	msedge.exe	110
PID 1812 wrote to memory of 4700	1812	msedge.exe	111
PID 1812 wrote to memory of 2960	1812	msedge.exe	112
PID 1812 wrote to memory of 2960	1812	msedge.exe	112
PID 1812 wrote to memory of 3820	1812	msedge.exe	113
PID 1812 wrote to memory of 3820	1812	msedge.exe	113
PID 1812 wrote to memory of 3820	1812	msedge.exe	113
PID 1812 wrote to memory of 3484	1812	msedge.exe	115
PID 1812 wrote to memory of 3484	1812	msedge.exe	115
PID 1812 wrote to memory of 4868	1812	msedge.exe	117
PID 1812 wrote to memory of 4868	1812	msedge.exe	117
PID 1812 wrote to memory of 4008	1812	msedge.exe	125
PID 1812 wrote to memory of 4008	1812	msedge.exe	125
PID 1812 wrote to memory of 4008	1812	msedge.exe	125
PID 1812 wrote to memory of 1636	1812	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://hornbeamcairn.top
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffd46f2c188,0x7ffd46f2c194,0x7ffd46f2c1a0
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,12588649057478148144,10959030275776135960,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6390459893326580437,15005202411213018167,262144 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,2862796636293231190,11780694719253547703,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8649454341809224672,18313138013673669065,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16643293294617979532,17964383014066593522,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7274068729366900276,7466999476975857229,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,1426297133379329802,12315434491520068505,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3676,i,6847055499754773243,2829748533226018470,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3592,i,5680753195059107102,5546345385532235412,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,12287430918003475707,9874703245190732582,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,5281335127832091942,1556826777384364961,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11865394583060356904,7782416768702347913,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11865394583060356904,7782416768702347913,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6340,i,8686221067118713661,3980737707240745888,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,7951182545990337122,11384858042932190456,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,2509964574850171958,14580165828815499926,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,5342901314903954342,13326405661559430608,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,425659142758852150,11510330658213766562,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5376,i,7728880272351619767,11442778039069008525,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,11827899434074494056,9855727476711412356,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8571292352618782989,3948065021699038297,524288 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1880,i,1896961163635274064,2276666081792546346,2097152 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,5138638990921385763,10773858444649310308,262144 --field-trial-handle=2012,i,9497760299602392320,10959541638642285244,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c1697ecc87af19c78e1daa8703b5ee185d270c97ce728f1347610d334db3bf45
MD5 720bd90669556fcdb1fe47923e6cc669
SHA1 9d9769d95a037d05a54b588906bebf958f396482
SHA512 70cce1a655843087a5bfe14b0f2057bf67040ba7b85411369770408ce0c9fa85526fbb7e5db51eeecd7bcd6a25d8f557b1571b94d3f45afda1b0eba2cef7ef10
TLSH
T1BFE078C408D5E61DE95077476258570C8394364FE2C4FD051F10C5C570476D0F3C35D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 44083afb907d9c872c4a8944912b87f85e150048b372a87847253cb1bf0c6138
MD5 075efa423fa62989b65e600b5f0ad148
SHA1 7714fd4e1077a393d427302ac358be200822a3ed
SHA512 a47876c00a7cb10deaf2fce1490e666b98f8cf9c6b84efbc1ec401d2e3d58e7df06ddd7fda497202faee907e5eeeb86f4bd73eed3e167d0415988d5ae193a142
TLSH
T100716F7803010061EBF11171B7E125D9B475A8ECFE679D89306C44F96AB836DD41DD6F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1a2a5b6c2708cf5664fa8641ffe130d983f93f76bb3c8ed56f2ded55205d75d7
MD5 82e99fda7abf0d5eaa7a61a5358c366e
SHA1 74145f7b2cd2dbc6341109b85a0da8f1b351b1d0
SHA512 abbcf426ea7d0bf3abf63e4227d1253df6e9b84db340ac956dcce29de26227b446ebe518389165bc639d487bab087a1d771b20858666319c71b00df56c61836f
TLSH
T148117DF3C3D5856EC91116F06A24AE2BDE2D0616821C7C15C9D4EF6B97F3075D00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b0a278b7a678d3f84cdd1abf29c13f293c1f957f67b3fcd92762db49f5716733
MD5 16b1e8ce41dd51594cb55db318e8fff1
SHA1 e7984aef5eb5a7bc1deb4d84ce623ccb723e61ab
SHA512 0011d95cf9831e0b8bab8afef437e263563cb95f8e8e4bb59e5d4dd3e6a464b01069ceb9dd7e452bd7090a6042e39bbebd492f495e81430dc77e68789a278fb3
SSDEEP 192:sxZiRgkK/fIsx1kViIdpI2HsZ6+WNGYvrmgXofZIgrJ:sxZidK/fIsx1sPHhGUq9
TLSH
T1A322B7126E28B47B8CC7E21DBA15BF53D6F95032A1D45E48EAFC961C04E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5a099365e4d75e4b499647243c648360069d0d80dd780a5e1548632522f79fc
MD5 b5af4e06563bc05ac5cb59a821ab9373
SHA1 1de5b0715d5c70b388460b646c636386acd06cf5
SHA512 2769bcb4efe0ed4b4b063a2034d573152244e717f088d0a4c50c3165b0732bf098f8fbe88c104f90ec8dfba864a453353f162ffaddd1bfd334db3968f8ae8eb2
SSDEEP 192:sxZiRgkK/fIs81kViIdpI2HsZ6+WNGYvrmgXofZIg5pJ:sxZidK/fIs81sPHhGUqp
TLSH
T1FD22B752AE28B57B8CC7E21DBA15BF43D6F95032A1945E48EAFC961C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fac6418999fefb7e826ccfa6cc4f51dff1e874d3c3cd780ea8b7d18e329f7f54
MD5 9291c07b2f4fba14d902256d4c1fca9e
SHA1 ef8c63c9dcb7fba21307fe207c9ccaf64952cd56
SHA512 5b3bb2aa4c6e072c056a10d1c0cfb95f63135284cc9d4b6d9bc1a8df04e62af33d661f04a0a5f81193c780f1bc5f99733d5fbd8babafa77bdde15ff57e7344da
SSDEEP 192:sxZiRgkK/fIs89kViIdpI2HsJ6+WNGYvimIXofZIg5TJ:sxZidK/fIs89sPHpG1q/
TLSH
T12322B852AE28697B8CC7E21DBA15BF43D6F9507261945E48EBFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3852b9267afd0bbf148a7d2d1f73198bb05abc1b9d4add8d4115f425125f196f
MD5 e0689abe7c82d1b21aea8c1770f9154a
SHA1 53c223bd02b77dffaa2a1aac2742b85feb1e7502
SHA512 9ea0aabdb6f4b51c2e551352f18ccab65ebaa6ec63c82d560ada65752ba7d5d92b17ea729b1d1376bfcbc1f976929f841b830ccea7dde131bd7865389968c6c5
SSDEEP 768:lgee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbWroC:lgee3rxWvhffnu1jatcL88btC
TLSH
T19BC2FA2B640CCB7E4FC00A9DDC5A6F977FA802C7A7549D4087FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66e55f40a22e9136a96b820e5784bacc6ee91cb5b46c16602162d95d1935b529
MD5 4378392e07ed08a83d593df70a07d743
SHA1 23a42811d0417d6a29ac359fd5cf7be39c8b80f7
SHA512 4022e096918a6a5c1d6ce206cec7cd3488815d328c91a22401101e2dad3a8bc7ddf24b926fce9bd0bea98216f02be453f20dea6fe8a47fefe820524d0a758436
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMDSI4:KYH+Kggmy+cKnKqimYKbaQSH
TLSH
T129A14316767B06423C7E3448B6AB96375F4132A73414E8AF7FB854A10E26E112DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7750558-1265-4dfc-ba80-71cd87548703.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7750558-1265-4dfc-ba80-71cd87548703.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c44ec15a81f68a786e3c47e20da3c8676749fcbcbc6cd7ac1fc48c55f748f188
MD5 504bce9d93e34c5de62cf749d8330e73
SHA1 4471159b8b7d49ca409e5f8903df01ae46ce34e1
SHA512 67bd78c87b3942980e6e621ee3545eaec03fbf266191d0edae95e3f8a6532bb8e6f9d516cad6c91e8d632beed7b8a4ccb7ac6b50cddf1ee576271473512f906d
SSDEEP 192:udm+xasuheOwQxMGsNYxLhQrILAYM7KfdQmiU1fzT4MTwz+FdLD1WSJrJ8z1NQqI:ZZcIhsNYxhAp7Ibdc0dbJruQMW
TLSH
T15B627D31AC74AC7B5DA3F185F48A36038FF49077ABC46A54E6ECAF1D01DA6AC1306917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1aadc5a75a745a4849a81cf48e9e585a931c9c8e93ebff63b24881cb4fc9ae47
MD5 7930e4b2bb9b78d507f377fe4d2e131d
SHA1 6a82a85687817ed0b36921555e6b2ebe050b8ffa
SHA512 1f3d726cffd7b93ed467c6a84b8b5800d42b26b71b27a60f55cf4f83bf2b24c86d9aa035fabaf73110b254230112c57d21d6a40ae63b9094f49a923ed21de0d1
SSDEEP 384:jiFiZcItsNI8TUNTUlIlehAp7Ibdc0dbJrOQMW:OFQt5wgnejVhOQMW
TLSH
T13F825B339CA4D97BADA7AA85F54A36038FF440B7DAC0AA54E7DC9E1D00DA1EC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 186ce76b76cc79dc7078b825bbe00b3eb9ec7da505e508a7b3b49c98062f98fb
MD5 eaf00c0ac002d5c80bef2ff7ad0ea8f0
SHA1 87d4cb7661a1e6aaa9efc22d85de06eba6d7057b
SHA512 8b484d6eef596c9950a1fbeb805aa6669310b1eb283d6624c66168392a574da110b4fcbbc3c44803977f78677072cf9f4de8ed4d13cd617b1fb5bc0040fde9d3
SSDEEP 192:zON56vM1PQmiUyOBMhTwz+FdLD1WSJr980INQqsU/u:zON56U1RpMndbJrCQU/u
TLSH
T176121931ACA4AC6B6D93B585F08B36175EF4916B9EC06B50EADC6F1C01DF6AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 986aa3d02a398bd1b4a7a981e196824b508327eb0ad6d0558a55f2dc792fcdef
MD5 410dff1e512e9b846f57029e31f50c84
SHA1 a33ab45adf0d20ccc71650a21b998bffa8c3e17d
SHA512 b782895e728f92cd94f077379aeedd0e58eb695aaf7687c8fd532bc651c4c31a0ef9e2ba69981083d271632778197029f412bdb1b5b07621b258a8403ba808c5
SSDEEP 192:uCm+xasuheOwQxMGsNYaLhQrILAYM7KfdQmiU1fzT4MTwz+FdLD1WSJrJ8z1NQqI:iZcIhsNYehAp7Ibdc0dbJruQMW
TLSH
T1E6626C31AC74AC7B5DA3F185F48A36038FF49077AAC46A54E6ECAF1D01DA6AC1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 681741b8365536d387f649fad1c98ec3ddb1ebb0e63a2f31f8f45c03dbae8716
MD5 9c0bc9a3785835c9b2df312abcc7dbd0
SHA1 51b5089bee5f5525fb0308f3fc4d460f18b463ed
SHA512 1afbf4e730f7b93dee0c0b050364d4c225a735b49868c6c3dc087c3e400c508c6ebc99a342a36c244bfd2d68e9b38131031bfce8855a69f1bbd9f1656e9cd3a4
SSDEEP 192:lONr6vMtPQmiUyABThTwz+FdLDf847NP6U/u:lONr6UtRVTnd/oU/u
TLSH
T127020935AC786C6BEAB3BD45F48A27175FA4607FAAD05B50EAE82F1C00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c26989e6-2f25-4d7a-a17e-10911addf5cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c26989e6-2f25-4d7a-a17e-10911addf5cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4617f448176b0fc083e5c1805c251122fcd45937ab057dcffe1255ac5df9243d
MD5 0dfbc7defeac93075d3b94f30d4b7573
SHA1 b2a5fb7df3dfb5cdd69f9a42d8700b6d0864cf6e
SHA512 b967647ad4b05844e30ebe1c02b7a2d7b921ff3badac1d0d510ca71ad334db81385ba64034a7b9cbc2d1bc0804a5ef04b16bf554287313e221f467a9c2d3d443
TLSH
T1B7411A5CA7E91148B3B36F56AFF7A86E487A7D772E0AE45D10010E4F0A72B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download