893a54932c3e74381a0b53ecf1553ffa7f0cab3d61f0ba45f8197f321ac7fedb

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260813-wtke9avtex
SHA256 893a54932c3e74381a0b53ecf1553ffa7f0cab3d61f0ba45f8197f321ac7fedb
MD5 0e72fa536f65cf1856e4783c4502710b
SHA1 12e55b94040fe7dc0fc0cea90585ab7eca8b7d5f
SHA512 d099a32b021c89606f668bd3c3a254bc1c432a930c1647e08faed15958bb184565d89d6387048688c65d82a48153fc41dd6dc76360f5f8270b1743613db711d6
TLSH
T182718355A781500571B3C3A6FB32470AFAA3C053C7064649BFFD21858FF291AC6637CA
MD5 SHA1 SHA512 TLSH

Score

8^/10

backdoor discovery rat

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	3460	msedge.exe

GoToResolve remote administration tool 1 IoCs

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral1/files/0x000300000001dbda-95.dat	rat_gotoresolve

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311183794328677"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D0660BCF-C815-4052-A7D2-CB22FF975BE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4248	2608	msedge.exe	85
PID 2608 wrote to memory of 3460	2608	msedge.exe	86
PID 2608 wrote to memory of 4836	2608	msedge.exe	87
PID 2608 wrote to memory of 4836	2608	msedge.exe	87
PID 2608 wrote to memory of 4836	2608	msedge.exe	87
PID 2608 wrote to memory of 2456	2608	msedge.exe	88
PID 2608 wrote to memory of 2456	2608	msedge.exe	88
PID 2608 wrote to memory of 3632	2608	msedge.exe	89
PID 2608 wrote to memory of 4552	2608	msedge.exe	90
PID 2608 wrote to memory of 3632	2608	msedge.exe	89
PID 2608 wrote to memory of 3632	2608	msedge.exe	89
PID 2608 wrote to memory of 4552	2608	msedge.exe	90
PID 2608 wrote to memory of 4552	2608	msedge.exe	90
PID 2608 wrote to memory of 3900	2608	msedge.exe	92
PID 2608 wrote to memory of 3900	2608	msedge.exe	92
PID 2608 wrote to memory of 3900	2608	msedge.exe	92
PID 2608 wrote to memory of 3892	2608	msedge.exe	93
PID 2608 wrote to memory of 3892	2608	msedge.exe	93
PID 2608 wrote to memory of 3892	2608	msedge.exe	93
PID 2608 wrote to memory of 5068	2608	msedge.exe	96
PID 2608 wrote to memory of 1404	2608	msedge.exe	97
PID 2608 wrote to memory of 5068	2608	msedge.exe	96
PID 2608 wrote to memory of 1404	2608	msedge.exe	97
PID 2608 wrote to memory of 2656	2608	msedge.exe	98
PID 2608 wrote to memory of 2656	2608	msedge.exe	98
PID 2608 wrote to memory of 2656	2608	msedge.exe	98
PID 2608 wrote to memory of 4340	2608	msedge.exe	101
PID 2608 wrote to memory of 616	2608	msedge.exe	102
PID 2608 wrote to memory of 4816	2608	msedge.exe	103
PID 2608 wrote to memory of 616	2608	msedge.exe	102
PID 2608 wrote to memory of 4816	2608	msedge.exe	103
PID 2608 wrote to memory of 4816	2608	msedge.exe	103
PID 2608 wrote to memory of 3360	2608	msedge.exe	104
PID 2608 wrote to memory of 2520	2608	msedge.exe	110
PID 2608 wrote to memory of 4440	2608	msedge.exe	111
PID 2608 wrote to memory of 1220	2608	msedge.exe	112
PID 2608 wrote to memory of 2332	2608	msedge.exe	121
PID 2608 wrote to memory of 2332	2608	msedge.exe	121
PID 2608 wrote to memory of 748	2608	msedge.exe	123
PID 2608 wrote to memory of 748	2608	msedge.exe	123
PID 2608 wrote to memory of 4448	2608	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,11208358920916246374,8608314433388549422,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7036097243658299195,5690628182329213219,262144 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,5957881664652673549,12760896288754894748,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,447934800645956164,2751907704639243331,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16362600016403714990,15649728175449911343,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8296771068463831191,17402403995202234546,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,12237159969313520590,9425034547699737096,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,1683285208131461370,10722387051229325170,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2409873280859022299,5225303812008208367,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5528,i,9819574877076601041,16139665017178431287,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3294429635848096587,8086551038926635474,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3294429635848096587,8086551038926635474,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11151454530256691023,13856370703446582005,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6212,i,17228271991687730381,9780526702941738492,2097152 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,535323494902949680,6603018993811043487,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,15301689112395820882,11241402960923687058,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3410318631885543880,15988441069115173622,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,17920229269088175560,76659879177501383,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7112633184490355837,8409829074257906320,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,13962860422046324727,9287785634346419182,524288 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,16648672552502411090,11743946041659382423,262144 --field-trial-handle=2212,i,12942328186641129749,14468007456704046625,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 39025a8de2823844c77630d63a6bafb9d0ffb8fdd0474f9726f0cc36b0da33b1
MD5 316b784656367ea32ccad41d3547f199
SHA1 3e63757ca663af293fad4b32f7c86acf2892e061
SHA512 d15b524093e532e6f75c3ae5d2c3b5589e135579ace4600c368d2c056c561ad6c9c6bddfc636e7c2372c0fe8b5dfdb860374fd30a6bcce146022bea3d8644909
TLSH
T17171453533118058E3220872DFD916EB763685E7FCAB3E8111F2BC749521F728666B5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589805.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589805.TMP
Size 3KB
SHA256 0514c12765129b3efadb78a6c4fe643b976c04abf373cc17743b49c13fff408d
MD5 7595fb6b76c6707fa088bdec4d2bbe12
SHA1 d0f60f4ccbba2ad98e2cc5df85d15fc90aa5d81f
SHA512 03bf39f06b4c425b2b272ce2633989daa2e2b87d042b47e0f04b678c215a5271100734b4dc064d0788eda850aa0f619ade2b039fd6c0ef830fa9198b4b46b503
TLSH
T1B371433933118058E3220872DFD916EB763685E7FCAB3E8111F2BC74A521F728666B5C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 76ad2ec623375e7ec8b32d9661f343ead28042d9779e46f6b5d4c97311002724
MD5 54f76f554d692c0580894495874fe851
SHA1 e7de07f58b29fe4959fcb09c32ca94619e5a5c4f
SHA512 150c81d0dc8ef61e773523d70e632920423cf0ad8c519592a3512133fc1d2ca97abadec542885ef07f7ec2547387a24d8fd5b61d64a9ce4b2e02b5343272553f
TLSH
T15E1190F3C3D5D56E890116F05A24AE1BCE2D0646421C7D29C9D4EF27D3E3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 149ec6a97e06324acd39d328c1bef2b67add20b08b29ec5c170543d582e3d719
MD5 59f274225449bbe7a1a49783870a71bc
SHA1 22f569ca5878dc81032929ecbfd6151950d6d38e
SHA512 9404d39b1656e7b7dbd731aaa07066667b0651d4ecbebad91fbc352e3c959d2cc0a004c70e521dc725ed9de45328a2d996a846eeec65f69fdbe565f129bb6832
SSDEEP 192:sxZYHR+9P/fCs7ceVZIdpdaHW6+WNGYvrCj+0IgrJ:sxZo2P/fCs7cP0HbG3b9
TLSH
T1B922C8526E78A53B8CC7E21DBA15BF53E6F9503291D11E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 334a979f6b7ac6844622662445362eb29daf7c0f8a1618f4ae5f521185ede7ef
MD5 2722c52f48a7582213b46e3fd603739b
SHA1 fe1d2f77578500cceb384e207900b1f8c9f1c227
SHA512 d78306a8c3dca9b4b3a6adad7d46d37a511ec60537ff131abd3ac646f2e6bd9326e13448c55194df25367e76ed12f4ccec9da5a84dc8c35e5dd686f18027d8f9
SSDEEP 192:sxZYHR+9P/fCsgceVZIdpdaHW6+WNGYvrCj+0Ig5lJ:sxZo2P/fCsgcP0HbG3bh
TLSH
T10222B7526F78A53B8CC7E21DBA15BF53E6F9503291911E58AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cb015b67abda8bcd3124400611f04f9c5e0316031e8ed92c4027989fbf8c437b
MD5 84f383f3ab6ffb756edb8b8b0dcc2a9c
SHA1 b49c8bda0443fbc8885db33210a9469265ea7d92
SHA512 63098a2bd59fef160fb0c023484d98289d6f340a676f9c606277cfe792105421d866567ddb5d1feb626e5344bbf85ec5b71321dbd57643e72b1c86249499d085
SSDEEP 192:sxZYHR+9P/fCsgdeVZIdpdaHW6+WNGYvM2j+0Ig5PJ:sxZo2P/fCsgdP0HbG8bH
TLSH
T12E22C8526F68A93B8CC7F20DBA15BF53E6F5507291911E48AAFCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a52fc43f52dd404c7d9c1c9c2bbb745213dd09fdf8fe1f5de210e9b017ecf6c8
MD5 15d768c8cfbfa3cb29e7f3e3b66a3e91
SHA1 2e18b183e53833cac84eee0e958911f1cec2d49a
SHA512 848c65809a63ad4d1ccaa02e44224b1311d82b7d5c4b8cbbd0a1aaea8440278c56938ffeb50d6a77a2c1263a67b9e4e7233f2d784d9965345d8db51d73e18216
SSDEEP 768:MPee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pb7roO:MPee3rxWvhffnu1jatcL88bIO
TLSH
T1CAC2FA2B640CCB7E5F800A9DDC5A6F9B7FA802C7A7548D4087FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596b82.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596b82.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 58491b2bc01b5b45a89819a17c8ba02467457207e824c00e59106d0f85fc7e2a
MD5 d290f36292edfb92f65dab935f5e7be8
SHA1 a24c336272eb195b89157854d1d8b63a0099b4be
SHA512 8246c316965fa703bf199bd67732bb5b024aba696ea83f6c849c00bf55c0b3817fa251d2b9d689656212c2417f41995cd2e073facf20fe380e502e43acf3bd94
SSDEEP 192:u0LsN2sQ1yM7BbyQmiU13iq4MTbt+FdLjv3mh18z1nqFRS:5sN2sQ71uk1Dd/72RS
TLSH
T102423A316CB8AC379DA3B185F04B36035FF8816B9AC46E50EADD6F1C01DA2EC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c45895a3290248cce7b3a772435b52567e635239434536e61bec66491f9c7625
MD5 40a339ae6b147215eb89a46a3fef4815
SHA1 12eddb87d36001a3166641cb6a22817aa8ff5754
SHA512 d04627c648e7b832aa983456ca54a29f8d0d5fec20aaa57795d26b0e7f2a51c293f4f5547a9a66fb12b307793f7924241f995ce631eb96343f78c5b78d3b184f
SSDEEP 384:3iFiZcIzsN28TUNTUlIlJQ71uk1Dd/Z2S3:yFQz7wgwVJlZ2S3
TLSH
T141824B735CA8983BADB7BA85F58A36039FF48077D6C4AA50F7DDAA1C019A1EC0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 01a420b181a8aeb16c5827c384a3ed180853bf99d8427b9ea7b58a9ecbee9fa6
MD5 c6682a3245af26d0d668fceb2ca6e353
SHA1 232caf9b3dcd9308c5841d2c7d0193c2f2695b45
SHA512 4399b11240ef8ce41433c417b8b63c76b0620a21ef67ebced07304af92ae538589362eec2e7d18a424ea804490252e0dd10439629c61079cd79a5c3ab6bd1d00
SSDEEP 384:PFiZcIzsN28TUNTUlIlJQ71uk1Dd/52S3:PFQz7wgwVJl52S3
TLSH
T19C824C724CA8983BADB7BA85F54A36139EF48077D6C4AA90F7DD9F1C019A1EC0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70fe61998f71efe8f40d4042a09d28da5bd733b0f3150230d651559171c6c8bc
MD5 89e7b3aca34ca5222fd4928da19706b5
SHA1 8558443c3872513a655d26872bee561da6181ee5
SHA512 773fba1c8a796cd851563d9acf22f62943e4eb4a839bbb9907bee3c124ac5f8d71fcc116c557e2d17c49fe2164244c2daf7e3deea5fb1a2da5620d0801807bec
SSDEEP 192:lONe6vMtPQmiUy0dThTbt+FdLjv3mR847BajU/u:lONe6UtRFTMd/+gU/u
TLSH
T105020935AC786C67AAB3BD46F48A2B171FF4117FA9905B54EBE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f0d3402145ae7e9071f86b172402b838616412cbd86807bd75697d313ff6425b
MD5 5ecada88445d350a72d991d01eb8f1c7
SHA1 9555cb53b2247d629ad567dfcfbeac65fb4d6f74
SHA512 81b8d4a948095f8700ee1dffc3378a0693b166a450bb2055921a29561cc950ed0b32499c9854bc992e7180071caf2540ded2614ad0e739680f943ad7042fe800
SSDEEP 192:u9m+xasuheOwQxMGsN2JQ1yM7BbyQmiU13iq4MTbt+FdLjv3mh18z1nqFSdYy:TZcIhsN2JQ71uk1Dd/72S3
TLSH
T163625C715CB8AC3799A3B145F58A36135FF8C077D7C86E50EAEDAB1C01DA6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e0ad14654871ac173222756a09eea558da0b496e0c25e515283ca14d3bc9db8c
MD5 7313bd3aa20b70b1ca1083ffa53ac638
SHA1 3cf011d4217f7970fd903e6cc4c01f5b1a3acd5f
SHA512 d6bc1e59678c70f14cad6c4bec04b779eb513e9eceb1757619bc6744fd5b0998d29e4a07a7880a729ad8f923fb068e9fa35328aadb50d73b9285f4481e3af949
SSDEEP 192:u0m+xasuheOwQxMGsN2DTiQ1yM7BbyQmiU13iq4MTbt+FdLjv3mh18z1nqFSdYy:WZcIhsN2SQ71uk1Dd/72S3
TLSH
T1EF625C715CB8AC3799A3B145F58B36135FF8C077A7C86E50EAEDAB1C01DA6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4ae3c5dda531b3bedfc68c8247b7fc0f6a94ebd68cf31b5daa556a60b10f45cf
MD5 c5a64f486e8abcc239f73c84b2deeea3
SHA1 192524c797e675ff11c795079aed540085a984a4
SHA512 145bb8ee1e226adc9cf230b1c2f5fc0e1a5f6719a323b49a9ad4fcd18c2e2601939db594bd69941a74c523b778ae0007d1354ee0c1f4164098b8c6d8af3d2acc
SSDEEP 192:EONv6vMlPQmiUyidHhTbt+FdLjv3mhJ80InqFU/u:EONv6UlRdHMd//2U/u
TLSH
T1AE120B316CA8AC67ADA3B495F08736175EB4817BDAC46F50EADD2F2C01DB6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6f37b7501264ad41bd8874cb1fcb3b138385341389bfda9de2d460bb4f207c76
MD5 cbab2fab5c6fe16969aa4e4754608772
SHA1 fbe6cd3fcaf9fbdc2bfe7699b9242896dddfa05d
SHA512 ff82a75c6e0bfa16f87b6b172939d384a5d9478793416a56b3f883b10880ae4bf1ecf71d2c3df38565cbb6bffe7341f1f33b7a2878441e4f7f8511e2a6576bfe
TLSH
T11241F958B6EA1158B3B76E16ABF6686E487E79772E07D45D00010E4F0673A40C962B37
MD5 SHA1 SHA512 TLSH

Submit Download

DINNERPARTYINVITATION.exe.crdownload

Path C:\Users\Admin\Downloads\DINNERPARTYINVITATION.exe.crdownload
Size 23.3MB
SHA256 69f7fb5a0c75717cff2210e9fff40b7158a907f0880539806d96cc7dd8662743
MD5 fe47a85059b87a4e787efbd531b87031
SHA1 01e2a7ef6a03c43b8a4790aecc67dcaa21eb63ed
SHA512 02033553ae2727830902406f54ad6110864bf0e9440ed14963a8555766330f0548f983c7df18cf80cd99f35079471af57d20ffbe1ccc7bacd84f62f8ec1e6618
SSDEEP 393216:YAwoMOd/9DYp3Q7xwvcqMcfuIp6HIaW947I3Xon91m/FHVP+zTLy3qOZXMdtW6hy:4oN/98pg7x62In947T8ZkHe3q6F6hljI
TLSH
T12E3733317156C171D48711F1AD28AFFAC2ACAD35877948CB73D85F2A9B709C26B32A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download