hxxp://acendalife[.]app

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://acendalife.app
Sample260814-e2p72avcla

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3320	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311552024070537"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{308DD227-4E2B-4015-9B23-0B6236F6CA8C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
808	msedge.exe
808	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3788	4576	msedge.exe	85
PID 4576 wrote to memory of 3320	4576	msedge.exe	86
PID 4576 wrote to memory of 3528	4576	msedge.exe	87
PID 4576 wrote to memory of 3528	4576	msedge.exe	87
PID 4576 wrote to memory of 3528	4576	msedge.exe	87
PID 4576 wrote to memory of 3820	4576	msedge.exe	88
PID 4576 wrote to memory of 3820	4576	msedge.exe	88
PID 4576 wrote to memory of 2076	4576	msedge.exe	89
PID 4576 wrote to memory of 1172	4576	msedge.exe	90
PID 4576 wrote to memory of 2076	4576	msedge.exe	89
PID 4576 wrote to memory of 2076	4576	msedge.exe	89
PID 4576 wrote to memory of 1172	4576	msedge.exe	90
PID 4576 wrote to memory of 1172	4576	msedge.exe	90
PID 4576 wrote to memory of 444	4576	msedge.exe	91
PID 4576 wrote to memory of 4936	4576	msedge.exe	92
PID 4576 wrote to memory of 444	4576	msedge.exe	91
PID 4576 wrote to memory of 444	4576	msedge.exe	91
PID 4576 wrote to memory of 4936	4576	msedge.exe	92
PID 4576 wrote to memory of 4936	4576	msedge.exe	92
PID 4576 wrote to memory of 2440	4576	msedge.exe	97
PID 4576 wrote to memory of 3148	4576	msedge.exe	98
PID 4576 wrote to memory of 2440	4576	msedge.exe	97
PID 4576 wrote to memory of 3148	4576	msedge.exe	98
PID 4576 wrote to memory of 4800	4576	msedge.exe	100
PID 4576 wrote to memory of 456	4576	msedge.exe	101
PID 4576 wrote to memory of 456	4576	msedge.exe	101
PID 4576 wrote to memory of 456	4576	msedge.exe	101
PID 4576 wrote to memory of 5060	4576	msedge.exe	102
PID 4576 wrote to memory of 5060	4576	msedge.exe	102
PID 4576 wrote to memory of 5060	4576	msedge.exe	102
PID 4576 wrote to memory of 1184	4576	msedge.exe	103
PID 4576 wrote to memory of 1184	4576	msedge.exe	103
PID 4576 wrote to memory of 1184	4576	msedge.exe	103
PID 4576 wrote to memory of 2212	4576	msedge.exe	105
PID 4576 wrote to memory of 2212	4576	msedge.exe	105
PID 4576 wrote to memory of 2212	4576	msedge.exe	105
PID 4576 wrote to memory of 4148	4576	msedge.exe	106
PID 4576 wrote to memory of 4148	4576	msedge.exe	106
PID 4576 wrote to memory of 4148	4576	msedge.exe	106
PID 4576 wrote to memory of 3180	4576	msedge.exe	107
PID 4576 wrote to memory of 3180	4576	msedge.exe	107
PID 4576 wrote to memory of 3180	4576	msedge.exe	107
PID 4576 wrote to memory of 2740	4576	msedge.exe	108
PID 4576 wrote to memory of 2740	4576	msedge.exe	108
PID 4576 wrote to memory of 2740	4576	msedge.exe	108
PID 4576 wrote to memory of 1308	4576	msedge.exe	111
PID 4576 wrote to memory of 4588	4576	msedge.exe	112
PID 4576 wrote to memory of 4224	4576	msedge.exe	113
PID 4576 wrote to memory of 3932	4576	msedge.exe	117
PID 4576 wrote to memory of 3932	4576	msedge.exe	117
PID 4576 wrote to memory of 3372	4576	msedge.exe	119
PID 4576 wrote to memory of 3372	4576	msedge.exe	119
PID 4576 wrote to memory of 808	4576	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://acendalife.app
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc57fbc188,0x7ffc57fbc194,0x7ffc57fbc1a0
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3171872374832101206,1260927718816400660,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,12082603072060450705,2520494788968696128,262144 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,8271176334908560711,795672737149535752,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12258804576818974370,15061302160563175947,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17308046032971632350,13634786248424897141,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,11836491294936663049,14770050541011360745,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17370495412200729741,17076578053712956490,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,3718981701547632225,7162140471920113656,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13320467085561376210,7930365399435811585,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,2746667501465009648,18135295720784161122,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,2746667501465009648,18135295720784161122,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6092,i,14485402392225806119,2017005049722858070,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3636,i,16670987614231171410,5037227940614371848,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6132,i,2290068892258627678,1334929811032538342,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6344,i,4925156292485488878,17995584414540412101,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3508,i,13686754459875932515,10543864329853369136,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5796,i,4739569452140603971,10714485331365886653,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6628,i,11586018281026827870,5329447722097178648,2097152 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,10700267168513158164,17259634035166298569,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,13523214389734217856,15990799549304452931,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,951462718600003484,14191103879556435715,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,11217354976009750977,11819614328563784335,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,14497436747667918216,9116272585091989028,524288 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6324,i,735175896380314643,17031111152172755215,262144 --field-trial-handle=2372,i,7205744136830600955,15798571898088852624,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1f8ba2a37de6c8c9ae001b6725d090ce5b33798cbaae424ba0ea86e61f06f86a
MD5 4a926e8dd8d4d3b87d7b7a9617682b71
SHA1 23e6605f66280385c04f5641836a2225da8fb77e
SHA512 8c4bea49fa25d2c4da22079173043a36724fd384cd5255563de2a511fac36165ac6ab498266f759a7d369b224b66a78e97147c292d194659ff9fe00d205fe921
SSDEEP 48:FcOj6VqcMSFqEcSAd5DyOq5I1qlg1+sIuUAJ84tREmrF26Nlr78FniPW17F354do:FBQFU5qS1+shJ8ruuBqXuz4P7QNuHs
TLSH
T16D91A336013585B8E39BC1F0D3E782163E3A4DDAF2935E08AAC05E7E5495BF1DD1058B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 1b14a99c711f3cf35846390d6c95397e0284dafed6d58ae9e93525bd063abd53
MD5 6ab40b0e86ab93606d85f93563057663
SHA1 54c7a1c187ea2d629d132b398f1367eacd9eb77f
SHA512 f7767e4d608d973858510fbad87d8fc3bc1abf72b89e5eeaf057d27827319aae69a3e68260717d10605ffa9bc4770422273f59e1aea96d0a51849a9c6f3190df
SSDEEP 192:DmK344Dk7eReUM6g6eJ2HHRpCrYOIhuPVRbhg9isPekE8A:DmK344Dk7eReUM6g6a2HHRpCrYOIhuPB
TLSH
T12CF18DA7C2D4CE6EC81116F166247F1BCE2A0A68432C3C5DC9D5AF5BD3E25B1D240A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cf7511f79d37873f469a907413d864bf51d2ddb475b5b2ce360a8acfb7ed7e54
MD5 c34703c012c7295914a53c11a567ec21
SHA1 a395179578c810e8ab164c97cebb9c4ae44914e9
SHA512 f377297d963d594f14e98da0bfa8e6368e82f9f928694040efb08856aed32dd839ec424857d7171bac47ef67b996a5a04d1478717e80ec62cf55e6e7442b7796
SSDEEP 192:sxZlRgyM/jK1Ml8MkC/fssx2MIdpgOyHX36+WNd5n/YI6aQc/fIgrJ:sxZlKMC/fssx2VOHUf/c+9
TLSH
T14052D7126A34697B8CDBE209FA45BF53D7F51472D2900E44AAFCDA1C04E6AED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4564f22b18a0bac8d1df0a373c53cd82a6e0fa8e5cd6b09cc80394919c41ed34
MD5 83dd2b434a4b433dcddfa1f45a55a76d
SHA1 499218fe56463bf165548208e0d9e5f05d782487
SHA512 d443188dbe64227b13f71fe94454241f56708d42eecc839aa11c98ee60d4149eda2c6acb120a26096c386fc716bc56aa467cdcfc43cfefab14ef6114e61f5eb0
SSDEEP 192:sxZlRgyM/jK1Ml8UQDkC/fssl1bbIdpaOPHX36+WNd5n/YIfYaz5/fIg54J:sxZlKqoC/fssl1bE5HUf/fu
TLSH
T12E52D616AA3459B78CDBE209FA45BF53D3F5147292900E44AAFCDA1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 63cdd2d8a894f5d3067a0e74459f5caf7b09209dabc68adfee08d5dbe42fbed2
MD5 db5a8c3286c82ff343a1c12765b3e950
SHA1 fc71f5256fa55825318a30f78073bb191df13281
SHA512 df5bff2336c2dc7c73a066793c42aeccb945264a7a2031ea88bf651ab10130b3dca2bffaa0cfcc760e6803ff201b94ce9eb72b8fce56c8ba8916d37295dc9796
SSDEEP 768:brsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Eroti9:brsqxXlWvJD0Tu1ja54LAs9Pti
TLSH
T188E20B3B694CCB7E4F840E6DEC26AED76ED801CB66988D5447FA880C03C72EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 767a9da448fcfe99040cdd51204c911dc4b218068e33787cdaf14b65ea83e8f1
MD5 9986a75bc0cd0fd49c86e8b26f49f60d
SHA1 30f2110803b647a2cac8ee22ccdfaa0628237c64
SHA512 ea95864ef9256b53324e58e921426d055c3f22ee8ac9fc3458d1eb7ef591601fb45544a86248e8047264b48384440554c0daee517efc98cf773b51772903c06a
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyJ2IXK7KEHyh5CIfKfqMHy5WInKPK8nz:KYbaKYIKa2wK7Kui5CAKfqGqWgKPKgz
TLSH
T1FFD10F56753B12027CBD290CA7FA96374F4232633418A46F3FB851A65E66E120EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b568991-0a4c-49a2-8863-d22822705a79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0b568991-0a4c-49a2-8863-d22822705a79.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b1815baa52763bde26f24d6f35688c5dc55513c6a92ed6721ce78699b6db2ba6
MD5 61bb6acd9ed177538502b21faa115f5b
SHA1 84a9fe424e730bb69cfde71f989e223bb621fa00
SHA512 25208de4b2d13d80dd091bc3d5bebca8665393e6cb15289fb7e268abf744ace1208a23ad44909dd1fc1c3e7c85f0e73cb8b03dfaf0626d38e377647d053b80da
SSDEEP 384:tZcIhsNAefUmbmKbk8VRNkd/xVpOOPrXLpe8C/oB6:1h/dnSHkVpOi9PX6
TLSH
T167928E71A8386C675DE6B941F48726179FF8907BF6C52B8491ECDF0C01DA569130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 91ecc7946580b8b9ba9b2a38f690fae65167912d087760e10f7cc4ff6ea63247
MD5 29ac8b6522f0944c21835da7d29c50fc
SHA1 41268f5d0f2ed9c8524b5fd3ccbae774605e5cbb
SHA512 203715bb6151970a8234a955253fca5c126267a89ff47e3e7a6455d434e27b8125285cf3b841504a694faec8e7306a62f3c995fee9e7164914bacb20da2adf05
SSDEEP 384:kZcIhsNALfUmbmKbk8VRNkd/xVpOOPrXLpe8C/oB6:ChgdnSHkVpOi9PX6
TLSH
T1C2928E71A8386C675DE6B941F48726179FF8907BF6C52B84A2ECDF0C01DA569130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4f32e35e485fc197fffd0e55fa4aaa2edf4886cc2ca66c0ef9973db54ab98928
MD5 0cf6fcddf9d8f62056c78cf846584fe4
SHA1 92f0052458e75bd92c3d505ec903aa30e58e61fe
SHA512 3d2d464cb2d353c1ae802919728b268188f6f4ed55c252c5d5a4cc04c68a4cac20beb71f901837f11e3e82816980a365c6d4ef9d619679acafe5feac81467fe5
SSDEEP 384:LiFiZcIHsNA8TUNTUlIlLfUmbmKbL8VRNkd/xSpOOPrXLpe8C/oB6:mFQH5wgedsSHkSpOi9PX6
TLSH
T135D229F258E75876D9AE6B43A77E2D038EBCC067F5846650B3989A0CCD861BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2669bc8d2aa29ba554c5611bb95fdd3f2a70f829fe6a132a2e50c718ad3002a5
MD5 b82335aadc1f9ce6f939169b00d9be63
SHA1 defc366ffe11ff94d93a4d3080edbab40b8c7ddd
SHA512 03d5608760463e8832c5277af04e58fe2d1238ff4b4fa2c3b2103ca103731c3f0645024864295a35bd5a225074ef350fbe11e1f40d0434729d31116faa8ca0c0
SSDEEP 192:tONu6JkRtQmiUyZ/W+RNX+Fd10IeReh3BPR7U6:tONu6UrGW+RNkd/FBlU6
TLSH
T10F02B835AC382C7B9EF2AE09B58B27175FE5117BBA952B84D6E81E0C01D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 879e608a2f26476501bd89cc2269a21e3d9d158e79f4c8a2ab1c55c4b5bf4a67
MD5 2c862ac0a78ca8d6d04886a5abc25f33
SHA1 aeded88be519baadbc6f4ab58c683f497e64c456
SHA512 9d01166f70fbbd4237db3b9f79b61f203ad39ebf723b55c3c5a37ea162386d2e10d9d9a23d9ddcb6e5796af447809dfc91a675931a116843b634cddbd8eea1fc
SSDEEP 192:fONh6JkRNQmiUyLE/s+RNX+Fd10IeRfFebVcmq7xU6:fONh6ULQMs+RNkd/xSpU6
TLSH
T17712E93568386C7B4EE26945F48736135FE5916BEA8A7B90D6DC1E0C01DF6AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a687a57e-fb69-4753-bcf7-b9044dccf861.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a687a57e-fb69-4753-bcf7-b9044dccf861.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f7bf4bd5e71d39ef5b72d86fa582e0e3fb14a160856c03affb5f057cec4dbcd5
MD5 b50dbb8551c4b47fa35002f03647feff
SHA1 8c54fdcc8350310e814e2adbd26b94a2ca0c42da
SHA512 fd2ab64cdc306134e5721fd7aabc6d28d472b95b9f094bf7bf0fc81f82f27d0474fd03bfab03192bd9a51e220bdb7cce6d042f06038e17efe48bb6772e2f8346
TLSH
T10D41FA4DA6F91148B3B76E5A9BF6A86E487FBD732E0AD45D10110D4E0B62E40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download