c3e7fc3a30910080de78ca1cf5fb3dc2e81eb38fd829dff70c6abb4c908373aa

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SmartTechReno.html
Size 10KB
Sample260815-armxpsvgqa
SHA256 c3e7fc3a30910080de78ca1cf5fb3dc2e81eb38fd829dff70c6abb4c908373aa
MD5 b565fe46a1eeda3662b1d7594d9213cd
SHA1 430a529ee3f322c1c5c848027558b5ffdae0f7ec
SHA512 f750898716e12802b8c794019618c80f2a4d76e6a7f33ebca4ce9bdf05611dc9e351bad4adfc194fcf8423555296f5b99f0ebb67d4b506cde6c18ef831780878
SSDEEP 192:V5273KyXw+Gn3i1wNwGGRpTH1X3VYxLY3Lu:V527EnuwNwdRpTIG7u
TLSH
T10122EBBF9AE0CCA3575446EAEF76B44A9C020157DE94C8C4F0ED4B051FA0EA70C271BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312272245417648"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{52FFD897-D216-4A45-B001-B80CAE1EC08A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2392	2524	msedge.exe	89
PID 2524 wrote to memory of 4948	2524	msedge.exe	90
PID 2524 wrote to memory of 3344	2524	msedge.exe	91
PID 2524 wrote to memory of 996	2524	msedge.exe	92
PID 2524 wrote to memory of 3344	2524	msedge.exe	91
PID 2524 wrote to memory of 996	2524	msedge.exe	92
PID 2524 wrote to memory of 996	2524	msedge.exe	92
PID 2524 wrote to memory of 4916	2524	msedge.exe	94
PID 2524 wrote to memory of 4640	2524	msedge.exe	93
PID 2524 wrote to memory of 4916	2524	msedge.exe	94
PID 2524 wrote to memory of 4916	2524	msedge.exe	94
PID 2524 wrote to memory of 4640	2524	msedge.exe	93
PID 2524 wrote to memory of 4640	2524	msedge.exe	93
PID 2524 wrote to memory of 3704	2524	msedge.exe	96
PID 2524 wrote to memory of 2212	2524	msedge.exe	97
PID 2524 wrote to memory of 3704	2524	msedge.exe	96
PID 2524 wrote to memory of 3704	2524	msedge.exe	96
PID 2524 wrote to memory of 2212	2524	msedge.exe	97
PID 2524 wrote to memory of 2212	2524	msedge.exe	97
PID 2524 wrote to memory of 5080	2524	msedge.exe	99
PID 2524 wrote to memory of 5080	2524	msedge.exe	99
PID 2524 wrote to memory of 5368	2524	msedge.exe	100
PID 2524 wrote to memory of 5368	2524	msedge.exe	100
PID 2524 wrote to memory of 2068	2524	msedge.exe	101
PID 2524 wrote to memory of 2068	2524	msedge.exe	101
PID 2524 wrote to memory of 2068	2524	msedge.exe	101
PID 2524 wrote to memory of 5648	2524	msedge.exe	103
PID 2524 wrote to memory of 2020	2524	msedge.exe	104
PID 2524 wrote to memory of 2020	2524	msedge.exe	104
PID 2524 wrote to memory of 2020	2524	msedge.exe	104
PID 2524 wrote to memory of 4772	2524	msedge.exe	107
PID 2524 wrote to memory of 4772	2524	msedge.exe	107
PID 2524 wrote to memory of 4772	2524	msedge.exe	107
PID 2524 wrote to memory of 5568	2524	msedge.exe	108
PID 2524 wrote to memory of 680	2524	msedge.exe	109
PID 2524 wrote to memory of 5568	2524	msedge.exe	108
PID 2524 wrote to memory of 2568	2524	msedge.exe	110
PID 2524 wrote to memory of 2568	2524	msedge.exe	110
PID 2524 wrote to memory of 2568	2524	msedge.exe	110
PID 2524 wrote to memory of 3324	2524	msedge.exe	112
PID 2524 wrote to memory of 1920	2524	msedge.exe	113
PID 2524 wrote to memory of 2728	2524	msedge.exe	114
PID 2524 wrote to memory of 4896	2524	msedge.exe	115
PID 2524 wrote to memory of 4896	2524	msedge.exe	115
PID 2524 wrote to memory of 2976	2524	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SmartTechReno.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x288,0x7ff8c845c188,0x7ff8c845c194,0x7ff8c845c1a0
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,4386950037763304422,9051800262973543356,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,730958551674462007,7815141686010446661,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,10097199381553725842,5214851285634727831,262144 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,5208970933821496967,1526597266310005318,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16464987047456925908,5942974238774242363,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,5759953377885228966,10948364127165960718,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,9214673965883945191,14063202977665151304,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,2599374222367785088,18337890663036731774,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,2532882225303286500,7967471468046972804,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5760,i,18266440234730874385,2149967403827370968,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6342545945410687788,9806667728772777242,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6342545945410687788,9806667728772777242,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6504,i,16944623477767108753,9747335890010602555,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6940,i,18176551349630566402,10267906565049491282,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,14007869257751380902,11484937918944882401,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,7113870240162436995,10229027881482912099,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:14
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7480,i,8147312858833578396,4590423077616008980,2097152 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,14090189663688681189,14917440742603316938,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16034827444367194036,7977603070235129661,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,12517768675956551429,168145625441420534,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5978466046644808011,10976325567787476364,524288 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7508,i,1757092993375890996,7371387921576752324,262144 --field-trial-handle=2632,i,12991487971501137473,16142986740562871068,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5a39309c8553d2822f2ad6cfc04ee6e06b5c90f896f8acee0d58e96ddd046cbf
MD5 c018a98892c9c43a38280bf1abf21209
SHA1 28fa30239e21d10e376b1f3cce980162180989d8
SHA512 04581ea1a076206437374124bb2331f3f28d2d076660bbd9e897291d09905fd746e4fc2ea57e70fd5101144129f883009a0944ef5d04cef187f4091abbf14fb2
TLSH
T16B5153CE4325ADE8D76285B1D4E054193AF2B4AB02836FC048B73DF05E12F4D00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5971db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5971db.TMP
Size 2KB
SHA256 57dc1b818763b669d3697bbf8be31ddfb46bd25ac72f0a5edbde4b5471bec824
MD5 57fa5def416e022a4719566791679523
SHA1 ba26cf733a14eefe7e4072d9433208c9c42f239f
SHA512 3376871c7ad1529e84c3694990765d15d244b17fc3321fd9177da45e7787461e5e5689223b0a5700c9274e2c662ab7e7481d6e40a62240ca2a101a10611f9df4
TLSH
T100512CCE5325ADE8DB6295B1D0E4551936F6B5AB42839FC088B33EF05E22F0C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9b2ee0906b330d032321cb31b80a4780074f01caaf5b54b718832f0f58a08788
MD5 d58ed1afab6e6c786b0bd04b85b0785f
SHA1 0a7d8cec112a010222d87a6e884be3d04c1dac33
SHA512 51203166650359511019aac9099b9862c200890ff804c21eaa3a8b365848ec4a08872a7c3828d6beaa14f41c291fb77cde21f453e81cf7b7b1a795e34be6092e
SSDEEP 192:DNXO98eRJVJUfJ4JiqRaVaiZjhKcAZIZJwJSgpTX4jQ6P6VPgNIRaPviPiT:DNXO98e/jUB4JiqRaVaiZccAZIZJwJSV
TLSH
T131E19DF7C2D8877E881662F05B25BE2ACD1D155A422C3C5689F5AF4F63F24B0D24229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16ae057324025350876b1790b890e191864da5a7ea7771e3bee3d5882041c258
MD5 70dc26fda90c4bde7b7ced1b99342872
SHA1 e01d9af6afdf25d97a8e1a1f9d5aa7e3e69dff8b
SHA512 0d8ad5cbcff7334f36e1e0f2254b68f1d4c8badc0e0d9068636b60b0494124e538623ec34e17bc541ab760c79e7a43dafa90299878f81ed3016b4f732e6bd5ae
SSDEEP 192:sxRx7RBOZ/fbVsbyvjDde5lS7szoD8pUUk/g6+WNIYComcuOs+G3IgD+J:sxRx7yZ/fbVsby7c5lOEO/5InksNe
TLSH
T15842D7166968A93B8CC7E20CBB55BF93D7F95132A1E02E58ABFC871C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0b621aeb56960e22ed4dc5d072aff3851d588be97aea24ea3b33250adb2c3281
MD5 de6beab26b413dfdb2c9c6a12c4e80c2
SHA1 8fef34f16862caea1ef37d0fc909ff28d882b7cf
SHA512 29e5cb5dfb6ae947039a6bdbc582bb83650de2bd8437871728695abb8650fc9695e4a4d33d025464d39ebe1bb750155c6df5af3fb9a29a74f4771ad272ad5aa8
SSDEEP 192:sxRx7RBOZ/fbVsbjvjDde5lS7szoD8pUUk/g6+WNIYCNmMuOs+G3IgDcJ:sxRx7yZ/fbVsbj7c5lOEO/5IaUsNE
TLSH
T16742C8166968A93B4CC7E20DBB55BF93D7F91132A1E02E58ABFC861C04E77DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2516931e83d4cf3ecc833ad6fe79d04f67b30e404d914667d32e49119bf4237e
MD5 1a96cffe87ed5713fdf444c2956c3e44
SHA1 3d41343e12a7780b53a66321376ce8c14b4a9919
SHA512 0d5b102f84c6fdf78e6187829c7b8e438ab1b5ca2fedbbe7a55e45c6c8263efd19db5587b9d5fc997688d1918833b7a95b116a674106df300817ab98ea37d49f
SSDEEP 192:sxR47RBOZ/fbVsNjvjDde5lS7szoD8pUUk/g6+WNIYCNmMuOs+G3IgIJ:sxR47yZ/fbVsNj7c5lOEO/5IaUsNs
TLSH
T17242D9166968A93B4CC7E20DBB55BF53D7F91132A1E02E58EBFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1d1d4118b17cbb1a4135867465104402e0f8a3d0db978e91be724329a66c835a
MD5 6501bc05813b2cfc7495ad8b7a7e4cd6
SHA1 a775fd96cb61720584d5b2083388ea7dbd0b634e
SHA512 3175f0037a70c5559cab5480115ccb307a50b0c58f447a886bfd5b8372a1b0ab1d351cea672e14451a911d5ba6fe211bd50220ff9ae93270cbb28373e1555edb
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvOroZSl:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vh
TLSH
T1E7B2DA2B600DCB7F4F800AADAC596FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 37db9848c63f8fbfea0a5045ea2a6c5233fd88662a260ecb1efa768268999636
MD5 27a7c6864431e55314252d7ec5ab2d14
SHA1 8c293ee5984cf829e6d1cb5b4fe35e45b0f671c3
SHA512 704efec4d6711ed8cab6b6ac5661474872c4f1195dd64dcde4d94f4db7e0828a672b0578fb1f9b831fbfda8d462b3e14dab198a0ac57d9b13ec5581661ebb26a
TLSH
T131A002114F801001C1790EB0258183406B21C9200551034381AD51C4DD617E69E42001
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9727165679d16e3ffcef5a5ee6e4bf18af03064b62c76394a95aad00648a2496
MD5 0a6bca5405231c3cc0b02902087e1612
SHA1 5f188be9c68c6473b6323482d3b810a5c3375d1d
SHA512 87105c98183f6bc12701f53a32654bb70f09407ca5e94d52aff74bdc2207e68125c42a058f14268cab8cd9d87a19aace702dd551e8d866d3a5578af76253a890
SSDEEP 768:f+3GhS+/7Vp8+p3bd66j+4BRv86aLIWTPi9Pr:f+3+S8j8+p3Z6n4y1Po
TLSH
T1C8F2B071E8E99D239CF5CB84B69637436FF85263E2C01ED498DCAB0D159716E030B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dce52cc9c7480ef10214a87bd8193ec6302c4b86dbd642308acc8ba8248c9d4c
MD5 54602b0a47641a1f83e843dc2e091816
SHA1 651cf792f0fcdedacaa9bfb825a1324ae9934058
SHA512 6aefa08e41b8a7beedab542b33d43696e725c128168dff7f9cdd8c729bcf90a6d476a6620f3e512d1bc1a0081fff1d163a756d1c1e5e007ac3bf8340de3edc40
SSDEEP 768:q+33hoi/7jp8+p3bd66j+4BRv86aLIWTPi9Pr:q+3xoY18+p3Z6n4y1Po
TLSH
T1E0F2BF71E8E89D238CF5DB84B2963743AFF85263E2C01DD499DCAB0D158716E130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 175712eee3f4234506c4e6305878ad0fb0351be20e5aa351b44453b2575acdb5
MD5 18ae5c56dce5fb46250e8dd52ec0dbba
SHA1 a0356102041c9af4e55a3c48c28a032f99f62316
SHA512 3488b58a05da805808fdd3d182a534cddf70e2bcea1e4bd6ba37bc96597163dcb3f921ccf7610d961d3ff44dfc511eb8e145fbc81a4b573ea9330f28444dbc62
SSDEEP 768:uC33hoi/Ap8+p3bd66j+4BRv86aLIWTPi9Pr:uC3xoZ8+p3Z6n4y1Po
TLSH
T1FAF2B0B1E8E89E238CF5D784B6963743AFF85263E1C01DD499DDAB0D158716E130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ef230fa8ba112264789b1f95e1ae555f6961888d5226799d4e6e69fb0f966071
MD5 bc91da778ff4a7fd5d2cc3a863f07534
SHA1 09c53f0a6b4881a3192bee4ccbd5450bf392541f
SHA512 2eead74637ba9da2067d8beb89353f2f43203244c22cecc2134bacc4cfd43831f2e173f2520acccfaca5ca62fc7d7f83ca89eff05e5a6e8f7dae0dbff227199a
SSDEEP 768:Irv+4UNbdD3a9cuNp8+p3bd66j+4BRv86aLIig2bwCl1:Ibsbp3adL8+p3Z6n4yy0ww
TLSH
T11C03CE73F8A899739CE6C64472467A433FF851A396C10AC4D5DD2B4E419A29E230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7bb885685ffd0e1b764af3f9a72fe2ba56d57c53245fe4023078613d8fb835b2
MD5 74cadb45abe13ac078464973ecd3ce64
SHA1 196508d1f5eac2a94f9a58b78a1a3eb92359d7f0
SHA512 15452de01cc7eca0e2a7c57fbcd69ccc1c2a9f1a673c6267ca1dd31175d27ade40a7ab816b367f89e27df3e89a54be62ae51448930a82fb1dcc238bcd2a953e9
SSDEEP 768:Mrv+4UNbdD3y9J7Np8+p3bd66j+4BRv86aLITT2bwCl1:Mbsbp3yfL8+p3Z6n4yy0ww
TLSH
T16A03BE73F4A8A9339CF6C68471867A437FF8529396C10AD4D8DD2B4E019B19E230B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74c21ccd-39c8-4f3b-8a0f-80665288d94b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\74c21ccd-39c8-4f3b-8a0f-80665288d94b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Smart Tech Appliance Repair Reno.vcf.crdownload

Path C:\Users\Admin\Downloads\Smart Tech Appliance Repair Reno.vcf.crdownload
Size 47KB
SHA256 41394686f53f4a8b0edcaddf4c892d6a6c4e637fc922eeeeeee524b5d10ae958
MD5 065b2eb0842731455f592a6ea26fa0a3
SHA1 aca25e43504686e78698b51913d44fbcf1718fdf
SHA512 b49b9712a22e41b9414783f548cc2a1376a8452f8b0c6aeb8646ebd7493d9b220ae26d96b26d2ddfc103adc973d6ca73e0f44e762fc541494758be8ee1254d3d
SSDEEP 768:fkHnMKLE1f1bOrLBqQnXjRPd1xFYMLKf6br3F8bgD57KiGQtZPfwUUqUGOP/iQ1f:fmMnKLBq+lnxF9LpHKgDJdrZPfQXHP/3
TLSH
T19323F215B1D1CD664F1B7E82F11230BAEABDD3B2D7C508B670AC999070F98548FBB819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download