hxxps://meliormedia[.]com/bsntable?gad_source=7&dclid=CLe01sqlu5YDFYySNwgdK50UWQ

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://meliormedia.com/bsntable?gad_source=7&dclid=CLe01sqlu5YDFYySNwgdK50UWQ
Sample260825-jpd2fsvtft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1700	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321178281568233"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{2012A9DB-2CD5-411C-9625-EE0029ED190A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4676	4564	msedge.exe	85
PID 4564 wrote to memory of 1700	4564	msedge.exe	86
PID 4564 wrote to memory of 508	4564	msedge.exe	88
PID 4564 wrote to memory of 508	4564	msedge.exe	88
PID 4564 wrote to memory of 748	4564	msedge.exe	87
PID 4564 wrote to memory of 748	4564	msedge.exe	87
PID 4564 wrote to memory of 748	4564	msedge.exe	87
PID 4564 wrote to memory of 1056	4564	msedge.exe	90
PID 4564 wrote to memory of 1056	4564	msedge.exe	90
PID 4564 wrote to memory of 1056	4564	msedge.exe	90
PID 4564 wrote to memory of 1184	4564	msedge.exe	89
PID 4564 wrote to memory of 1184	4564	msedge.exe	89
PID 4564 wrote to memory of 1184	4564	msedge.exe	89
PID 4564 wrote to memory of 3912	4564	msedge.exe	91
PID 4564 wrote to memory of 3912	4564	msedge.exe	91
PID 4564 wrote to memory of 3912	4564	msedge.exe	91
PID 4564 wrote to memory of 4640	4564	msedge.exe	92
PID 4564 wrote to memory of 4640	4564	msedge.exe	92
PID 4564 wrote to memory of 4640	4564	msedge.exe	92
PID 4564 wrote to memory of 1116	4564	msedge.exe	97
PID 4564 wrote to memory of 4272	4564	msedge.exe	98
PID 4564 wrote to memory of 1116	4564	msedge.exe	97
PID 4564 wrote to memory of 4272	4564	msedge.exe	98
PID 4564 wrote to memory of 3988	4564	msedge.exe	101
PID 4564 wrote to memory of 4352	4564	msedge.exe	103
PID 4564 wrote to memory of 4352	4564	msedge.exe	103
PID 4564 wrote to memory of 4352	4564	msedge.exe	103
PID 4564 wrote to memory of 1960	4564	msedge.exe	104
PID 4564 wrote to memory of 1960	4564	msedge.exe	104
PID 4564 wrote to memory of 1960	4564	msedge.exe	104
PID 4564 wrote to memory of 4900	4564	msedge.exe	115
PID 4564 wrote to memory of 3452	4564	msedge.exe	116
PID 4564 wrote to memory of 1304	4564	msedge.exe	117
PID 4564 wrote to memory of 5048	4564	msedge.exe	118
PID 4564 wrote to memory of 5048	4564	msedge.exe	118
PID 4564 wrote to memory of 5048	4564	msedge.exe	118
PID 4564 wrote to memory of 1192	4564	msedge.exe	119
PID 4564 wrote to memory of 1192	4564	msedge.exe	119
PID 4564 wrote to memory of 1528	4564	msedge.exe	122
PID 4564 wrote to memory of 1528	4564	msedge.exe	122
PID 4564 wrote to memory of 4072	4564	msedge.exe	123
PID 4564 wrote to memory of 4072	4564	msedge.exe	123
PID 4564 wrote to memory of 4072	4564	msedge.exe	123
PID 4564 wrote to memory of 4532	4564	msedge.exe	124
PID 4564 wrote to memory of 4400	4564	msedge.exe	125
PID 4564 wrote to memory of 4400	4564	msedge.exe	125
PID 4564 wrote to memory of 4400	4564	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://meliormedia.com/bsntable?gad_source=7&dclid=CLe01sqlu5YDFYySNwgdK50UWQ
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc32edc188,0x7ffc32edc194,0x7ffc32edc1a0
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,9010799095521679586,13001933466551223363,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,14578063180120625024,3198012735323710661,262144 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12362392923422165800,17448455644040318962,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14715519824550733933,18010304615736038432,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15113447569406741082,6731643727491509641,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1836740231963999126,793662659175082826,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17347168631017057601,1163814300047138858,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,5962066989369287952,6374480025205513746,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12065143439126299553,9890910858969315174,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7814568479712837562,14021598022206447122,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7814568479712837562,14021598022206447122,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,1285664011771115708,6758058670169392532,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3548,i,10297985139084472942,11700629021453210432,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,8228947612045940745,4905591254810375930,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3784896132931780293,13677652574429986378,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4791061893839694132,14652647551996310896,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6236,i,4598998314475812864,15638063368605062266,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,10722141091050637416,14165357298548796506,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,4615193082323298229,2388666780421981623,524288 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5876,i,7989586554274702051,16085137149825528464,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,15227729183659541546,5334546594364250082,262144 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2792,i,5928003429583332745,10012482079261433872,2097152 --field-trial-handle=2380,i,11035547391546772381,6869349618274344963,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f387d081631259c721d52cf1dfb5e8575d6d90c6798a383e79ba39dcc8d6ae40
MD5 3754c97fe698e7b25b60dd9820014758
SHA1 da6a3949505b954b52433eb8c10800edf8977f20
SHA512 5fccc7a7c97cd19b10063b2f7a86c61aa383e899b421c94446d0a94c6ca0c7c3a76e3c2f099632e6a11ce04d2dc953df4b537fdd86b38b4ffe6775aa9ac996d6
TLSH
T1AD71527427018054D7670872CFC912EB76368AEAFCAB3E8511F2BD74A121F328667B1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589054.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589054.TMP
Size 3KB
SHA256 15dcf57c6ed7af3413f8f19565001afaf59cc0865a1ed8679d8dc6ae358bde8d
MD5 779bec4c1b047d0db7e2ae119bbf6caa
SHA1 7999ce4ad6856529fa51e2c96cfd2a15623ea6d6
SHA512 b71a12e8e879bc998f932097a67672ca899c9d6c1c0efbd3ce97e04092619677148826800d94936b92b466297187b73e9b35f9c3c1459118d504f6519279b3bf
TLSH
T1EF71427427018054D7670832CFC912DB76368AEAFCAB3E8511F2B974A121F328667B1D
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 57546982602eec9613d4bf6bf1b754e33961c158086d3860d9df1148a817daa6
MD5 540b0f414959be66b20d22463643072e
SHA1 13afa6a6a488c3a2e7b31b9d6ba9c64a5b4d8548
SHA512 7aeea456e34b0c4ae3f7264d0d36e0ef2292b74a020764aa4700241d4f4914c011a0b3be261e835cae47b08b589eded88b1c89405c9d96a09fa59bc5365657ce
TLSH
T1D7117AB3C3D5856E8E0556F0AA24AE2BCE2D0606422C7C29C9D4EF2BD3E3475E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1dc4053bbfe0d09f3d96e33ae88015268b243c74dac8f24b4fcf79d4ef1bff15
MD5 794d1ba039d8fb78196f950e84079e1f
SHA1 749c33620a806565de98783b482292d9a677d1f5
SHA512 0cc63c07a4cce247447ad0a5e666ca04893c99c164f0191b8769f1dbbaa7adb15167197f2c88244d388117f8fe84954ea85b58bc0b39cbc4599b4e496e30c0dd
SSDEEP 192:sxZxRYyM/jK1Ml8Mkb/fLsaciV1IdpJHW6+WNGYvxYjDFIgrJ:sxZxKMb/fLsacvJHbGp99
TLSH
T17342D8126A34A977CCDBD20DFA51BF53D6F51472A2900D44A9FCCA1C05E6BED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e9816dfb6b9352560e6a49c7aea6eafb320d5c12751648e8063792c4d3a4bdd
MD5 0558f02da68acb90261cc204fe32fb7a
SHA1 ba094455dd57d657681ed0d05136ce8bd0c728a6
SHA512 2d5e9d28f2517d2dc6f834c4cd348905ddb05acf0662b89f8dc25a05fac96a73b575e5e635d67f6b7eb8ff98b67d62fb32747c446d725339d4188ffcec223da0
SSDEEP 192:sxZxRYyM/jK1Ml8UQgkb/fLsQJ7V1IdpedHW6+WNGYvNPjDFIg5zJ:sxZxKqzb/fLsQJgyHbG49P
TLSH
T1C852C512AA345977CCDBD20DFA51BF53E6F5147292900E44A9FCCA1C05E6BED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9063a509b0624888b4be34eed9d1e2acca1f4f3a3ccb960ff691acd09e747a81
MD5 ce081bd21f21555853c71f995e7de74f
SHA1 cad03b02bbdfd0a71bae868cb59fdb76897f0629
SHA512 c32270c6d714b52fadc631eea92573fdf5232602e44ae2f347c8b172b6463538ffbb29b7250731ce74467dad4fab29c39273401354a71214f680d1ea7ab81a4e
SSDEEP 768:42seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppproWT:42seJ3xWvhfynu1jaVcL88pCq
TLSH
T192D20B2B280CCB7E4F844E5DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5aa5979-4709-4a96-9c30-d00f3c665b71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c5aa5979-4709-4a96-9c30-d00f3c665b71.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4ec51818d99b7db7e3d4c15a00822b780594b0d64bbbafa6300d459beda82671
MD5 004e10fec500042a84c5a124c27557ca
SHA1 138d3ff88a9a15357571c05f18d44303b9ec0483
SHA512 752aef08fada0c391e38b67274f001ec047a7dbcc40eda71f5b208e1736eb3fb8817f5524f69bde4c04bb1630c436ea4027be9ec88405c31a174423450620ae5
SSDEEP 192:uZm+xasuheOwQxMGsNPJiQH8IpHM7LMJQmiU1JhG4MTQj+FdLKKSnGNlA8z1aqi6:ZZcIhsNPJiFH7onJJkdeKS0lZaLG
TLSH
T1CC625B726C745C3B6DA3B146F58A3A035EF88127E7C45B44E6EDAB1D00DA3AC031B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 37bb57f3ba7b2cae35a63ecbe567e7ac9b823fed0c290fe6fbe8390232a2726f
MD5 c2fc0ac1b9dcfa72339f1af61cb650a1
SHA1 b46b1a3ebab9ccc1f5677e76634a6bddc8503304
SHA512 88c6a898e99b76963cd18e22922ce99775b72a90361a863b3a55d443c855bc1a39b0aae811b7d74480a6703f2ba985c4713c55da2e9ead113609c93dc54c468e
SSDEEP 384:yiFiZcIwsNx8TUNTUlIlciFH7onJJkdeKS0lfaLG:5FQw8wgCg2WFaLG
TLSH
T1CA825C735CA4893BADB7AA85FA4A37039EF48177D6C4AA54F7DD9B0D009B29C030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90a40d7c430aa0a27f056b8f939a31ae66ed9778a21e84ed2c6932724eae8f6c
MD5 b4b3b4be02969fe70b6a0711256b8ca8
SHA1 def7d6549d559742d3f9217c17fd0df457b7135c
SHA512 27022cfe9637fb03708f4eef6288861ba1d8af8f3147dd45ac718d5f2b160217a8f72189be0389e0ae7d754e1b7aee1f61b9d86824cc555345ca6abfcfa1a002
SSDEEP 192:lONQ6vMtPQmiUydrThTQj+FdLKKSh847PWU/u:lONQ6UtR2TbdeKSJOU/u
TLSH
T1B8020836AC786C7B9AB3BD46F58A27171FE4216BA6D01B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 3627bbf4b4a083205e02bedc5c0209eaf04ec3e7aec66e5cac62dd1977025c74
MD5 c53eb5bd912a3e7572af13dbe2515902
SHA1 49334b0b681ad4a44bf7162513638912b1edcbe7
SHA512 aae6df3722ecb98551bc5707cc1c97c0a4cec04b7732766de3b4b029ca3d3970022ac4e04d681de8c61ae6c115fc2d1b279ecfa61cc410a478beaba01874880c
SSDEEP 192:uVm+xasuheOwQxMGsNPciQH8IpHM7LMJQmiU1JhG4MTQj+FdLKKSnGNlA8z1aqi6:JZcIhsNPciFH7onJJkdeKS0lZaLG
TLSH
T150626B726C745C3B5DA7B186F68A3A035EF48027E7C45B44E6EDAB0D00DA7AC031B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 80047e2c4c559d57982b59e0114feebe199e1817310167ee4ac9b1080948298c
MD5 831b8f4992bde53773ce7cc66cd26725
SHA1 0c754fab8c8a507433891604704ed45380cde72d
SHA512 95bdb00d1d7fbac8ef7413c086798e0d0cc354ec062a7c44fed21a860eb3905c94a5b39db80e2d20a7486d11f8f262e102294d07cab1065cac6d5c0992fd2842
SSDEEP 192:sONi6vMqPQmiUy2rrhTQj+FdLKKSnGNl680IaqiU/u:sONi6UqRPrbdeKS0ljaU/u
TLSH
T1C2122B72AC785C2B6D93B182F08B36035EE4816BEAC56B51FADD2F1C01DE75C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bb0438e1b189d706a3a3823836ae1e70d8ff3eb5ed6d91a2a4744ca15c3fa263
MD5 afeec8e1f99e7a6c338586282d170f3d
SHA1 715de640ed3d0a20b209f410b11a0194a9f6181c
SHA512 2104ea1c6cfe86dca28f98f25f98a875b5b24c84d9e417b40b81b3ffa6d8c4ed300e68e22d0a514bc392cbf6e23952b9c069511dadc08eccd6c0b3ee853a0fa4
TLSH
T1D6411858BBFA1148B3B76F16ABF6A86D487FB8771E06946D00010E4E0662B44CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download