hxxp://bmp-bv[.]com/?wptouch_switch=desktop&redirect=hxxps://go[.]mmhighmetrik[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bmp-bv.com/?wptouch_switch=desktop&redirect=https://go.mmhighmetrik.com
Sample260826-e8x68abf62

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
57	2492	msedge.exe
57	2492	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321926467616547"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{9D6BDE13-1015-4CF7-8300-4C81858DCF77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1196	1292	msedge.exe	80
PID 1292 wrote to memory of 2492	1292	msedge.exe	81
PID 1292 wrote to memory of 2520	1292	msedge.exe	82
PID 1292 wrote to memory of 2520	1292	msedge.exe	82
PID 1292 wrote to memory of 2520	1292	msedge.exe	82
PID 1292 wrote to memory of 2504	1292	msedge.exe	83
PID 1292 wrote to memory of 2504	1292	msedge.exe	83
PID 1292 wrote to memory of 1352	1292	msedge.exe	84
PID 1292 wrote to memory of 1352	1292	msedge.exe	84
PID 1292 wrote to memory of 1352	1292	msedge.exe	84
PID 1292 wrote to memory of 1720	1292	msedge.exe	85
PID 1292 wrote to memory of 1720	1292	msedge.exe	85
PID 1292 wrote to memory of 1720	1292	msedge.exe	85
PID 1292 wrote to memory of 3268	1292	msedge.exe	87
PID 1292 wrote to memory of 2268	1292	msedge.exe	88
PID 1292 wrote to memory of 4344	1292	msedge.exe	89
PID 1292 wrote to memory of 3268	1292	msedge.exe	87
PID 1292 wrote to memory of 3268	1292	msedge.exe	87
PID 1292 wrote to memory of 2268	1292	msedge.exe	88
PID 1292 wrote to memory of 2268	1292	msedge.exe	88
PID 1292 wrote to memory of 2692	1292	msedge.exe	90
PID 1292 wrote to memory of 4344	1292	msedge.exe	89
PID 1292 wrote to memory of 4344	1292	msedge.exe	89
PID 1292 wrote to memory of 2692	1292	msedge.exe	90
PID 1292 wrote to memory of 2692	1292	msedge.exe	90
PID 1292 wrote to memory of 2804	1292	msedge.exe	93
PID 1292 wrote to memory of 2804	1292	msedge.exe	93
PID 1292 wrote to memory of 2804	1292	msedge.exe	93
PID 1292 wrote to memory of 912	1292	msedge.exe	94
PID 1292 wrote to memory of 912	1292	msedge.exe	94
PID 1292 wrote to memory of 912	1292	msedge.exe	94
PID 1292 wrote to memory of 3212	1292	msedge.exe	95
PID 1292 wrote to memory of 492	1292	msedge.exe	96
PID 1292 wrote to memory of 3212	1292	msedge.exe	95
PID 1292 wrote to memory of 492	1292	msedge.exe	96
PID 1292 wrote to memory of 3492	1292	msedge.exe	98
PID 1292 wrote to memory of 684	1292	msedge.exe	99
PID 3492 wrote to memory of 4012	3492	msedge.exe	100
PID 1292 wrote to memory of 4512	1292	msedge.exe	101
PID 1292 wrote to memory of 4512	1292	msedge.exe	101
PID 1292 wrote to memory of 4512	1292	msedge.exe	101
PID 1292 wrote to memory of 3608	1292	msedge.exe	102
PID 1292 wrote to memory of 3440	1292	msedge.exe	103
PID 1292 wrote to memory of 3988	1292	msedge.exe	104
PID 1292 wrote to memory of 2692	1292	msedge.exe	105
PID 1292 wrote to memory of 2692	1292	msedge.exe	105
PID 1292 wrote to memory of 4428	1292	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bmp-bv.com/?wptouch_switch=desktop&redirect=https://go.mmhighmetrik.com
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff915dbc188,0x7ff915dbc194,0x7ff915dbc1a0
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,10404760623767900844,3792626005416915235,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,16344897031083521994,7713219362930967039,262144 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,608094298879375597,919505887448031041,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,15873410984217298507,3216314866547558508,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8966512673080135692,16380836252934782679,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11812413525979083165,13765643768859120800,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14321425097973259598,2896654912499394255,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4260,i,17371939002697631093,14087731446672693609,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4308,i,13864012870109000754,4547258127396516620,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5292,i,8068472172424148662,15323585900214814007,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5172,i,15547487640068391989,15285288439675698610,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,1413248574134783961,8828800351133118,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,13843481581813707263,12544235189080671859,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,8605581793631306548,8843682113508012900,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7561423157176020869,5886381114939391267,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1124
    3⤵
    PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,8605581793631306548,8843682113508012900,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6668,i,6195169607042422516,2353649916913466440,2097152 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4539812034487741270,9473538024277943663,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,9554966106376392705,5633266623978237052,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,11530782252013372128,7516858068623637661,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,9174590662232276507,8367038235210943490,524288 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6684,i,1535841727692604287,2922856760795927232,262144 --field-trial-handle=2120,i,1193472127227869344,5148652866271237507,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5de049d9458326724768f53692b10469dcdc05ea4b6d4dcf747f8415e507ef7
MD5 254c007bf6c04111273249e3473590d9
SHA1 fdd40917064f867729958edb96518b0526f1f789
SHA512 928ac22c282d58cbac7f57c980f372766e17c50a630d4c3a02acbfc77d450709fd47ea9e76f53c5ff0fa266503b94cd671f4a7266fbdaf18cdbf0fb7f475ace9
TLSH
T15C717F65C38A34B8F77512B2B1C211A9F27B80780E2B7FD10ED8D9F5D53A7610226E8C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78d7e018cce40e8273a234d91342a54fda2a83016ed87112835bb1ef03526681
MD5 441d0505ac6c90007ea417dfb3453a20
SHA1 61f42cc98853e758789a3a61d23956cdc926c6c8
SHA512 9192856de1a3bb685831352fbe7d4098abae5874fab2197cbde7b62b2ac95a4d2da27e1b3a3021fcbb4e3e7f8e5105353e27e05095cae85486b29bc3e5c40cc6
TLSH
T178618F65C78A34B8F33512B2B0C211A9F27B80780E2B7FE10ED8D9F5D5367510126E8D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 59a4699d494464895610d56ec151654240324e8f089945ac58f421ed5d7ff3fd
MD5 95a2a2acc1e2e8e4af08d86e18243ec2
SHA1 8e8074e9f4650851fb4c5b13a8d2b9e25362ab49
SHA512 d70bb3baa06c47311dab4796c83d60bc792186ef4cf95d0348fb14aa27516e5ef8587c9c4da0c07e2a465a361d589649831eac2a75f37b9bdac7db8340078d35
SSDEEP 48:YALlNMCO8VMZ8VV+8eMo8VMJ8VGIU8VMGlsEzBXsn8dsnCKsho8v8XYwEs/8689K:DTODvzbXcrzByX9iIYwTXgWUDB2LOQ
TLSH
T1CD91AFB287F5A52DCC2117F09A192F1FCE1E191857283D6B85E8AF1FA7D2870E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b83b7a43c50b97211a6b2ad4cb5f248b07f77da09c4aeb3cbf5e6af6a3a2c910
MD5 6bc266f4dcfdacb82edbcb9980d9a3e1
SHA1 1d27bcd9bd18ef83faa71013fe66e643e6423e2d
SHA512 0c21614b756188538c0aa2b537549b6c7592e54b9ac40cfc2de8d1628740dc45bd273f73f0911bccfd4838c5f71eb18364073ba3a71527cbf2273ad10d6fc966
SSDEEP 192:sxZ5RAyM/jK1Ml8UQSFM/fXsZ3qNIdpzH/W6+WN7t6dY0sVUgDNIg5GJ:sxZ5yqYM/fXsZ6ub/bUd54pU
TLSH
T1FF52E712AA34A977CCDBD209FA05BF53D6F5147292910E44A9FCCA1C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 de1e898f6ee278c3ba477cde92b7e8040a11f69a4eac512d44e1a01a35520c8a
MD5 8a5cac5a56c1afa7364d0568bd5ca196
SHA1 5abd7e79ef1f79503767783e66b781a2d2799b8d
SHA512 b660c377d9784349b5f8ee1da4e88e1eea52588f39859c52895f3bc7850aa39029bc5375463a3da00aaac5062b9ab8670b004b5430e75f9a7221affd4d2c2d08
SSDEEP 192:sxZ5RAyM/jK1Ml8MFM/fXsCvNIdpZH/W6+WN7bs/Y0sVoxQNIgrJ:sxZ56dM/fXsCvu1/bs/54j9
TLSH
T12E52E701AA34A977CCCBD209FA15BF53D6F9157292910E44A9FCCA1C04E6BED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9c28ca1e91af9d4f36606eadc84ff4846dd78c26bcaefbffc0c0c60690ca8f75
MD5 9a15960cbd2716bcc4a39ddcdbf15236
SHA1 04fb65a204245cb2b6a0b573f19a47f8b3942fc3
SHA512 d514cf5ef5d96e71528fcdf49e1328ae75c03bfd47eed0f9874d2a203fdc6bc30a049277584c377792d702bcbe0f9028dfd3f21dcffe5208ca1aa7a0dd842c38
SSDEEP 192:sxZ5RAyM/jK1Ml8MFM/fXsZ3qNIdpZH/W6+WN7wIZZY0sV6HQNIg5GJ:sxZ5ydM/fXsZ6u9/bs+Z54hU
TLSH
T10752D712AA34A977CCCBD209FA05BF53D6F5147292910E44A9FCCA1C05F6BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 3d2bcd9c7621d03a3fc6f4bed2987557c673560f751d93551f3f947a70aa3987
MD5 5302042487d7436661212dd6c75ae8a5
SHA1 4c23779bb09df2a7e8a2b2687c852a0876653f2c
SHA512 94bc0df87746f6ab93d53d36bd7a7acf5c6f26ece250dada721fdf86364b77c21388af795c3d7ecff49fc7d3353c4e89e617c26bf71adce3ffd079d76eb793ac
SSDEEP 768:EH/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601jProsT:EH/Xh8dF27kWRmwcQDwu1jaKmjLpkD1X
TLSH
T1D9E21A3F280CC77F4F844E5DEC26AF966EE801CBA658495447FA894C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4c62aa74e5c33650b389481f20cf7b2af290868859c408d3cb377b60d5d1e3b5
MD5 4dd37866da92a2b791102e2d40476d57
SHA1 cf3f11300c7fcc0cd7b0cd25e35c0589012c42d6
SHA512 709ad3377c46363f3dc3e3ffca6175fe3fd119fa482f32856483d5f7908dcf328db0e2a013371a47480eb384a8079edb9670c2b79d29cbf31c0fc5d1474ed59b
SSDEEP 48:KXVBDPTgvXqzImpgKB1p7gF5wMabRtyBkIvKxGEry1HIlKYcwnGvC2sz:Kg+MKfq6ykgKxGK+HyKYcU
TLSH
T1B3912A1370BA12013C3E394D86A587A70542B2E37425B53B3BE850756E6BE225EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af4bcb0b-7aa6-4030-b97e-855d07b6c07f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af4bcb0b-7aa6-4030-b97e-855d07b6c07f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5915ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5915ef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5d1475acd244f815a816d7913032ba431948ee4505cf42890d9eef7df11e7325
MD5 88e990261c9b67334883a904e5bc82d9
SHA1 bf3ab74b4313f6a0e56f93c05a00850de6afcfee
SHA512 695c9a47edc0ee7463415d210e681d39acb0c0b50c135c6877ccc1348c1a760e61c951012dd9f700f6ac7cf285242baf7679108d179a89b67bc71a0c4faa5f7d
SSDEEP 384:oZcIh8NW+ExzXiVb1ur/E5I+xsbTkJL+HBbseXo4:WhZ0k/Ey02TkZgbXT
TLSH
T102828D715C68ACBB5DF78101F94B36178EB8816BD3C82A94D4EC672D09DA1E8131BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5c811f6c2f39957841b4e14f0da298adc1c93aadd7706c6515cdbef86dae6888
MD5 b928e28cfd48e344e448115d9035f04a
SHA1 0a16124ab3887f9c21e2c2ef3f0247afb65b11e3
SHA512 7658cea6a93f02b8ad507c4bb0c928faed8266a8abb785c2bf61de60036f9318aad404fbbd4ada7ad3ef530a508f9cd18947c152a99b1bc12f47bad553d8d7bb
SSDEEP 384:MiFiZcII8NW8TUNTUlIl3ExzXiVbxur/E5I+xsbT1JL+HBbseXo4:3FQITwgWQk/Ey02T1ZgbXT
TLSH
T1A1C23AF248D7987AD9AE8703A73E2D178DBCC157B6846990B3D8561CCC9A1BFC30AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2c78a4b67c65a74f88f45c366e8848760877ae44c9f84d22fafb8b3d7437a224
MD5 89c29f90de70df22b7f7335918e95637
SHA1 00a341407877c16bb004611893ad5a15f288b710
SHA512 3259f22a9ca21fd696faeb89ff99e13f13877e0b99b90ae699f60a6afec4204bdb01cf86ca44d32ceb8fa0f79e8cbcdf2d579695dfc1ca0a9c9b1c5ad24fd610
SSDEEP 384:MZcIh8NW3ExzXiVb1ur/E5I+xsbTkJL+HBbseXo4:ahq0k/Ey02TkZgbXT
TLSH
T1F4828D715C68ACBB5DF7C101F94736178EB4816BD3C82E90D4EC672D09DA5D8131BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6fec804bf7f5e56f8dfb894fc7de8de1c375318b21eda4498ac68fcf47e4b65
MD5 d9bd3f23c476d55a9403c95f4b7c3a5e
SHA1 3480e763906bbfbc4adb7379c90a3b3920925709
SHA512 bd8a1d5f7a57fe60183e4117efb8be3a991b5bdd7cf0ae3405c34b4c04adcabd22eccf03b6551435541d2f0709daf43146a6c878345023db8386b4bf560980b6
SSDEEP 192:hGNv6t6H35QmiUyw012Kq/rUH5ml+xPEbTY/9nMqzLU6:hGNv6MXXC2Kq/E5I+xsbTYJLU6
TLSH
T1CE122B356868BC6F8DE39941F48732138EA5522BDBC96F95D4EC1B2C05DF29C130A962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82e99b98dca233a2ed0eeb6f756f2fe61c3dc7930a9f389af288d5a3c2b921ff
MD5 4fdf80c0cf81ce134c272418895d5f12
SHA1 b3b7aedf769a3b822c587fd9db7fdee944de25d9
SHA512 710a4657744e8edf286542c15ba1d10cf37156a83142b6d8fd6a4256a08750c333102ee6fb61ec50830ef22ce4273b33faa98f7916c9b5dc2415e07aa45f7706
SSDEEP 192:1GNe6t6H3BQmiUyEHBH12Qq/rUH5ml+xPUD9MaZU6:1GNe6MXfTb2Qq/E5I+xziU6
TLSH
T1A502FA3878786CBB8EA35E45B48777278F95216FE7955F88D9E80B1C01DB28C1306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce1dac1e-637a-4d9b-86a0-43fef342a79d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ce1dac1e-637a-4d9b-86a0-43fef342a79d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download