hxxps://url976[.]groupgreeting[.]com/ls/click?upn=u001[.]AR9Mx-2Futf8zCizRJR1zWQ36G3v9en2kUd4G-2FZ-2BTRKFkX4AtsnuwgS-2F2U9UYov3-2FVbag-2Bnl3GRIiGnVZzhVWqydDUBa-2BbcgzhhgvLEEV8Zis-3Dqcbq_6v9MA-2B-2F-2BGqXYba5-2Bp3rdgKPbloXYgWxZyiHJXH2kRXSSNSUPcm5cGzLsC34KN1Exbz5WSG2JnpuucviTJKP8wGXNlRlob6ayBw53qXhttp6epaD3X-2BzpqymEqNTbCelnDsrlLzScLYfhMDJANj8CPTvp5mYNak-2BqaBNOmz7eLdPxSCGEbrYw-2BJgiqVVkXl1EuZ-2BM1Dnv6ofxFUNWhhEGJQYgaE9i9xGME4ab5D2BAFQXAeF6teNQjBo3Ll-2BSydLd8DSPWyh0NbwEK81IXm-2B5060f5egc-2Besbyt2d4iOB7ktvFiUwhLDJdb2Ucw77i7CRzdLjLE6eHDkLco8qSIUvGzKK27CPArLxl3KDZuydL-2Bp6-2FyjIIOIjQmZPqcyURINZvhZOISpICkwUbhIy12753Mt0pNFuk8bfg9pHSrXqYT-2B1LOI7MWZufSeix2QohHpvyvUWCj8JmrJ9UzFBIbTi8QLhkJQoOSSl4Ls0-2Fw7Fow4-3D

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url976.groupgreeting.com/ls/click?upn=u001.AR9Mx-2Futf8zCizRJR1zWQ36G3v9en2kUd4G-2FZ-2BTRKFkX4AtsnuwgS-2F2U9UYov3-2FVbag-2Bnl3GRIiGnVZzhVWqydDUBa-2BbcgzhhgvLEEV8Zis-3Dqcbq_6v9MA-2B-2F-2BGqXYba5-2Bp3rdgKPbloXYgWxZyiHJXH2kRXSSNSUPcm5cGzLsC34KN1Exbz5WSG2JnpuucviTJKP8wGXNlRlob6ayBw53qXhttp6epaD3X-2BzpqymEqNTbCelnDsrlLzScLYfhMDJANj8CPTvp5mYNak-2BqaBNOmz7eLdPxSCGEbrYw-2BJgiqVVkXl1EuZ-2BM1Dnv6ofxFUNWhhEGJQYgaE9i9xGME4ab5D2BAFQXAeF6teNQjBo3Ll-2BSydLd8DSPWyh0NbwEK81IXm-2B5060f5egc-2Besbyt2d4iOB7ktvFiUwhLDJdb2Ucw77i7CRzdLjLE6eHDkLco8qSIUvGzKK27CPArLxl3KDZuydL-2Bp6-2FyjIIOIjQmZPqcyURINZvhZOISpICkwUbhIy12753Mt0pNFuk8bfg9pHSrXqYT-2B1LOI7MWZufSeix2QohHpvyvUWCj8JmrJ9UzFBIbTi8QLhkJQoOSSl4Ls0-2Fw7Fow4-3D
Sample260826-v2b86stbmd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322389356875052"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{816F3033-2AA0-48B5-9A91-173AD4E08E8F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	msedge.exe
416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2084	4708	msedge.exe	86
PID 4708 wrote to memory of 3600	4708	msedge.exe	87
PID 4708 wrote to memory of 4840	4708	msedge.exe	88
PID 4708 wrote to memory of 3600	4708	msedge.exe	87
PID 4708 wrote to memory of 3600	4708	msedge.exe	87
PID 4708 wrote to memory of 3636	4708	msedge.exe	89
PID 4708 wrote to memory of 3636	4708	msedge.exe	89
PID 4708 wrote to memory of 3248	4708	msedge.exe	90
PID 4708 wrote to memory of 3248	4708	msedge.exe	90
PID 4708 wrote to memory of 3248	4708	msedge.exe	90
PID 4708 wrote to memory of 448	4708	msedge.exe	91
PID 4708 wrote to memory of 448	4708	msedge.exe	91
PID 4708 wrote to memory of 448	4708	msedge.exe	91
PID 4708 wrote to memory of 4432	4708	msedge.exe	93
PID 4708 wrote to memory of 4432	4708	msedge.exe	93
PID 4708 wrote to memory of 4432	4708	msedge.exe	93
PID 4708 wrote to memory of 1892	4708	msedge.exe	94
PID 4708 wrote to memory of 1892	4708	msedge.exe	94
PID 4708 wrote to memory of 1892	4708	msedge.exe	94
PID 4708 wrote to memory of 1228	4708	msedge.exe	96
PID 4708 wrote to memory of 1228	4708	msedge.exe	96
PID 4708 wrote to memory of 1228	4708	msedge.exe	96
PID 4708 wrote to memory of 3828	4708	msedge.exe	98
PID 4708 wrote to memory of 3828	4708	msedge.exe	98
PID 4708 wrote to memory of 2976	4708	msedge.exe	99
PID 4708 wrote to memory of 3396	4708	msedge.exe	100
PID 4708 wrote to memory of 2976	4708	msedge.exe	99
PID 4708 wrote to memory of 3396	4708	msedge.exe	100
PID 4708 wrote to memory of 3212	4708	msedge.exe	103
PID 4708 wrote to memory of 1136	4708	msedge.exe	107
PID 4708 wrote to memory of 2536	4708	msedge.exe	108
PID 4708 wrote to memory of 3760	4708	msedge.exe	109
PID 4708 wrote to memory of 2412	4708	msedge.exe	112
PID 4708 wrote to memory of 2412	4708	msedge.exe	112
PID 4708 wrote to memory of 2480	4708	msedge.exe	120
PID 4708 wrote to memory of 2480	4708	msedge.exe	120
PID 4708 wrote to memory of 416	4708	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url976.groupgreeting.com/ls/click?upn=u001.AR9Mx-2Futf8zCizRJR1zWQ36G3v9en2kUd4G-2FZ-2BTRKFkX4AtsnuwgS-2F2U9UYov3-2FVbag-2Bnl3GRIiGnVZzhVWqydDUBa-2BbcgzhhgvLEEV8Zis-3Dqcbq_6v9MA-2B-2F-2BGqXYba5-2Bp3rdgKPbloXYgWxZyiHJXH2kRXSSNSUPcm5cGzLsC34KN1Exbz5WSG2JnpuucviTJKP8wGXNlRlob6ayBw53qXhttp6epaD3X-2BzpqymEqNTbCelnDsrlLzScLYfhMDJANj8CPTvp5mYNak-2BqaBNOmz7eLdPxSCGEbrYw-2BJgiqVVkXl1EuZ-2BM1Dnv6ofxFUNWhhEGJQYgaE9i9xGME4ab5D2BAFQXAeF6teNQjBo3Ll-2BSydLd8DSPWyh0NbwEK81IXm-2B5060f5egc-2Besbyt2d4iOB7ktvFiUwhLDJdb2Ucw77i7CRzdLjLE6eHDkLco8qSIUvGzKK27CPArLxl3KDZuydL-2Bp6-2FyjIIOIjQmZPqcyURINZvhZOISpICkwUbhIy12753Mt0pNFuk8bfg9pHSrXqYT-2B1LOI7MWZufSeix2QohHpvyvUWCj8JmrJ9UzFBIbTi8QLhkJQoOSSl4Ls0-2Fw7Fow4-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17697476649754753484,1023459435848716294,262144 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,14754120699358313456,6105326058007562740,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,9280551002937829133,7107140054391604821,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,4652737429715420467,1082146112576995062,2097152 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,3411573032402444746,8728578721581899277,2097152 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5113813999958946213,3457756532127385400,2097152 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13845624229437139433,4468869982154130073,2097152 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4948,i,14202013273335187516,472535600937252557,2097152 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,5339675438259069803,8438870800127387486,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16822820649834346281,6005043673077880616,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4680142954042617828,16601989185614444000,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,9592107376912014571,3329276455679229128,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,9592107376912014571,3329276455679229128,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,16584809777899024257,10133819249576365863,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,3254886228033890646,16233025410876823955,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,11939333752254814268,16762211159403569260,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2976,i,3436159015705818671,10292123111284476819,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5570210787819621759,432194700140840327,524288 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,18076126695583429394,3541536932625274252,262144 --field-trial-handle=2068,i,2765309368263255480,17193401549472917493,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b53efd6e9c688bc0daf5d60d34293ff75c4677af708810e304e8627de5a86386
MD5 e4764907273a760b7cf92a2cb1eb2def
SHA1 4d58a5d863a5ce8982511e37531bc98f404e2e2d
SHA512 d450ea4a276bac58f92fbbaa90e4d3eecfab27b82f87e6a8ce581dd06817640b13b9b162f12fd1b9c096c8006fdb22e6ad3aecb5aa40ba1370e806ddf5497da1
TLSH
T19171B5781BB31762E765013F91F0860CB7BBC1EEF92B1E3E0350687A151E7841194D57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59212a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59212a.TMP
Size 3KB
SHA256 6d78ae00cbe6339dc98d246f699ec69222fcd469451234c99c02296c4062a8f5
MD5 353a809ee6f8110f05059247d3f6fcad
SHA1 f2c5e23022147d21a250988d873db8756f746cc8
SHA512 f7e5dfb1f7ff6e95d006b357724846e0ccdbab7fd4d2d83d0e61dea1865ff5fed14c780741b2ffde102b858be222f6cb753028fe973e1278f1e842674d5bdfcc
TLSH
T13E6192781B720756E766113BE0F0860CBB73C2EEF92B1E3E4390297A650DB940184D07
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d9923024512605f03c036c324e69edcc318a4022eddf88a478cadc6f00ad9e41
MD5 23ba7f3cc5bb0bea1078f7a9981ef499
SHA1 ef984db0acbd057585f22816b0ade4c672bc91c8
SHA512 c34ca40191803a9142fff4962c29b09d67330ee57b7333998368eeef6b60044657adec0a914c2ecc1ac8def03a301216483a23da534657402ad7eff0d07ae51a
TLSH
T148519AB7C3E5962EDD2156F0EA146E2BCE2E0914931C3D1EC8D5AF5797E2030E106A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6042483f745ac98304741d4682b82f1be9557dc619936a8833fed11844e7cf6b
MD5 055089855d1a6d748e6ae18f47954cb4
SHA1 de3d05731ae4c0577bc9f76033c25b256ed21688
SHA512 86525452aef59c6ed4b597b10ed36c69c86165a2342ff12dd02905b9c591f3f235319360165f62638a8d633e5647c03d2472e2a44c9f64622806df944d0e5c89
SSDEEP 192:sxZbRTkx/fosb2WHIdp5UGFC/W6+WN0i5/Y9IyVuLIg51J:sxZb2x/fosb2flGbr/DN
TLSH
T14C32C8166E38697B4CDBD219FB19BB53E2F9103291D51E48E6FC852C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 159dc5692cfe689f8ed057791f8c1535a666429a53b698d884eb9ea186e84161
MD5 379b3cc6f9e076e4aee14f7655230e96
SHA1 62a0177200656f3f30a217b1197587570d08eccb
SHA512 c62d0fdbfce6e1946c5c50142fd656fe1386b04afa165633c245a2ada3bcdae978722a9282ec80d5f56fa95a5f62afc7ef0c9e41f64581fa47b3b15bc0273343
SSDEEP 192:sxZbRTkx/fosL2WHIdp5UGFC/W6+WN0i5/Y9IyVuLIgrJ:sxZb2x/fosL2flGbr/D9
TLSH
T1F222C8126E38A97B4CD7D219FA19BF53E2F9143291D51E48E6FC852C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5de4d61647e6693d647ed07ef5753d5d4f3e21683d561514d7ffcc886bea036
MD5 451f84efaa3033e1839baead1b1e42ef
SHA1 7f254c87f3ef87f4bcfbc20c30f4dc5cc9c1d18a
SHA512 ce323205039fea85c44bdf88edddfb0d64ac2909e3f07fb415b8a39ba815fa6a91e7e920e0a5d50f16fb9a6021abcab3981ebd19e92f10092ee5fcdb0aee21e4
SSDEEP 192:sxZbRTkx/fosbEWHIdp5UGFC/W6+WN0i5/Y9IljuLIg5fJ:sxZb2x/fosbEflGbr/GD
TLSH
T1E832C8166E38697B4CDBD219FA19BF53E2F5103291D51E48E6FC862C05E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 02a1bb140c348229a3f41757e7d5bc5823078361e403500c421d7b50cc06784e
MD5 ad095eb2fb9bed7c3d935c2a3cc30c7f
SHA1 b0348509efc61926a76076f037f84334d5ca8057
SHA512 3c41302a578be253ffd7b14b2fbb33c0cee349b1a5e6d04011d22f92eab88bcf55d0532d7574ac813a6cb32246270706131089235e68570a253dcedf0b8c6c0c
SSDEEP 768:2CyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7droObqX:2CyvIZwWvu+Q+u1jamFLeR7WOC
TLSH
T19DC2E92B240CCB7E5F801E9DDD5A6F9B3EA802C767988D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599fd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599fd0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0d3e44fc8cf5b0e616009e330165d9a35286ceccefcd8eb430fc557b73997df6
MD5 108f3c8503b6941466bb7f968fbede62
SHA1 ff7d334d4e0a89d08dcc716a0c227084135fc0de
SHA512 577ec3e6049f5037dbec25bf503033856a60004a217f5629cde3c10df0285d150cd7c95e1949b8111d0fd9cf38e4f9aca8fbfe5054c4f07f1696efb37b6b6a03
SSDEEP 384:AZcIhsNafSZsb9ziNppce+CxO9+RYQ+HBbs94yoI:+hcWbNo35OoRYQgxy3
TLSH
T106827C72AD789CB729B2D141F94B36136EB88067E6C42F80D1DC7B2D05DB69C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e0725e3edb94df6d9e685d343e98a1fff56a2d8e30a42373ad932db04f83e26b
MD5 791e971105ee2acd084547988a8998cb
SHA1 dbe739f42b1c88792f9d705602a0be113cbf4430
SHA512 20c634c87f77a81a118cf8b096902715ded131f09114b229b14c4c962a2386ad11307b457e96440c6c9d44e3f44a8c3c12fb756d6959763698852ae60ed6d054
SSDEEP 384:44uiFiZcI8sNi8TUNTUlIl6SZsb9ziNpNce+CxO9+RNQ+HBbs94yoI:4gFQ8PwgTWbN435OoRNQgxy3
TLSH
T1BBC22AF248E78876D9AD8743EB7E2D135EBCC057B5846A50B3D8561CCC961BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de3e206497f848bdb89fda89f8574d3b425ef25661bb753e14eb1b64c1314e3f
MD5 db3a93d33518508339bce54617ac123c
SHA1 127ecda45b1bdc4a6a5ef2f86e134ed5dc61faa3
SHA512 cab1c64ea7c5af44a53c5db24194a97d631370c91750a4ad5dc071b787a0a37a7b424f6298dec2a56859fe548ee8863e38ca946126ad424b89b35b481efeec95
SSDEEP 192:JONk6v+YLNQmiUyA1Zh+CGQO9Uous7LU6:JONk6vz/zZh+CxO9PvU6
TLSH
T1A002E835AD782CBB9EF2AE05F84737176FA4217BE5952F90DAD82A1C01D774C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee5aa38ad4d64dc157f28dac7aedc54a70121a2dd15d5eb1ffe399a68aeb2ac0
MD5 609709b75d8e62200553dd9ff2d9b116
SHA1 4a628943c53e2e5a6ed3271436421e488e8d6f46
SHA512 969b54cfb0222c16a3a4a7d2521fe7bae2298cc461e3225472fa0f2b3aae1e88dfe99dd90a640c887306b171356c9b5d0ce81b1abb3ee7ae7b7623fcf72fb60c
SSDEEP 192:0ONT6v+YL9QmiUyB1Mh+CGQO9UNROCHsqSU6:0ONT6vzvUMh+CxO9+RPQU6
TLSH
T136121B32B9785CA75EE2A944F8873613AEA85167EA853F90D5DC3E1C01DF65C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 11cbb018bcc48ad5814a795cb78b84fedb5f384dcbea9f8856ca75486a294e7b
MD5 3cee348ca1253c4df47a992c8af54e41
SHA1 b08d56c9038ed437d79ce2fcb6663807900fb36a
SHA512 8cf5c32cce6f943a691eaade370da4ff174b36eada8fdc6c6eef8f2ea67b868e16a4f19d6c4940b57e06557c13d19f2f766d5de899b5ca63b127cebc456cc2a8
SSDEEP 384:CZcIhsNa6SZsb9ziNppce+CxO9+RYQ+HBbs94yoI:whDWbNo35OoRYQgxy3
TLSH
T128827C72AD789CB759B2D141F94B36136EB88067E6C42F80D1EC7B1D05DB69C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4558eb53-71e4-4f41-86e9-23e779b2a2d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4558eb53-71e4-4f41-86e9-23e779b2a2d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11f260205ec13e8b601ea693563af5c5670f38e8c04519369b28c3e05228ee85
MD5 964b31bd9311c5e1b22cc1b4878cebd7
SHA1 14fc3154e4c215479cb80a5fdf6b0e28e1c5d224
SHA512 1bfa8c50532dbe251925a26ad82b9d9fb698bf098b56cb2bf1cb01fdf4b83123f903ab56a39ad7511f292a9d632f6998efe00a053a1a958f9d79cac60d3ed971
TLSH
T1AB415A5DB6F91149B3B76F5A9BF6A87D487ABC372E0AD45E10010E4F0A32A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download