hxxps://www[.]airasiarewards[.]com/my/en-gb/vouchers

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.airasiarewards.com/my/en-gb/vouchers
Sample260827-dd219adj4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322728842811742"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BC078559-02ED-422F-923C-DC7D054DD113}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{710FC20D-712C-41C0-8FFD-018827B659D9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3304	2852	msedge.exe	85
PID 2852 wrote to memory of 1516	2852	msedge.exe	86
PID 2852 wrote to memory of 2480	2852	msedge.exe	87
PID 2852 wrote to memory of 2480	2852	msedge.exe	87
PID 2852 wrote to memory of 2480	2852	msedge.exe	87
PID 2852 wrote to memory of 892	2852	msedge.exe	89
PID 2852 wrote to memory of 892	2852	msedge.exe	89
PID 2852 wrote to memory of 3296	2852	msedge.exe	91
PID 2852 wrote to memory of 3296	2852	msedge.exe	91
PID 2852 wrote to memory of 3296	2852	msedge.exe	91
PID 2852 wrote to memory of 1520	2852	msedge.exe	90
PID 2852 wrote to memory of 1520	2852	msedge.exe	90
PID 2852 wrote to memory of 1520	2852	msedge.exe	90
PID 2852 wrote to memory of 4424	2852	msedge.exe	92
PID 2852 wrote to memory of 4424	2852	msedge.exe	92
PID 2852 wrote to memory of 4424	2852	msedge.exe	92
PID 2852 wrote to memory of 2692	2852	msedge.exe	93
PID 2852 wrote to memory of 2692	2852	msedge.exe	93
PID 2852 wrote to memory of 2692	2852	msedge.exe	93
PID 2852 wrote to memory of 3308	2852	msedge.exe	98
PID 2852 wrote to memory of 2184	2852	msedge.exe	99
PID 2852 wrote to memory of 3308	2852	msedge.exe	98
PID 2852 wrote to memory of 2184	2852	msedge.exe	99
PID 2852 wrote to memory of 2296	2852	msedge.exe	101
PID 2852 wrote to memory of 1460	2852	msedge.exe	102
PID 2852 wrote to memory of 1460	2852	msedge.exe	102
PID 2852 wrote to memory of 1460	2852	msedge.exe	102
PID 2852 wrote to memory of 820	2852	msedge.exe	108
PID 2852 wrote to memory of 820	2852	msedge.exe	108
PID 2852 wrote to memory of 1196	2852	msedge.exe	109
PID 2852 wrote to memory of 4540	2852	msedge.exe	110
PID 2852 wrote to memory of 4540	2852	msedge.exe	110
PID 2852 wrote to memory of 4540	2852	msedge.exe	110
PID 2852 wrote to memory of 5492	2852	msedge.exe	115
PID 2852 wrote to memory of 5500	2852	msedge.exe	116
PID 2852 wrote to memory of 5508	2852	msedge.exe	117
PID 2852 wrote to memory of 5928	2852	msedge.exe	119
PID 2852 wrote to memory of 5928	2852	msedge.exe	119
PID 2852 wrote to memory of 4888	2852	msedge.exe	120
PID 2852 wrote to memory of 4888	2852	msedge.exe	120
PID 2852 wrote to memory of 5324	2852	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.airasiarewards.com/my/en-gb/vouchers
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13817319298019856290,16138394080819940602,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12638037150325189892,11708489874763899896,262144 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,5857638957712994663,15184387876589675193,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,11050899170923361877,16560751428906651725,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2705427040680611604,6719042388074153214,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,15207817211048368934,14910811457539511970,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6894602363362480935,14121524189478653521,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,6014324982162903738,15927001898550773496,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13277092694726834947,7687709731379653630,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7890724222482612387,8250532024743092351,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7890724222482612387,8250532024743092351,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,7228895282197678559,13533815404822595450,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,5552108586822061293,14380590981057287279,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,930944383170773360,13848916769175824682,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,13142705200531744123,17616602351351167288,2097152 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,8310323053187266117,4858812816326261290,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,14420275618000027777,16809367365043072112,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,8555564595388557557,12889610680647588766,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7928549444548707249,11979970696845139908,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,3208364620588174710,13225832468484420182,524288 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5228,i,3773530439139128225,11762449763576387604,262144 --field-trial-handle=1776,i,9121242832620981687,6734870659748747508,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2b8baf1a7a4eb9041a9c39a62c9576e772bc10b8568d4e0f5c34c6e10e80102
MD5 37bb2df384518c08d81544c6e36bc5b6
SHA1 e509e2729bf178dbb4f3bda6ae7ec9d5777aeee5
SHA512 3aa6474accbfea711e618e61ec021c00e174122c0a10e01e4ffe8e175ced9d6f8f120e8d6bc44fc7c8cfe180aa13f97dda875d22175f1c76f96924c73ac2e79b
TLSH
T11F81E5E0F1BA8995D3A1837DCAE0CA2434358B5B4B9FDE4B0A60513EE40FBD3536E118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595412.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595412.TMP
Size 3KB
SHA256 d378c9eda59f31cc7c0c8cf161f4fc78172f5e239306b1ab0049b5cbbb23bc48
MD5 c30cade6733554b170a9ff2d6cbc1f1a
SHA1 286c655c50a4bc54794cf3f8b7bb5fd6ef45777f
SHA512 d1a805bfeada4097072a6a3dd64d9b46f14cdc5a1cc8fb017205586a4e54ee339c60e85482da2a20c016db8efa14e13643926f8cfd6746f7035891e94f3eb778
TLSH
T1E07192D4F1769896E3A2837DC6E1C62534359BAB0B8FDD4B0660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4a74aa4459a8acb02769f07e55eddad3915aeca4e96f38d89220d3be10c5ef28
MD5 6657657756d35d8920eb28716385e86b
SHA1 6ab17495606f726241e02921a49bfbcacec66101
SHA512 a377a762f8632e1eef4901114908517ad24b5713ff9b733ffb5debc03f78785b42702bf0de1b00085fe01e8997dcd09747d628adaf5ac572482c7f882ccffe07
SSDEEP 192:D6OyuNLTpJ1GpjEZ5S3UIoq7B5VwQMqfXp75B6z7VKzT:D6OyuNLTpJ1GpjEZ5S3UIoq7B5VwQMqj
TLSH
T18AF1B9BB82F8856DAC1291F1A61CAE3FCF5A1518437C3D8AC4D4FE9AD7F11A1C10294E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d0664d8650d60dc282aa3e68bdb6eaf901c0da43ac703b8630ad44e0da732e19
MD5 439e1750e341cd4a2e5fac3b6f650df9
SHA1 599d771672258b9badd3d371e7c86efaf2bca83d
SHA512 66821a1936e486d50183c5169eb2ef3ca3c498d05b1c3d4804683c7467612c14eb39364a992adcf9da6ac06599427389ebb5bafb5797105dd6c9f3f458ad7a01
SSDEEP 192:sxZIR5yM/jK1Ml8Mkk/fns1/+IdpePHW6+WNeQf/YwkyX+3IgrJ:sxZIrMk/fns1/vcHb5/hg9
TLSH
T18752E8116B74A97BCCDBD20DFA41BB53D6F5053292940E44AEFCCA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 116d29db4f58c444f8b2ab0450b6498035d26dcb1732fac663f23567ce3c3449
MD5 41befb5111e9cc026881d23999b47e51
SHA1 e82a3e04dbc6b8cb2297a28123865cebbc9f8eec
SHA512 af7653778017f12690a296892b9a3e31d4a8b31edd8d18db391495aff8e2310874acf7527e704e008f86b51411e01e5015437e8140db0a0da5101cc023dcfc09
SSDEEP 192:sxZIR5yM/jK1Ml8UQbkk/fnsDM+IdpcPHW6+WNeMaXYw3HF+3Ig54J:sxZIrqwk/fnsDMveHboXfgO
TLSH
T1A752F715AA749D7BCCDBD20DFA41BB53D6F5443292940E44AEFCCA1C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dddd49bb522078bebe12b5208c4755b4dd46de053d69fcc96715ffc35ee74899
MD5 4a79bc3b817afaa836fac52e7cc79cbb
SHA1 36492293b5b4b153f1e5c418b04cbd1e9ecd9c4a
SHA512 467a5f11d90b5b11cb52ad8f4db039ee5abb0bcdc8270690fd8d485e8918d0b544ae8b031fff31ac0b83a4ec8db16fd4474b9950b2565d3c50800b106a53c7bf
SSDEEP 768:PI4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dgroh5/3ay:PI4jeXmWvmKxEu1jacPLZQdrTN
TLSH
T111E2093B280CCB7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3c0319cea734060eefbd009607a23b973519590f0af04b40d6df13515a7f74d
MD5 30ddfd05ae5d6e4d3ca171a279faa01d
SHA1 89e7bd5be1167983fb3e3b44e877826e08f85e49
SHA512 1bab24498193677c7f0778579ac58236ea1c5ec97ee1236dea2c10622f56fde3feda052792ed73a6663efb982e32f14a3b87bd4c993262da9bcac08f842ef0d6
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ43SgKXqW2z:zHC7ntll81A3HHLdBwfHoxXfVXTG
TLSH
T19391415235BF56022C7E290C92A4D7679A4271B33218A43B77EC01B64E67E240EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

689ac181-863d-474c-b901-055ff0ce19d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\689ac181-863d-474c-b901-055ff0ce19d6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ccbecb638bc8276ffb67d765d6af8fe813e78068ae911a1850a74a586bc027e
MD5 c61038a13707101d399f0ce9fd309b12
SHA1 2d7e973b4a885881cdb4b463400dd064e99a5965
SHA512 9d8ed60579c6673715314d3d1187220b19ff03c2cf1b9ced9e21c1f6d185a3605055711ad30780b71cf518961a4eb46b5d61e848fea96c169a8bb2a48fa79eaa
SSDEEP 384:sZcIhsNvUMQ8wseQf++BO1/cxFe+HBbs4v+op:6hfYTBO1/cLegZGe
TLSH
T198828D725CB8AC771CF5A146F8473A034EF8405BDAC97FD0D5DD6B1D049A6AC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 416c33d017dcc763068509ce117dbe9c1e66908cf99fc53290d44deaeaa19552
MD5 75a313cbbe7a8cfc0151091a56f5688b
SHA1 61223ede4d214892b7ed93b452fa9e83e67b10ed
SHA512 45e00eeb2463bed3e70d1a77047ae56e838e518034a0c633515e014aa0f34cc9f77f3a3f2a7d81ca4e13cf30dea572f6a514bffa5149e3072c4571afc832df0b
SSDEEP 384:XiFiZcI2sNk8TUNTUlIlpQ8wsuQf++BO1/cPFe+HBbs4v+op:SFQ2Rwg0YTBO1/cNegZGe
TLSH
T18FC218F248D79876D9AD5747EB7E2D034EBCC057B985AA90B3C85A1CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54db2ce6ea0c10d0abd719d307786a0da997959436484c2bda8b0d7596843e00
MD5 735fd647431d21b653801171359aefbe
SHA1 ba8c95e89452826d6a81f56d044928e26c81521b
SHA512 6feea2ae69ab16d812690ca75c94951311f87c9f5c02ae64b1e7071ff4007284ea3036efa36c1ec717b3256ac51594ff5e11fdada1ad69ad21b40a778d70bc33
SSDEEP 192:EONI6hZ0QmiUyRRpc/+jVEBO1Tm65wOZjgfrU6:EONI6ocpu++BOU2EDU6
TLSH
T14202C83568AC7C778EE2AE45F88727235FE8212BE9956F84D6E81B1D04C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b90aa6f9dd25b40bebe0553a9ed423756dec74e31f5715e4059462dc3a0a32a
MD5 57d2084c2a60fd175a8cd27f698e6eb9
SHA1 48136bef6f31eb4f497ffd2833d548160be29e9e
SHA512 04385e6f9e5c341ebebcb4a9706270a23a2c3ce5d017841ac2efd5b6e3ac6f009e6b3e6dbc050202fd6303ee44aeb627b9104f81b2377375b45e8dd2ea758a06
SSDEEP 192:FONt6hZ0QmiUyRRQc/+jVEBO1Tm6//Ex5cOqoq8U6:FONt6w+Qu++BO1/cU9eU6
TLSH
T164122C3268A8AC771DD26585F88736534EE95127DE897FC5D6DC2B1C04DF76C230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 88e3a551b22886e28854de13bf0a2481bc472e2c8f5d34181c308f184840dec2
MD5 b68755eb1f636d9c84e18e87aff3486a
SHA1 69ec4e36695c3724b19bbc2dd821de5e7a1d5627
SHA512 fa4bd4f944d76b4e2aaf2bf5e1e6b9cd693adb538931dfa96b8359353156bdbbfe11732b61fa4d29a859b448b2f1a7c891076e2ca1e704cbe78d85682b396e2a
SSDEEP 384:VZcIhsNvUpQ8wseQf++BO1/cxFe+HBbs4v+op:thqYTBO1/cLegZGe
TLSH
T117827D725CB8AC775CF5A14AF8473A034EF8405BDAC97FD0D5DD6B1D049A6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f45d92f959341d8ba64cb59482bd3845d18254a210918765e8a5a48bbf717b79
MD5 bfca37e6a18e97beea40c604db045311
SHA1 581b2f92eea2358505cea6ac20cd1889c6ec2012
SHA512 b878d65b34b29256e5e22179008d158fbfb9df4d530cfc8b5135f7ae5cb99149131c1980b1ccbdf02142e063a8807f1af624b84d1e0544bb36d546b0fe6570c4
TLSH
T16D41C698A6E91149B3B73E5AABF6686E887FB8372E46D05E00110D4E0A63F40C971777
MD5 SHA1 SHA512 TLSH

Submit Download