hxxps://accounts[.]nvgs[.]nvidia[.]com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9[.]eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9[.]gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
Sample260908-wv61mswerd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333649500951995"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{170AA576-16E6-47F7-A231-A78F6E166680}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4840	1264	msedge.exe	80
PID 1264 wrote to memory of 2348	1264	msedge.exe	81
PID 1264 wrote to memory of 3252	1264	msedge.exe	82
PID 1264 wrote to memory of 3252	1264	msedge.exe	82
PID 1264 wrote to memory of 3252	1264	msedge.exe	82
PID 1264 wrote to memory of 4436	1264	msedge.exe	83
PID 1264 wrote to memory of 4436	1264	msedge.exe	83
PID 1264 wrote to memory of 3492	1264	msedge.exe	85
PID 1264 wrote to memory of 3492	1264	msedge.exe	85
PID 1264 wrote to memory of 3492	1264	msedge.exe	85
PID 1264 wrote to memory of 2896	1264	msedge.exe	86
PID 1264 wrote to memory of 2896	1264	msedge.exe	86
PID 1264 wrote to memory of 2896	1264	msedge.exe	86
PID 1264 wrote to memory of 1644	1264	msedge.exe	87
PID 1264 wrote to memory of 1004	1264	msedge.exe	88
PID 1264 wrote to memory of 1644	1264	msedge.exe	87
PID 1264 wrote to memory of 4240	1264	msedge.exe	89
PID 1264 wrote to memory of 1644	1264	msedge.exe	87
PID 1264 wrote to memory of 1004	1264	msedge.exe	88
PID 1264 wrote to memory of 1004	1264	msedge.exe	88
PID 1264 wrote to memory of 4240	1264	msedge.exe	89
PID 1264 wrote to memory of 4240	1264	msedge.exe	89
PID 1264 wrote to memory of 2688	1264	msedge.exe	90
PID 1264 wrote to memory of 2688	1264	msedge.exe	90
PID 1264 wrote to memory of 2688	1264	msedge.exe	90
PID 1264 wrote to memory of 2556	1264	msedge.exe	93
PID 1264 wrote to memory of 3424	1264	msedge.exe	94
PID 1264 wrote to memory of 2556	1264	msedge.exe	93
PID 1264 wrote to memory of 3424	1264	msedge.exe	94
PID 1264 wrote to memory of 2176	1264	msedge.exe	96
PID 1264 wrote to memory of 4636	1264	msedge.exe	97
PID 4636 wrote to memory of 2680	4636	msedge.exe	98
PID 1264 wrote to memory of 444	1264	msedge.exe	99
PID 1264 wrote to memory of 1128	1264	msedge.exe	100
PID 1264 wrote to memory of 1072	1264	msedge.exe	101
PID 1264 wrote to memory of 4952	1264	msedge.exe	102
PID 1264 wrote to memory of 4952	1264	msedge.exe	102
PID 1264 wrote to memory of 4128	1264	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa7d08c188,0x7ffa7d08c194,0x7ffa7d08c1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12793542496108392148,15161292087817738192,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12484768420169895084,8925188810974657939,262144 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17797749133378585927,16493071481618025171,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8369619095786710264,12187877065524115529,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,18036324511076240594,8478024623347259822,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,3558002579326467451,17931850171278393734,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1080095183305085694,18233520247866153869,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,16475387368834921338,16332506235608143972,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,14263075152313662449,9161699864902293850,2097152 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,6393217767076020833,6780424888759183316,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15692678984451446521,4496305358284561937,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,17917035255060659319,10813494824669068535,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,17917035255060659319,10813494824669068535,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,7302256577973859515,2761035587738224637,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,15559547445030790590,9780660640763807524,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,12651206418593731174,12826962313898775472,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,18318997396309285584,9614529873772397941,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,5668179984037623391,10017016103554743363,524288 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,3785229438678591974,8221696795127715695,262144 --field-trial-handle=2204,i,11817431603322587034,17996030592534707247,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9268c81dd8afa6fbdc34d051a638b4dce94ab92618da951ddb0bc7dc51433fef
MD5 861a6fce0d87692d2b4a1303e56f1a25
SHA1 7a516cdc72a0f568ccf931e78fc08ead146d8e52
SHA512 9a9d6e902af9bba26e1ef6ceb054ca9a19ea9e7ea145a221d8fbe629d7b20cfc76340fd3acdcccde9af66986da13da0c4d8c84cd8ce7106f1212135992e9ce44
TLSH
T166D02B21B7CCD400C0E30031C018931041A800C4642B8944B0B0842D680B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 adf1ac7ef6ad2f467814611b23b5905d27bfbc301c113cc0f42faa887b0cf867
MD5 43cfaffeaf5c46b9eadeebb1347c22e7
SHA1 d96f3ed6add4b5fd08b00be076bd99ac8c96b6d9
SHA512 d9c942c219d1021105ade146c164fb4fff35ac9acd0e85af945085e82c7ecd2ab6e92dbb4acf30d22ebeb0b2a7a9788fcf0f1d01f75408a2ec7523fc3c62a603
TLSH
T1C7D02B2177CCD800C0E30031C018931041A800C4642BCA45B0B0842D580B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b927271ca1a8729514f02030b6b76630d36f4b6ab77be81ab77903288a02955c
MD5 2c46279f40e67899aac3243f4ec5d68e
SHA1 349f11006cdaeecad479dac3797648d1cd71a8cc
SHA512 ce935fd641601a92bf04c984e95c358c9d2ca81adee00b5651efe9acb99b24f5b57569d874593ae1804158b229ae82fd70874b7a2af2959cb0c3d8b5f97ab038
SSDEEP 48:RhUu9fZSD9AeDRDu3aVFddRIuLBQULppHKRW6PpBBTb5/XIlY/0oXtYC3V0G:N3SCeDZTFddRhC0pHcpT9QW/0GmI
TLSH
T122916C259EF26631E31002F0C4D3EB8378728875BAF71EE119F4D9BE9253792AE25034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ad04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ad04.TMP
Size 3KB
SHA256 19c4081ac733695319bf5b3f8eb30372158fb64546fde1d01814abd102a2375f
MD5 de8bcf1e7a832ed92818c783d7941923
SHA1 f855346fbbacbf9af0abb4b0b4e011e38962be00
SHA512 6b49f4e2e24ca08581ad82910548b8debfc502f99badbc8794216c5422ab615e6974853eade943b9097c8021efc8d7786245ac8575c423062e48dc94afc57357
TLSH
T14D710925CEF2B871E35101F1D4A75BC378B58479B9F31E6111F4847D2297A118E66534
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 978a258b36e9b627122de963844db78a11bba48f8d6fab154e2d1583f103797f
MD5 cd3ae1761b4871dcf3a33f4cd7a72c9a
SHA1 429680be83d937d49495fe7592c02b044e24213e
SHA512 32958fc89e384276e3ad728d4c570496864b1a9a86397588ac8acf4d6a0ea9a742333e62cd35b54f1deb9c553c945a91ab7b5778a5a09d077ae689d4241bbd0f
TLSH
T1BF2168F783B0D96E9E0196F4AA189E1BCF6C0615435C7C3E86D4AE17D3E3461E001A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1b84150b0ba2c3991d92332d2226db70afb40290dbdd4aae7708ec6cc012ec2
MD5 8369aa26c9d873802f090c9714089fd2
SHA1 8903bf5ac3612fa7e4ff7785681a5bb6454a9c7e
SHA512 51775ee8d0b34144357492616a1b3673b50102175f6e0afd3bfb602b56dd206909357922c819fff55b456c385b11477e7cdfbe8a3de067965998d0a627116b2e
SSDEEP 192:sxZKRbyM/jK1Ml8MF7/fSsKcVIdpYfw/W6+WNrs64/Y0YGcwJjIgrJ:sxZKFd7/fSsKcmYY/bb4/5L9
TLSH
T1F5520911AA34697BCCDBD209FA51BF53D6F8147292904E44ADFCCA1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 800ab55121bbf3172c46ae32b058ee1ec7b29fbc86233a9e986010583e46a7b9
MD5 367eba876cbe8a5c3d81ca5355615755
SHA1 0a150d2f95436a71dbda5c3cacb11447453f4774
SHA512 45f475d4e545dc1f4fc3c158f8c4f191cb0be46f8075c4841aa4a7648589a08b33cad87515c3a195d68c3b2ccef4b159bddfce73c4cd799ee9aa75ceebb2820f
SSDEEP 192:sxZKRbyM/jK1Ml8UQ6F7/fSsC2VIdpSfw/W6+WNrs64/Y0YGxTbjIg56J:sxZKFqg7/fSsC2mSY/bb4/5xY
TLSH
T12B520915AA34597BDCDBD20DF951BF53D6F8147392900E44AAFCCA1C01E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 2b3acf09a5c5a40d8432e012b61c9831c58bf2ea61c23193fcfbbb05c3f15916
MD5 a8c6ba54119ede1fa226a92e4ec3579c
SHA1 d4947a664a22676390eb2bae2eeaca906bf583ac
SHA512 f6fe0319cab39f2f86f0578fe5f89d3ba6dbf312f6d1778283edde0eaae4059c2a32c47a3c199e49fb235d2980f71dcf0499cde9ba0cab2d7da01a0e8e6a61e8
SSDEEP 768:9yl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/SOrocI:9yl1j83r2pmWRmeKQBCu1jaK3ALpCN/+
TLSH
T1E2E22C3B680CC77E4F844E9CEC266F966DD801CBAB684D5447FA484C03C77EB552A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1a5116efc4b3e80fcc6ffa16a9ddf5ef060a1e24b2a88fba16c87ac95961016a
MD5 08cedb718347fcd72804f28ebbff3b30
SHA1 e5b8af9871eba8cc2e4d9a1fa448e40de72490fc
SHA512 d41697c2f72a87221ac03d8af9c688cf9fe8b2c21a887c7d12c6e8d1e8a00ee10ddc7f10f35386dddbfc0de2cfb913a1b6065bd909f1a17c2d0ab50d4715ff22
SSDEEP 96:KkUgKtemKaUKP6GqgQK1CSEx+NhfTHMvDUX15MK9Z1HMRRhUvY:6vvDnvEx+NhfTHQDUl5FZ1HwRhUvY
TLSH
T1EEC1384230BB06413D3E6A08A2B5872B4B8276633529E56F3FA940F54D67E340EFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85f12afc-a3cb-49ab-b383-50be108c51bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\85f12afc-a3cb-49ab-b383-50be108c51bd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6365cc1457e308062b35a5b2a9c6a3b4748f0ac13fef15cd1d2fd2ace6c65edc
MD5 22e4a8c8bdb419008b0ffefb252afc39
SHA1 70bfea6660e71c394003bc4bde2a61c0114c2a7b
SHA512 421947eaf556233a6f7197ab35b1153ea2033ef54cfe63821f2991c7f6029d96a9a59751368ba701587f676c45bafbfff2a6271ea0ef1d2106c6670851e3bb08
SSDEEP 384:bZcIP8NV+EA3RQxdgX532E8mdH2EX50GxuvzxV+MhdpHG5oc:DPSmoCfF50G4184pHeT
TLSH
T1EC827D71ADB8AC7B5DA79145F48632135FB8906796C86F40D9FC6F1D019A299030EC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0ea3923dbd9efb1828bf15ce291905ab4ca31a9ef78843d7cde1de6550dd8882
MD5 31747d6b2b40e8e9eb06fb52ea4f7e22
SHA1 3055557232a6d30e7bab30ff65d5fb9ab732a678
SHA512 b79e4ba9f5835f6f5a8708ea8e2414ef7cc99707b79eb3248f7e5a35c786d7abb2198b5eada4f08d64c02d2246bb1ca724ae62530e84b40efed63f9f745aa28d
SSDEEP 384:kZcIP8NVyEA3RQxdgX532E8mdH2EX50GxuvzxV+MhdpHG5oc:CPCmoCfF50G4184pHeT
TLSH
T15C827D71ADB8AC7B5DA79145F48632139FB8906796C86F40D5FCAF1D019A39A030EC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ea52d69602c06fc369641ac80239f178235614ff1fc1d29fc04872848b1d6dd6
MD5 4a8a6a29aa24734275d649bac324b82b
SHA1 bf057113436c128ec919a0a978a7bff01e1c3792
SHA512 541d48fb3cc90ef2d411ed656080b49b1bcec5047f3dcb28a583bea9db9f43a511606dd15b2817c7495712a61dc8c89bfd75e661e3b622ba2696ff93e2905233
SSDEEP 384:YZcIP8NVJEA3RQxdgX532E8mdH2EX50GxuvzxV+MhdpHG5oc:mPbmoCfF50G4184pHeT
TLSH
T184827D71ADB8AC6B5CE7D145F48632139FB8906796CC6F40D5FCAF1D019A799030AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 18b5ed8e011f7d88685f4816f610227370ba0337c73f22bdc83ea883048cc7de
MD5 2ed5fffb4c6ebdda87142a8fe87687b6
SHA1 9f1531c96234c56272f19954a83f5b5d707adcd1
SHA512 f01e7084997ce459f4a2eaa87b634f4408b084bda88868737dde363bd409efb3734b2dd6a6a44978deccf24f10ccf67fc10a57746622476f61264e7cda94760c
SSDEEP 384:JiFzZcIU8Nv8TUNTUlIlJEA3RQndgX532E8mdH2EX5hGxuvzxV+MhdpHG5oc:gFrUSwgkmqCfF5hG4184pHeT
TLSH
T105C22AF258D7987AD9AE9743B77D2D028EBCC067B584AA40B7D85A0CCC561BFC309C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c193aa6f955919e55c8c47fa83a8cca053099beea96c8bce75c67b623f66ef4f
MD5 1f7872fe5af8c83dfae474999f0773d6
SHA1 4a44ae946c90eaac265d86cf8d8032db7cfe7237
SHA512 47c71e39bff560f1a87952b68ac76826df824205c57c80b92361f27a71ac1bdf11b73680c5a85ea260d9e805ef97fcd0ff1674e4b1c4ef4829a03ca0076447ef
SSDEEP 192:6GNO6i5fQmiUymdSO7X5zPr2Ujzormd8o2oajDrzU6:6GNO62hNYO7X532E8mdH2dPzU6
TLSH
T11402E935A868AC7B8FE39E46B48637175FE4112BDA956F80DAF81B1C00D769C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a362b36a4286b1e5b906dc1f5da7db407edf604f5516546a7f0cd4b524b118c
MD5 8aa8ced99e6306041310c5161521e38d
SHA1 b7bd5dbe9b678e8a614c59df1635e9b2a8d313e8
SHA512 562ef68d5443bbdcbacc7b1f880fdfd3e5eb8e74f48dff73b9b67af4f5b1349903266269a1a52ab297b372e675c9f3eaeadc18cf73580cbda6c730fbbeeb1415
SSDEEP 192:MGNo6i5FQmiUyES/7X5zPr2Ujzormd8o2EX5roTnXGQFq7U6:MGNo62jg/7X532E8mdH2EX5uGU6
TLSH
T1B2120A35A874EC2B5ED2E595B08631139EE5512BEA897F84D6FC2B1C01DF69C430EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa06aaa2-bc3a-4fc2-be49-11c8c8dbb918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa06aaa2-bc3a-4fc2-be49-11c8c8dbb918.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download