hxxp://closewithclio[.]com

Resubmissions

16/09/2026, 22:27

260916-2dbq3afa653

16/09/2026, 22:24

260916-2bqgfafa473

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://closewithclio.com
Sample260916-2dbq3afa65

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3240	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340712819242933"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{A79CC18C-C398-4189-91C5-2F05BD2DC46D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 1896	4092	msedge.exe	84
PID 4092 wrote to memory of 3108	4092	msedge.exe	86
PID 4092 wrote to memory of 3240	4092	msedge.exe	87
PID 4092 wrote to memory of 4784	4092	msedge.exe	88
PID 4092 wrote to memory of 3108	4092	msedge.exe	86
PID 4092 wrote to memory of 3108	4092	msedge.exe	86
PID 4092 wrote to memory of 4784	4092	msedge.exe	88
PID 4092 wrote to memory of 1880	4092	msedge.exe	89
PID 4092 wrote to memory of 4372	4092	msedge.exe	90
PID 4092 wrote to memory of 1880	4092	msedge.exe	89
PID 4092 wrote to memory of 1880	4092	msedge.exe	89
PID 4092 wrote to memory of 4372	4092	msedge.exe	90
PID 4092 wrote to memory of 4372	4092	msedge.exe	90
PID 4092 wrote to memory of 2252	4092	msedge.exe	91
PID 4092 wrote to memory of 1472	4092	msedge.exe	92
PID 4092 wrote to memory of 2252	4092	msedge.exe	91
PID 4092 wrote to memory of 2252	4092	msedge.exe	91
PID 4092 wrote to memory of 1472	4092	msedge.exe	92
PID 4092 wrote to memory of 1472	4092	msedge.exe	92
PID 4092 wrote to memory of 1160	4092	msedge.exe	96
PID 4092 wrote to memory of 1160	4092	msedge.exe	96
PID 4092 wrote to memory of 1160	4092	msedge.exe	96
PID 4092 wrote to memory of 4000	4092	msedge.exe	97
PID 4092 wrote to memory of 4000	4092	msedge.exe	97
PID 4092 wrote to memory of 4316	4092	msedge.exe	98
PID 4092 wrote to memory of 4316	4092	msedge.exe	98
PID 4092 wrote to memory of 3004	4092	msedge.exe	100
PID 4092 wrote to memory of 1192	4092	msedge.exe	102
PID 4092 wrote to memory of 1192	4092	msedge.exe	102
PID 4092 wrote to memory of 1192	4092	msedge.exe	102
PID 4092 wrote to memory of 728	4092	msedge.exe	104
PID 4092 wrote to memory of 728	4092	msedge.exe	104
PID 4092 wrote to memory of 728	4092	msedge.exe	104
PID 4092 wrote to memory of 1140	4092	msedge.exe	112
PID 4092 wrote to memory of 3808	4092	msedge.exe	113
PID 4092 wrote to memory of 1484	4092	msedge.exe	114
PID 4092 wrote to memory of 3972	4092	msedge.exe	116
PID 4092 wrote to memory of 3972	4092	msedge.exe	116
PID 4092 wrote to memory of 1384	4092	msedge.exe	117
PID 4092 wrote to memory of 1384	4092	msedge.exe	117
PID 4092 wrote to memory of 4804	4092	msedge.exe	118
PID 4092 wrote to memory of 4624	4092	msedge.exe	119
PID 4092 wrote to memory of 4624	4092	msedge.exe	119
PID 4092 wrote to memory of 4624	4092	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://closewithclio.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff12f2c188,0x7fff12f2c194,0x7fff12f2c1a0
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,18420487726523754092,6633140339075729819,262144 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,8876636598126338642,3872471262901876042,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,7247443529158293661,277761258418365254,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7060647003547334754,18179283217531263027,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16150990994434380578,13229574143493611391,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,5825624401036990413,1570711789395394559,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,49280070076770810,1393549484252343118,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3584,i,6034414531641836476,17488096186062796905,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16616428007506259544,12326879993584556611,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8415580742929429177,16525448481882238378,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5029415982091739282,11293855929326567136,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5029415982091739282,11293855929326567136,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6180,i,14771510437774262515,1655634666650367526,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6364,i,9847580372005647419,14548009643343383109,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,15730135070206075903,9632445649110598464,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,12125245170407861319,15288474108923770603,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10959819968504083206,16577282671841884911,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11811883146575979052,2800677600915776728,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4976882387569781017,9396277130056498469,524288 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,13466477365460212511,6787354394781333653,262144 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=1016,i,7877699058620534663,12813920965879808563,2097152 --field-trial-handle=2944,i,85257224006038212,8711805569097345515,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03088aff8cfcebda95761a2c39dbc1691fc97a86aa1488464d1b57c25d14cdee
MD5 9410196c9baaf07cfb5a1a13ecef0de4
SHA1 0cbbdcf8b865f0eb8639f0da40bcc4343955dbe9
SHA512 001ff2f6778edfc8d753b498ce901f5e2493ec0998e6f0bce3b2c902ed6167d890e65b1a5ad1914c6985c2a44a0713bf3987e8f25273ae3e5f428dea872cf8f0
TLSH
T13D617F864A9485D6FB96FC3293E910A7BF7B65C347839F8B835CC87ED44671520C419C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a47.TMP
Size 3KB
SHA256 3d7b0dbf876ffe7303eabd450f02a4cd8bda7be9b5ab8aa67667ad159bd555d5
MD5 d806a5fb451c9759f82717a00139463d
SHA1 2fb1c6a26fe8033f7f695be7613825ec7b36b9e6
SHA512 6b22c91756909cba62d3d7eba1e95009d018acd6c1b7fedc740d77ba456f96b50e405d5fcf65a0b073a0eacb5256f7ba36bb5cf7ec94059349d7a7409109a922
TLSH
T1CB615E864A9485D5FB96FC72A3E900A7BE7B65C24783AE8B829CC97ED44670520C419C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4f53119c6e98c9a498ff2674bf6397c9bb7ae3b541d67c9f9ab7271a91d10f8
MD5 6c34e3fe79d2487b13c9533c0de05677
SHA1 f58ce9423f7f896addde021ae70b0e19db774fe7
SHA512 dd259f7f6843a347343cb50f9e3504ff1fbf49468ca6ee09a857d051230f0c5b1c15fc8b28b60e946ae1f1b64e23164ef9ab95626bd64515d650a9421f7e9e69
TLSH
T1D5419BF283D4875DDA1112F0AA186D2BDE6D0A5443583D2AC9D9DF4FD7F2076D10194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3765ee9a6a65ff304457204be15ed81a048189b3bde29f82fa6e24c41a3394ae
MD5 505afe385b272280dad5a89652c62c4a
SHA1 4d0053ced467213a99ee18de84fb1c53c63fa0ed
SHA512 64ee5b9a95fcdf184643712fb035414bc9f1c7b7b36f481473af6561cdd21ffa0cfb8a2e729731ee710977a7aeea64c69643f5d99976b3e582e256ab01e4024d
SSDEEP 192:sxZjRiWv/fWssfIdp3M/HW6+WNUpk4/Yg/a+PIgrJ:sxZj7v/fWssQOHb14/os9
TLSH
T1C322B8666E38A97B8CC7D21DBB15BF13D6F9103291911E58AAFC861C04E6ADD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c2f0adbf79479f91b7a8e8be021bb61bf5594be5d019f62b34b61ace6b68ec47
MD5 7f4ef9d1af1b183121a5f345381c2472
SHA1 c9fdcb9eb44711c31e771a04c52e10cda5bb6547
SHA512 a5fb9bd30daaf76d6b16e3a0249bffa3b649dafa321c862f07d83595aac304689b3fde643c45da9b2ebfb8a5415c462e059cdb0150fed4f08af9a85a83123190
SSDEEP 192:sxZjRiWv/fWsMfIdp3M/HW6+WNUpk4/Yg/a+PIg5TJ:sxZj7v/fWsMQOHb14/osr
TLSH
T1EA22B7666E38A97B8CC6D21DFB15BF13E6F9103291911E58AAFC861C04E66DD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9dc2a4a20a484967ae491739b4c0bf3c1c7710a5d674b81752152f8bb815fe4f
MD5 9272aef8feefe6e7d3fe71b958596dcc
SHA1 8445cc72ae0f8521fe2a3def0e86717460c1a8a8
SHA512 5f96f1abdeb3b19b23ec9a7e5a54df5b45b2594101ea8be805fed61ffb3684837bf253bebf1a205b00a75042cd754a51b5b037db08df7ff4e14a0773a765e13c
SSDEEP 192:sxZjRiWv/fWssZIdpZTEHW6+WNUpk4/Ygja+PIg5hJ:sxZj7v/fWssy6Hb14/wst
TLSH
T10F22B7666E38A97B8CC7E21DFB15BF13E6F9503291911E48AAFC871C04E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e7773f6cde78218b7832500464ea8a06373073cb6121fdddbdcf989c96cf2d2a
MD5 58630efc43dc64ce687a9a1c0cb372ab
SHA1 fd00a5cf1316bbb1fc025d02d3810ef2231d70b8
SHA512 bb7d08da7b7c008cd590e63744260108ff068ec3c9c98b52112a3eeb198d151486138c11abad31f6d911b743871818af61a11108f25ca1524476096d65340a26
SSDEEP 192:sxZjRiWv/fWssfIdpZM/HW6+WNUpk4/Ygja+PIg5hJ:sxZj7v/fWssQ4Hb14/wst
TLSH
T17622A8666E38697B8CC6E21DFB15BF13E6F9503291911E48AAFC871C04E7ADD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a39e1a4ad0619c5a284f05754cac292f39835da4d9349db163414256c1717527
MD5 a7d00a771bc8928f11dac295a271bd02
SHA1 cbfe0df216c798a8210ca7edb8869a502e48f84c
SHA512 ef2a5ab52c8c6e19bbaaa52015e08c0a20514a37aa987c94c63a39715284e96fd14d8073637fa242ed94732557f99dc4186a21afb549e773c747a872398660a7
SSDEEP 192:sxZjRiWv/fWssfIdp3M/HW6+WNUpk4/Yg6a+PIg5hJ:sxZj7v/fWssQOHb14/pst
TLSH
T19A22A8666E28697B8CC6E21DFB15BF13E6F9503291911E48A6FC871C04E66CD231740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 95f3d519a63b68aa34da74ab4195c1a5dfc4a51ab8a9adf2da5724a4a258c317
MD5 0b8f0cfe304ab5bf8fdcbc49f64d6385
SHA1 fa8c862ff1dcf5b6ea0a0edbee89e8897dea0560
SHA512 c56cf7a1d89eb2635f8cbddc33a5707cd3c1b75379cab94090dac74ba8718fd260502d5f6295963c2ead2a5d8b8f0ffd2dfcf628754268e18f5016bb278ea0d4
SSDEEP 768:/QichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzwrovyv:/QichfPWvPZhlu1jan+LKgzbKv
TLSH
T138C2FA7B644CCA7E4FC01A9DDD1A6FDB7E9802C7A6588D4047FA984C02C77EE61264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 587B
SHA256 6c4b913893d2be85d3020b75e162cd0f4ed00bd3e2588792a2d385da93f11612
MD5 f675e006eb80caf6c7f16ac119513e41
SHA1 b8452fd245e8a70a78f189c5ab1220d529f4cbcd
SHA512 23fd28198254869bd826c67906e4b9cf8bc821688c8a9c71e440dad95b1d379440b1cd347e266ca0f022e46572d50f3caec481ea7841fd2ed4e051ab32fb3e74
TLSH
T190F031C0B2EE01CA7E8DA551C10F4E0B98B27A96120D5D71532F48F48F84C180F1ED54
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b74bd093ab75aec7220fc740da530b224329797a0810589f8af0d24aa14b6863
MD5 7d8159551fc1fe372ed94f8569f55bc1
SHA1 79ab6fbc5a66f777af8460d946380dd56fb59557
SHA512 e30e4be70984807e990c962b769a80dc0adb7aeec3b92cc794523c0bfdd7fca7b2f6fad4f7f2a435f2e86b59597b04c60e83c95be644934fb06e42fce289549b
SSDEEP 384:ZZcI7sN3Ubhi5s/AduBGYX5EWuh89w4ka8v9vV:x7ACAiGYuWsIw4gF9
TLSH
T159828D32A874AC2B5DE7A045F44B3E13DFB48027EBC47B9499ED5B0E05DA288130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a3413fa5769e4f2f3dfa4a1680810a3bbbb7c5e30d1fc3b65fce9dadf14ae82e
MD5 abf58a94053cdc5bd522f45174b02569
SHA1 dd94ca2b30932589bba9fb63aa8b1ec24b13d7ce
SHA512 69ad0e8c86a8f07e54f5c5beabd6ed313ba2dcfd9cb88e17372878cf699e999853bc1f1eff9b2afe108cb0ab9bd5af8661cfad3b27ddc7715cadabefe1b6a053
SSDEEP 192:18zBsN3U1QqTTaphvqrAQmiU1DVAdB4BGYX59eznCi7h89njkH1q/5JgHn:CsN3U1hi5z/AduBGYX5EWuh89w4gH
TLSH
T13E422B36A8786C3B5DD7A151F44B3E139FB8512B9BC43F9495ED1F0E41DA28C230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9926d3be15b3f9bc9a4e900ab4380fac4e38d4fac6d57f2bb3094b976d443d33
MD5 b915967959824f024b2d6c1559259f5e
SHA1 79e71e6b2d1bea8dababaae7616e6d20feedd3f9
SHA512 e25c2eee206d379eef5c8888aa86b1017ce1b1d361896f1321ceeb028c2c34d74b60a9d10963d64e77f39df08182772e66bb6955ff88a8976c6d6acabee61486
SSDEEP 384:iZcIiZsN3Uqhi5slAduBGYX5EWuh89p4ka8v9vV:QE1kAiGYuWsIp4gF9
TLSH
T1BEB229F168E76836D89E5347A77E2D138EBCC017B6846A44B7E90B0ECC8617FD306526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94e7239edaae71a3d9481329e3f539b3b96bd9a787ef4a02faf1299fc27a046a
MD5 8147959b8f4f645b09bf3ddb241a89f9
SHA1 af85f18ccceb2e0d075e5af1098150a29db4fa4d
SHA512 45e4cd03df7a2cc0ee0d79fb5cb1451d3a60213159eeaef220d61b9161e18a3426d50fb9121f2530498c43b4c8b25b6ba657ae96626f1ef57cb633e15f4466c6
SSDEEP 192:LJONQ6DphmqQmiUyxIq8wGYX59eznCi7bkk7WHFiU6:lONQ619RRwGYX5EWuzXU6
TLSH
T16C02D939E8787C7B4DE76E55B44B2B239FD8112BAA506B44D6E81F1D00D764C2307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1175ab7a47b57a4fe5171dd83a5355a24fca3b87a30b2fc74948ae2ef708ac99
MD5 67371e30500480521766510c085ccf1d
SHA1 33ece45c6840e1a31c5c28cb45bc81cdf1bcaeca
SHA512 e23bd3f1395ab2e0ace8ae74b344be153728912b01c182fd3954b3b19584c900299c2f88acce923c1c58b1168fee9af3e011d488808aebae99a3c249874cdf89
SSDEEP 192:LJONN6DphpqQmiUyQITwGYX59eznCi7h89nykIIq/5JU6:lONN61KqTwGYX5EWuh89D4U6
TLSH
T123121A35E8B8AC7B5DD36591F48B3A139FE4522BEB847F9095EC1A1C01DF65C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3568b2ab3afa1fca89998b5ed619f39e3d6e618745d5fe81ff31768991b3c88a
MD5 23c5454f9fd3ea40a743e27c203e9922
SHA1 46b83afa094fe53987c58e0cc1c185ed4de61e2d
SHA512 7f822559048ecf70168791dbc0c0e3f8ddf684b715a47065d944c01debbb2bb00d54169f2b326f580beae2ad2e5912e23afcd5a4870f139438eba7bcb2ac9538
SSDEEP 384:LZcI7sN3Uqhi5s/AduBGYX5EWuh89w4ka8v9vV:T71CAiGYuWsIw4gF9
TLSH
T1A7828E32A874AC2B5DD7A045F44B3E13DFB49027D7C47F9499ED5B0E05DA688130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6565248a-8374-44ce-a5ec-266480ab1af3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6565248a-8374-44ce-a5ec-266480ab1af3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d76cc8cf5af50bdf0d07283f6e2489b7d82817c7294d0c17960d0427057876a
MD5 46c0694c353dbd36d340db2b62fd2beb
SHA1 a1a02c1b988a1f2bee65178afef6ebfe3d135892
SHA512 af5e1b4ab973adaa78ad9f7f0c451c03995e8a2ace2b25e812e1fcb08a81ac8bf23e7860d5cefaa69329b41c8ccba978355d7dc167c895d432846edc9dae4891
TLSH
T1AA410558BAE91108B3B36F5AABF6A86D447F7D372E4AC59D10110D4E0A22B40C972B33
MD5 SHA1 SHA512 TLSH

Submit Download