143fbc0b8a8065095c0845292b509fa6d729ac3c02e6c9b4d6a853a2bfeb1091

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TFArrow/readme.html
Size 4KB
Sample260916-tncgca1vfs
SHA256 143fbc0b8a8065095c0845292b509fa6d729ac3c02e6c9b4d6a853a2bfeb1091
MD5 9e7c59b2feaeec1ac81e5a4d8a01b0d0
SHA1 1d49c75c7073bcdd56ffe9a7ced1c346e250e113
SHA512 8541b52d979bc98c7f405dbaee122b77710781cdddb839530dd4478dbfeb052f5495d705d923205bf2388cbe4cb21e23996debb621abdafad2e10514d1e806e2
SSDEEP 96:Bx7T6J1+H5P+lqz0JeOHnRWwkaBgNwd1XclChr3Xr3Zpr2Ar7NO:/2AZmlqzwvnRWwka8wPMybbSAvNO
TLSH
T15B910E29ADE302526053D83537EB76A6EE608053474ADDAC3D8CB258CF8A792815F3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5584	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340487633108190"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{CA6F454F-C838-404F-9988-D47C15195E12}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4564	1992	msedge.exe	88
PID 1992 wrote to memory of 2504	1992	msedge.exe	89
PID 1992 wrote to memory of 5584	1992	msedge.exe	91
PID 1992 wrote to memory of 2504	1992	msedge.exe	89
PID 1992 wrote to memory of 2504	1992	msedge.exe	89
PID 1992 wrote to memory of 6088	1992	msedge.exe	92
PID 1992 wrote to memory of 6088	1992	msedge.exe	92
PID 1992 wrote to memory of 4496	1992	msedge.exe	93
PID 1992 wrote to memory of 1804	1992	msedge.exe	94
PID 1992 wrote to memory of 4496	1992	msedge.exe	93
PID 1992 wrote to memory of 4496	1992	msedge.exe	93
PID 1992 wrote to memory of 1804	1992	msedge.exe	94
PID 1992 wrote to memory of 1804	1992	msedge.exe	94
PID 1992 wrote to memory of 3760	1992	msedge.exe	95
PID 1992 wrote to memory of 2600	1992	msedge.exe	96
PID 1992 wrote to memory of 3760	1992	msedge.exe	95
PID 1992 wrote to memory of 3760	1992	msedge.exe	95
PID 1992 wrote to memory of 2600	1992	msedge.exe	96
PID 1992 wrote to memory of 2600	1992	msedge.exe	96
PID 1992 wrote to memory of 4804	1992	msedge.exe	98
PID 1992 wrote to memory of 900	1992	msedge.exe	99
PID 1992 wrote to memory of 4804	1992	msedge.exe	98
PID 1992 wrote to memory of 900	1992	msedge.exe	99
PID 1992 wrote to memory of 2148	1992	msedge.exe	101
PID 1992 wrote to memory of 4224	1992	msedge.exe	104
PID 1992 wrote to memory of 4224	1992	msedge.exe	104
PID 1992 wrote to memory of 4224	1992	msedge.exe	104
PID 1992 wrote to memory of 1240	1992	msedge.exe	105
PID 1992 wrote to memory of 1240	1992	msedge.exe	105
PID 1992 wrote to memory of 1240	1992	msedge.exe	105
PID 1992 wrote to memory of 4752	1992	msedge.exe	106
PID 1992 wrote to memory of 4752	1992	msedge.exe	106
PID 1992 wrote to memory of 4752	1992	msedge.exe	106
PID 1992 wrote to memory of 3228	1992	msedge.exe	108
PID 1992 wrote to memory of 5880	1992	msedge.exe	109
PID 1992 wrote to memory of 3692	1992	msedge.exe	110
PID 1992 wrote to memory of 1780	1992	msedge.exe	111
PID 1992 wrote to memory of 1780	1992	msedge.exe	111
PID 1992 wrote to memory of 5048	1992	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\TFArrow\readme.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffb5f71c188,0x7ffb5f71c194,0x7ffb5f71c1a0
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,5595494691798500335,14705178523369410522,262144 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1395819560235003932,6470078243072534845,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,7769029250485235689,10575286664481204729,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,1875379491404256560,6102845259108596956,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,1209841688884630202,3157675177211213930,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,541977639361372291,7281829510220910929,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14204253044333147840,18391951807469802338,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:9
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4127061330589052944,10676152866625113262,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12504832578794912382,8902432783793597912,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1544516685807578827,10189214853931561693,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1544516685807578827,10189214853931561693,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,16669589385415519210,12502971310295933464,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3848,i,12309237037503015969,7495909681849061104,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6600,i,13178844847855290325,6836296321244115961,2097152 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3120,i,7979808582312557872,9308104245418662299,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,4260913734705218138,16382613423824407627,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3062621990383605040,15030838852843535254,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,15385585359532351396,10153866562897269411,524288 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,17620010628682393867,14003144847876504873,262144 --field-trial-handle=2756,i,8488321922362279553,17373029878235447864,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9f55afddf22a7164f048a9d2bea0b5c6c6db34a9ba9c9b583ff29bdb82597ed2
MD5 7d1f1f0630a4843e1d85d530ab1ff4f6
SHA1 124215754fdc0a8922a97c4efc228db45d981c3a
SHA512 939213f91f7f58f1abe9e07bc2ea9392b09d71e4637056d65b142b0b355078877bfa2f2f1d821cb16072832da941486a024b636a5dc156d9cc9c74f8758257ac
TLSH
T19461966493DEAB50FB9622F143C694A3F9308A8C5FCF4F6375A1EC7A608A3D40A46184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c097.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c097.TMP
Size 2KB
SHA256 eb011edba6a6741342d3842de13bcf8d05df9c5526d51016812632711388115c
MD5 d1f760d98fcbd5cb71037ed1e5d98091
SHA1 78c562c48e46a7f554efd2d1a0f211fb091b1fc5
SHA512 439cc1cfe86ebc5dd934310367acf26c0222037a0d12ad4fa01c97033dbece4d2fdda8722d7843350aa0ef4200f929fdc3dce1686f4e44f0d6d5f659ce01a1bf
TLSH
T10351A7A4979BEB54FBA616B143C4A0A7FA348F899FCF5F0334A4EC78614A3D44A420C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 de4a60d9d2827e744f6587778332f69e50fc8fea89050c796f685b3573a50339
MD5 f264272311e2777828eaabc405f350ad
SHA1 a13cf45e3b7ef4b2e5b4745e11443f700ad43024
SHA512 a83bd045e525489c1ebc586fbc1e2e74ba537c573262ea4ad1a52ed29c9f4cae9b1f9c98e9c28ca2750629987b766b91a62a1cf912f656be27bc1437e6c6ce67
SSDEEP 192:DHto/yal3DaJ+KzdaimdjhnJaU5fvxGvTLXRTz8e5zs5vPUAWRT:DHto/yal3Dy+Kzdaimd5JaU5fvxGvTLr
TLSH
T16A028CB7C7D8866EC81117F06628BF1ADE1E091992183C1ECCD8BF5BA7D2472E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ca76d978604b48a6ed3f09adad9adeeca47f80440e9b2ec5444219c573fa98d6
MD5 99ec1b044c372c90ff8c1d42993040b1
SHA1 a20ab90df238a827162f54b4f43b021ceb915409
SHA512 f6136964c8a5bfddd385ddbb1272226a0345fb7a700c00098bc32e320d388ccf4c88f3531a3427fbf752993b1a95c703473c1c1bddd483036690e2e3786f7ac4
SSDEEP 192:sxRuRWbd/fsusHHyYhTqzoA8p48D/g6+WNIY2GcEGFIgD2J:sxRuyd/fsusnbTnx/5IBJ2
TLSH
T10432CA1AAD28A93B5CCBE21DBB65BF53D3FD503361911E48A6FC861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e32b775578a344c6192e0d1e90486d8edf66731c33b20435fe46d3e1a36cd037
MD5 b48aebb37c283ae41f7468f330821b00
SHA1 6fb49c04c20ee0531f6771ade2d746633eb0ee3e
SHA512 05644d3645737a4eb8ab97872fb11dcb94c5c485ef0e7c163c92b270ad142e7da0519ada7f2659767bb522e65dcd4fda8ff3f05ffe34a5dcf03d9783a8b943fc
SSDEEP 192:sxRVRWbd/fsusPyYhTqzoA8p48D/g6+WNIY28cEGFIgIJ:sxRVyd/fsusPbTnx/5IPJs
TLSH
T15632B71AAD28A93B4CCBD21DBB65BF53D7FD5032A1911E48A6FC861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 11e427c5142f7c482f092a0f679c4df09806a55f35da0d6cb503a0e353100540
MD5 d4f51dc13a695d4c0bc2109ef7861dec
SHA1 73262c2748f2779ae58f51225ce9d95a95912b66
SHA512 53135570aa7c627bd92b5c375365dd45c41d4bd4552d1f921ec7063712bfbf39e2454ef71e7df5beee5bbbb926bf426d8a53827b03a645da54cc671ee38d4776
SSDEEP 192:sxRuRWbd/fsusHGyYhTqzoA8p48D/g6+WNIY28cEGFIgDEJ:sxRuyd/fsusmbTnx/5IPJM
TLSH
T1B532B71AAD28A93B4CCBD21DFB65BF53D7FD5032A1911E48A6FC861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 55157476dd65ebc978ee666433e07be3999782a82b812f1ac5d6514796ab9159
MD5 59280ef86a165e71ba18a78988cf735e
SHA1 14cc3100343c01b6d38ab5581614f82f79bda8e1
SHA512 0d8c334218b8f64fb28c0f8483690fcd061c6b134d7eb08d785ba7a97385aaafee8d6aa416a7f09c1ca9135fb7574efec17b89d757b04a7c1516ebc99eeaf3e4
SSDEEP 384:LbnaaCTfCtgp/FfrDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWaroHrH:L7aaCDWgptfrD8F1+UoAYDCx9Tuqh0Vj
TLSH
T147B2EB2F644CCB7E8FD00A9DAC596F9B6E9802C796588D4047FE984C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 231ba60a268de897dffe1f9bac0c477cb23ccd474ef9c273fd59e76ba82fa981
MD5 3b55746a7e8788734929e4bccf591e22
SHA1 02338cebe4218bffcb711f11422e627c5b9bd2f9
SHA512 332f7fa78dfb578f28e572ff724e0488e716ad7b0420f7da061182a4a6fe11b34d249d01a08e160a702c70e70277972d826d8832b5287ff55b29069c50657551
TLSH
T1DCA002944381161AC464A7B32085A3806360D8184209472B449C3068DDB01954902503
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 126c7226e2a5015b94f998b8a0f2ca8b9ba5965759f33ae9e266042b52a29482
MD5 312e10c50fbc22207696e61cf94ee7b7
SHA1 fbb013599aeae678a4281e70c4d1c85f4d610a4b
SHA512 c30148598b62a89297d3e3d742d444dd807409c9ec142336f55d46d5d6f9b5f947cb0e528c1708a3e03017c4424390e8dadaec9a52a834895f19bed0813b3363
SSDEEP 768:WX3WdHDjgm1IuB8jDmGA5b65Q92RQMPbu+rgIUQn:WX3AHOFAF65dQorgIUQn
TLSH
T1C1F2BF72ECA0DDB39CB952C17A97B2156FF8426391CD46D049E9AF0D05C7A9E430BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7fe5666a2393bcbd37a785fc85b87a1f10e3ba870786ef6a930d8436da4695c1
MD5 d3c9ad0b1085264eb7c92429e038615a
SHA1 6797e78072f48dd12df166130eebd1819e9edc87
SHA512 4119b3b5bd86b775a10baf3403a52230f98323a748c9d902c61c988c46acaf5d3ad09b12e30498c06e656a3347aaefa152b692cb47f96ea56bdffa9c0a82fb06
SSDEEP 768:AX33dHJjgm1IuB8MDmGA5b65Q92RQMPbu+rgIUQn:AX3NHk0AF65dQorgIUQn
TLSH
T198F2BE72ECA0DDB39CB952C17A97B2156FF8426391CD46D049E9AF0D05C7A9E430BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4366662eada0ca00ad83ca1bb4b5f76c89bd772a7e7ac61b326d5bc7340c172b
MD5 c87b4e59f6d877077b47fe5fa1092ff9
SHA1 548cc7008d7832feb5f4860622bf5180893328cb
SHA512 94249b093b47c077bbe15e8adffdf535457f07078613799306eb291ea28b7fa5514dccabd92a47fe83559a6b27efe2fd1d8663a19038ee90e0579b5d85fc153d
SSDEEP 768:U/UxvxjgC+B3icvJgm1IitDmGA5b65Q92RQMPbzFj0O:BZj3+B3xN3AF65dQ8FQO
TLSH
T1C703C036EC90AEB3DCF952C0364BA356AFF84563D1C556E049F96E1D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e17accae-bded-4fa4-9c8d-9c3427b637b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e17accae-bded-4fa4-9c8d-9c3427b637b9.tmp
Size 40KB
SHA256 6faa2d6c7ed42430d414777dbe08d10e29b6f89396b7e3d2ca31e2d40fe45154
MD5 287143f4496a324a81c1e1b08a93ce95
SHA1 f3f45fc01331f3f6ba73097354d5b8549a457deb
SHA512 e9512024306f15297220fffa023fba5de34df423f15ac90fc792860fd76b5b264edc99f108f9f90f7b43597290c3d6307538b30112cd19ace6732e6ccbe3cb27
SSDEEP 768:WV3WdHTjgm1IuBrDmGA5b65Q92RQMPbu+rgIUQn:WV3AH7AF65dQorgIUQn
TLSH
T133136BF198D39973D8AD5383277E6E056EBCC113B1C8459077D96A0DCD866BFC30A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download