hxxps://bahmfast[.]com/?16542960

Resubmissions

25/09/2026, 12:46

260925-pzwl5sec376

25/09/2026, 12:38

260925-pvgx7awemd6

25/09/2026, 12:36

260925-ps7e3ays6k6

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bahmfast.com/?16542960
Sample260925-pzwl5sec37

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	href.li
53	href.li
54	href.li

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348139996465965"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{616F629B-4B0B-4EB4-B149-C0EFF48B2CC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5936	msedge.exe
5936	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 5056	1816	msedge.exe	89
PID 1816 wrote to memory of 3028	1816	msedge.exe	90
PID 1816 wrote to memory of 3416	1816	msedge.exe	91
PID 1816 wrote to memory of 3416	1816	msedge.exe	91
PID 1816 wrote to memory of 3416	1816	msedge.exe	91
PID 1816 wrote to memory of 1884	1816	msedge.exe	92
PID 1816 wrote to memory of 1884	1816	msedge.exe	92
PID 1816 wrote to memory of 4872	1816	msedge.exe	94
PID 1816 wrote to memory of 4872	1816	msedge.exe	94
PID 1816 wrote to memory of 4872	1816	msedge.exe	94
PID 1816 wrote to memory of 3860	1816	msedge.exe	95
PID 1816 wrote to memory of 3860	1816	msedge.exe	95
PID 1816 wrote to memory of 3860	1816	msedge.exe	95
PID 1816 wrote to memory of 4460	1816	msedge.exe	96
PID 1816 wrote to memory of 220	1816	msedge.exe	97
PID 1816 wrote to memory of 4460	1816	msedge.exe	96
PID 1816 wrote to memory of 4460	1816	msedge.exe	96
PID 1816 wrote to memory of 220	1816	msedge.exe	97
PID 1816 wrote to memory of 220	1816	msedge.exe	97
PID 1816 wrote to memory of 4792	1816	msedge.exe	100
PID 1816 wrote to memory of 4792	1816	msedge.exe	100
PID 1816 wrote to memory of 4792	1816	msedge.exe	100
PID 1816 wrote to memory of 3484	1816	msedge.exe	102
PID 1816 wrote to memory of 3484	1816	msedge.exe	102
PID 1816 wrote to memory of 3484	1816	msedge.exe	102
PID 1816 wrote to memory of 1104	1816	msedge.exe	103
PID 1816 wrote to memory of 2696	1816	msedge.exe	104
PID 1816 wrote to memory of 1104	1816	msedge.exe	103
PID 1816 wrote to memory of 2696	1816	msedge.exe	104
PID 1816 wrote to memory of 4668	1816	msedge.exe	106
PID 1816 wrote to memory of 5832	1816	msedge.exe	121
PID 1816 wrote to memory of 5840	1816	msedge.exe	122
PID 1816 wrote to memory of 5848	1816	msedge.exe	123
PID 1816 wrote to memory of 5296	1816	msedge.exe	126
PID 1816 wrote to memory of 5296	1816	msedge.exe	126
PID 1816 wrote to memory of 5660	1816	msedge.exe	129
PID 1816 wrote to memory of 5660	1816	msedge.exe	129
PID 1816 wrote to memory of 5936	1816	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bahmfast.com/?16542960
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff85e7fc188,0x7ff85e7fc194,0x7ff85e7fc1a0
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10236943139387157988,16350383236868020183,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11276449179905464015,15504547224352942126,262144 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1070368588717157463,4595501590405946730,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13759925795947669561,4709162189873197231,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5721403687234049752,8936380274668258544,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,595330661538289904,1894496982926546329,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,7464512771762733945,2056156917139446220,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3440,i,6830103822113624191,2063996476494171882,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5188,i,1010794982358948025,1916499837859917806,2097152 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,250336032196884121,17175298814468205501,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,15396151935453125384,6487556783820771686,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3649735977219033100,3539524329529712290,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3649735977219033100,3539524329529712290,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,4649888454866308879,14328665019327414802,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,16669542370008195239,7326831905929520493,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5385095280583453345,718675360638959829,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3020,i,8848201408074365484,2687055755554845280,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,968132185889874059,9278551588399707080,524288 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4672,i,11604983459880162870,4673614261981256159,262144 --field-trial-handle=284,i,8365809828504369707,2078701707999995169,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 faf83155061f717055e103b7f0b0e5c0c4e67b9c5f6827683d476789167e4a72
MD5 86e3af0bd93762e7742bf00a0c73a2d1
SHA1 7496ef7494abebf3285a1fb9e76862efd98ad384
SHA512 d321580ced67a1def6b69048ef6c07a59f4ee3cd14cb33352c08f326cf59c9c815203f980c2581607c1f3acdf99ad62153f10acf0a1c32248d346840403d204d
TLSH
T10751D94469A1E0B4F7A43AB992E0128F3E36A9CD8ADF1DD51168D8B9FC4E35D83C007C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592939.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592939.TMP
Size 2KB
SHA256 5d9a76b5771493878bcd410d84cdcca737c79e564532a3ae005c84197460f3d9
MD5 c0791287c3f08ae2c1fa92ab9cca6992
SHA1 1a84a1143c762b80a30252148b9c2f57ac22d592
SHA512 e79edef8dc2355bbb2f06ba0240529ead648f632b69730b6c2ce35800bd127203ba47a5511f192163ba1fc766f4477a8ce89e320072aac854d78e3867842310a
TLSH
T1A451B8849A95E070F7A4797992E0128F3E36A9CC86DF2DD51168C4B9FC4E35D93C007C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 027f838d2e5f99064c3f3716f824fbc325f313e0cc0d990639a8806e2eb61ed6
MD5 4b11ba5dc0ce1d705ecce2d4a9e11910
SHA1 7bd72954b5b0408807af82a2b5fc0a3fa3e18d13
SHA512 5e99ceb24fa524e4bee5e66bfcbe0e00a235291df58172d1a362c4ea5b4a95ab3cc5d9a09f7ea203f107db09b214ab51fbc2156065686b1395fa72c702fe7881
TLSH
T1F2819EF6C7E4862DDC2156F06B156E2FCE2D0D1482283C2AC9E49F9BA3E2471D101E4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a4123a1d0c1b5d96d686025d9508d2512d9295e572abf6542def6910a0c8240e
MD5 f8759ef9f5ca3d8ad9d8c6d1c1266f52
SHA1 eed8ef2ed2e435d3f334d55fe460b10bfb843e94
SHA512 9a9eb1459344a5fbf1c898fbdb9d5b6734b018fb1cfcaa9c7cc38ddd022bb2198be647f7a0cef9ac97f59d882751a5855858c19cf912ad6c15eab9c56ba9b739
SSDEEP 192:sxZ7RPWa/fvs8/iIdpw3HW6+WNvjw/YapJ1HIgrJ:sxZ7Ea/fvs8TWHbU/59
TLSH
T1AC22A7566E38A57B8CC7D20DBA55BF13D6F91032A1D01E48FAFD861C04E7ADD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e1874064f175e7138161a115590daf2dab22a4afad09d01e68347645c3497828
MD5 d0ac1112129229fc38e0e87b03eb17d5
SHA1 baa3c6d126ef93ff1554392f706f32c052c80a3e
SHA512 5f3324ebe4f7ada4e3234b5e1e9fe5f121bff952a8fd15f7b945209e2b2d53cfcad267931f3957db051b3a728950c8cabcabc34e1b9c1ddd3b45856a3287e821
SSDEEP 192:sxZ7RPWa/fvsM/iIdpa3HW6+WNvNCXYap+1HIg5NJ:sxZ7Ea/fvsMTQHbQXOd
TLSH
T19E22C8566E38A97B8CC7E20EBA55BF13D6F9503291D01E48B6FDC61C05E7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 33405789dad18b799b958ff1d5fa7ca189263b21b6a5a2061edb68ee7e034996
MD5 3745de3ee77f4030303364bdfbf4823e
SHA1 b8acb27b84cff04e5145783d1d4bd708ddbc0b84
SHA512 64b0c37f6219a4b8fe59902cd4063751a45ee5b6ce65612c86a40054b931d4305464612ca89dfb2a29d8e2f0a397815ac66c84f276c2bd3da53beb598acecb72
SSDEEP 192:sxZ7RPWa/fvsM/iIdpw3HW6+WNvjw/Yapf1HIg5NJ:sxZ7Ea/fvsMTWHbU/vd
TLSH
T1E422B8566E28A97B8CC7E20DBA55BF13D6F95032A1901E48B6FDC61C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5b947490333efd8d21745477863594e555e40ab5d1032c58a7a18ec88ca7f0e2
MD5 89379c6b777aead2cf1cb66afff6ef34
SHA1 989a43673279c9a9af8ee221ba03066f817ecd20
SHA512 77d11aef79ae2166f302f71503d7875847521e9e7338d8208e0b587769e3076067df7cdd92f50f13415a6a9c706fd059c66c3a86acb780a22ec5ec159a2c2442
SSDEEP 192:sxZ7RPWa/fvsS/iIdpw3HW6+WNvjw/YapJ1HIg5vJ:sxZ7Ea/fvsSTWHbU/5b
TLSH
T13E22B8566E38A57B8CCBD20DBB55BF13D6F91032A1D01E48BAFD861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 837047f9b77d407ffca490f77c7ca4b8beb04fe4cf93acd11cab1d27e1ef80c0
MD5 ce1527f31f3c27d7e32e37a22860cfef
SHA1 b7785722d4702b249eddb5377d9dd5f252e72a69
SHA512 209c51c6c05c3d30c55405e2524a82f1e74ac23afe92ef6a66b669c2f91ccfa9e6670566d61accd3fc9265748715af54a09e82c704a3d55009c1484a0f0e0ddc
SSDEEP 768:gEWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Lro43SAmRJ:gEWPcLKWvKeceu1jaClLiF7443SAmRJ
TLSH
T186C2FB3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 fad17732f40c539ace1ac06f3b4af5e2281d5fc1715b7fa9ad2ea9d47ea831bb
MD5 1bbfddcb0218d44cfac7da64d2c506db
SHA1 71cad46f918ecbb8d21d582730d178460b350643
SHA512 6203a2e1f811cef1af188730ec56049d4c0982c936ed6d81e2cd31b8226479bbd6ab2eaa20ccabc60ade53a65949731e236b18de4369f94b1068eeacaeedc60c
SSDEEP 48:K036j3Z5JibhMRISHiK9H1tixnyYkV3LyLRAthrvzMb/KXIS5MK9Z1zMxxcYKbRm:Kc0AKla+CaQKTSMr6KIIS6EwKRyg
TLSH
T164B1F71971BB535038BD294880B6971E528235B3365CE62FBFBD00B64D6EE484DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4446cd45-b463-42a8-aa2e-b79d205f4634.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4446cd45-b463-42a8-aa2e-b79d205f4634.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c1b30c65ea6f737ae5eee9a0e4a73043e0f8278f88ce9febecb4b74956218be
MD5 3d25262736b315d54206e6c8df1d43cc
SHA1 e10ac1319586ed072970c169472733926b2df8cc
SHA512 f775bdc6330fd0c2211ca6252023dd68012da40bf5d1f6075e6f422e76d85563937404f4b967c1240aaf52fe75fc7e559d00b1f5f953c9f8b69e4b7f646d7259
SSDEEP 384:NZcIhsN4bmu1CeOzIGmAs8PDXeibtgOIwZOypNol:VhaupYLlLeibXsWa
TLSH
T1E6829E769DB8AC7B6DE7A104F44A36139EB89037E7C46F90E5ED5B1D00DA298030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 59dc611e2a6ea58c61f7f29f8b3f1b0162593b34c4af53cf9efaca640d1d0b30
MD5 8f3bd89aeb9d08942751004e5fde19e3
SHA1 e318b47ddb2b4ccd21a968ff82851518f48e2209
SHA512 3ee67eb7d381af164c4c368b5e96b04553343a62b5a559a1c899cd2735e48f58495c0b4e8e2a488f6c60bfcb4df783edf71e2556ab5bd90c570e860494ab17e4
SSDEEP 384:eiFiZcIDzsNo8TUNTUlIlimu1CHOzIGmAs8PDXBvibtgOIwZOypNol:1FQHRwgXuIYLlLBvibXsWa
TLSH
T159C239F648E7987AE9AF5707A73D2D138EBCC027B5849A50B3985A0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d68cce13bf178342d7764e467d6e2b709660c5252f4b5dc98c31e45a60401e56
MD5 58d89df95ea3cbe03c854cd414d1d03e
SHA1 3a39e22246502c3d1ffa52e0b5d42352774d656e
SHA512 c7e8f98a698bc25cbbae8014ea7944d186599ccf4449971d4ba31a9a25b7059ff70671e959156d270f38305fe6ddf278c1d720f4a9e3bc2355d41ef2536822ad
SSDEEP 192:aONj6IE7QmiUyAtTPuIGmAcjzor5RZSC7sxeeU6:aONj6Dt7PuIGmAs8RsIeU6
TLSH
T16B02EB79AC787CAB9FF3AD09B4473A23AEA4112BE5952F54DAD81F1D00DB24C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a988b1b25f58b89706b51d923595e959cc5126884e6a72451836bb10fc94fbea
MD5 ff7fd171b318406af3b77bc7d52ae24f
SHA1 a6e718d6e31759a3f7d9a167fe2fc0c221453f1d
SHA512 5f84920bd4e2483965b9d40f20924c71a65c6fbc04520be5daf89b2775750f39ee3c8fa0aff2824b732012857920f8dc6217c3977db0391efbab99a443dbfc22
SSDEEP 384:CZcIhsN4imu1CeOzIGmAs8PDXeibtgOIwZOypNol:whdupYLlLeibXsWa
TLSH
T13382AF769CB8AC7B6DE7A104F44A36139EB89037E7C85F90E5ED5B1D00DA298030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad6e3445b7638ef1ed2100ac87cbe581763c1724eb167a8f4d33fc340b5c3368
MD5 1ffe9629494c3746a9fb76b48c1e198f
SHA1 c31d64df2957671af8de168e7a41c274fd91b3b6
SHA512 934756883c1a5c6caabf9359188b0b0c6e91b6c2dd22178e597f31a48318c6ba941f9050ce541ece9456e193eafb392a66ef7621a678498db207a58a9b55a354
SSDEEP 192:aONB6IEuQmiUyEtTquIGmAcjzor5RZtDX127HI/SU6:aONB6DqBquIGmAs8PDXyHbU6
TLSH
T1D6122B76ACB8BC6B5ED3A844F44739239DA44127E7886F90E6DC2F1C01EF25C530A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0d0f80a-2080-4974-854c-b0ffa52bb1b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b0d0f80a-2080-4974-854c-b0ffa52bb1b6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a49c390ebe807acf13090c5b7b505c2c3de6e37edb8a721c2509ca862950aa03
MD5 25d74fc7a732629d110e56229aeba2eb
SHA1 9bf651618a2eb9b9c9d6ef83196440ac501d1c62
SHA512 02cb25461aeb6f55a24f20f56adbbeb4790ee47bc119bbd9fc5c26e558b1eac30bcca18d41aec898065aeaca8fb7675dccfd6c537f9e648d61fdf01f81bd0a09
TLSH
T1ED412858B6EA1048B3B37E55ABFBA46D847BB8733F0AD55E00110D4E4A67B40D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download