hxxps://app[.]smartsheet[.]com/b/form/01a091110e3b7eedaf4ebc0d87b02600

Analysis

user interaction
yes
max time kernel
66s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.smartsheet.com/b/form/01a091110e3b7eedaf4ebc0d87b02600
Sample260925-vr2fbas17j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
824	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{FB776B6D-812A-4815-9BF2-1879F294BA32}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1636	1084	msedge.exe	85
PID 1084 wrote to memory of 2088	1084	msedge.exe	88
PID 1084 wrote to memory of 824	1084	msedge.exe	87
PID 1084 wrote to memory of 1156	1084	msedge.exe	89
PID 1084 wrote to memory of 2088	1084	msedge.exe	88
PID 1084 wrote to memory of 2088	1084	msedge.exe	88
PID 1084 wrote to memory of 1156	1084	msedge.exe	89
PID 1084 wrote to memory of 2252	1084	msedge.exe	106
PID 1084 wrote to memory of 2252	1084	msedge.exe	106
PID 1084 wrote to memory of 2252	1084	msedge.exe	106
PID 1084 wrote to memory of 2756	1084	msedge.exe	91
PID 1084 wrote to memory of 2756	1084	msedge.exe	91
PID 1084 wrote to memory of 2756	1084	msedge.exe	91
PID 1084 wrote to memory of 3824	1084	msedge.exe	92
PID 1084 wrote to memory of 3824	1084	msedge.exe	92
PID 1084 wrote to memory of 3824	1084	msedge.exe	92
PID 1084 wrote to memory of 2748	1084	msedge.exe	93
PID 1084 wrote to memory of 2748	1084	msedge.exe	93
PID 1084 wrote to memory of 2748	1084	msedge.exe	93
PID 1084 wrote to memory of 4980	1084	msedge.exe	97
PID 1084 wrote to memory of 4168	1084	msedge.exe	98
PID 1084 wrote to memory of 4980	1084	msedge.exe	97
PID 1084 wrote to memory of 4168	1084	msedge.exe	98
PID 1084 wrote to memory of 800	1084	msedge.exe	103
PID 1084 wrote to memory of 1440	1084	msedge.exe	104
PID 1084 wrote to memory of 1440	1084	msedge.exe	104
PID 1084 wrote to memory of 1440	1084	msedge.exe	104
PID 1084 wrote to memory of 2188	1084	msedge.exe	111
PID 1084 wrote to memory of 2188	1084	msedge.exe	111
PID 1084 wrote to memory of 2188	1084	msedge.exe	111
PID 1084 wrote to memory of 5448	1084	msedge.exe	113
PID 1084 wrote to memory of 5448	1084	msedge.exe	113
PID 1084 wrote to memory of 5448	1084	msedge.exe	113
PID 1084 wrote to memory of 5456	1084	msedge.exe	114
PID 1084 wrote to memory of 5456	1084	msedge.exe	114
PID 1084 wrote to memory of 5456	1084	msedge.exe	114
PID 1084 wrote to memory of 5952	1084	msedge.exe	118
PID 1084 wrote to memory of 5952	1084	msedge.exe	118
PID 1084 wrote to memory of 6100	1084	msedge.exe	119
PID 1084 wrote to memory of 6100	1084	msedge.exe	119
PID 1084 wrote to memory of 6100	1084	msedge.exe	119
PID 1084 wrote to memory of 5304	1084	msedge.exe	121
PID 1084 wrote to memory of 5304	1084	msedge.exe	121
PID 1084 wrote to memory of 5304	1084	msedge.exe	121
PID 1084 wrote to memory of 5320	1084	msedge.exe	122
PID 1084 wrote to memory of 5328	1084	msedge.exe	123
PID 1084 wrote to memory of 5332	1084	msedge.exe	124
PID 1084 wrote to memory of 4628	1084	msedge.exe	128
PID 1084 wrote to memory of 4628	1084	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.smartsheet.com/b/form/01a091110e3b7eedaf4ebc0d87b02600
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,5440520777102935750,16462153581023952284,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16978280287636495327,5853232528780436127,262144 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,7740232088660242964,6969016429015855514,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12961944191769383705,12085989057847620215,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6719345517462150616,3270189200825600483,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,14638875569793564164,8899179861622098059,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14816843285866543787,6526817031840371787,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,17521593834370162917,17741419155803636321,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,10636302278754558959,6085374546714715916,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,8556915076077579276,17231251432879152971,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,8556915076077579276,17231251432879152971,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6008,i,10720904054616851078,9472587817057301597,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6420,i,3357422642242055500,7777641720611924337,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3932,i,1241588957075580817,9306218261127279887,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6568,i,6423425180049903374,15349744935378989991,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,15446577465473223803,13324462319195296643,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6912,i,1912800926259221499,14035416453359953659,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=560,i,13445234506250403942,12812166071603097345,2097152 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,17407586149190735454,11332949821248954806,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,8375459592215549918,8089661440916376839,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,364774256899920937,9882159045161430009,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,8760327829987738711,14644190965454827872,524288 --field-trial-handle=2392,i,18322268604885369174,9340758558225914512,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4928

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0177b618941268c7c868fdcd72505a9904945e99450b14438ae895ca0486a8a4
MD5 91d8de1ff425b83c7250e13daa91bc1c
SHA1 2b2773711e0d02bb48462163bfeb7258fcd34b17
SHA512 35c19b91ddfe5eec8ec4b445ea7bc782e953a25130e07b0181c5f474e95e56ec6745da68ef34e156549b0bb24d081cb68d9c095029fa0f399d80a2357e2a5535
TLSH
T10881FD40AC408D20FF916F78A2F926FF35B5B4885EF3DD9D32B6C8799866748860536C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a5bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a5bc.TMP
Size 3KB
SHA256 1ada36b40ab81b2c47a36a50851135caeddb19f6d84ea6d76c0e6b338c4bd7d3
MD5 37114e8fa34ad34e401463d2ee96f4e8
SHA1 114bf4d965da189681f5b7e06f00368e6ec6ebd5
SHA512 371a493bd9365436f4e235fa9a6bfc8304b13b80d18ac4b534bda28c4b3c8fab84b50c147fca0e4b107331fc0a3b10ba74de81000e7b184ecebe4e8707da2299
TLSH
T15461ED806C408E64FF965F78A3F622FF35B5F0815AF3AD9E31B8C4799466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c82faee410ba8686c35800b729c9b32b7f1b0c3e4001bf60be742eebae87ae3d
MD5 8a36788a5b391463a297209281fe8492
SHA1 d355bef2b6df953faa2c7d61c44c290ee6faea25
SHA512 3a07345988f3f4fd4fbbfa432367baed4fa469bdb186a1dbab3c8ea7c6c8f7743eafbfcaccec846dfb159b231d4f6617307c1527e0d2e5270ab3ef047187fb7f
SSDEEP 192:sxZJRk3Wl/fssgzedIdpwTHW6+WNUst/Y36sCFIgrJ:sxZJWml/fssgSeOHbh/Xj9
TLSH
T19422C956AE38A97B8CCBE20DBA25BF53D6FD103255D01E48A6FC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a137a82da1a3bc3fc3197d10f5364af975a31359240d81f91c75bdab6a130096
MD5 fb1b63bd2c559b0051d1344741431908
SHA1 731dcc74fdb8e3e6071be63e78740e6eaad42da5
SHA512 f43858c81946b5cef3a745c8e22c8eaa2b68888b0246613d62b0d9309c8d79fe39b10add4efc3cdab283d5c385373a934f21fb6a726b3e2cd9733adc5609e020
SSDEEP 192:sxZJRk3Il/fssItedIdpajTKTHW6+WNCqwstyhl/Y36LCFIg5YJ:sxZJW4l/fssIIePHbTNq/X0W
TLSH
T17D32C75AAD34697B8CCAE209BA25BF53E6FA103255D11E44A7FC8A1C05E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fabc3f8edf412dc65857114e58676a9258c5143daaeeeb7238403d10c6e686e9
MD5 8fbc43566e0d74fea90d88b350ac7469
SHA1 7be832342dd6c5ef178555b346a29b8758d07000
SHA512 a47b7804b699fc5d530c7b9dd17c99c35827a7c022885f0adebf779fd95a85ff57b1f640c2ac87825a5b8bb70ccc4409523f2e3bb390e5c07bbca466e41c74f9
SSDEEP 192:sxZJRk3nl/fssIzedIdpafKTHW6+WNCqwst/Y36sCFIg5yJ:sxZJWXl/fssISe9HbTN/Xjc
TLSH
T10322C85AAD34697B8CCBE20DBA25BF53D6FD103255D11E44A6FC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8d1943684245015651d1da8e979c7f5fb141ce641b2fa57d86ecd3043d8d961f
MD5 c3e5ebd48b2b9a65a40a7a8d4518bb8a
SHA1 5570051672d94a4fc2dbd9b01e2c2830618feee0
SHA512 45a71a6db774d0173e75976cd6fa90ffa0a48feb0bdaa61890a3628a05f19ce48e7f908b2f76732829b2b47274c4798ee2c38f449ef0a96551b9ad200a73b5c8
SSDEEP 768:S8Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/5ro7k:S8Klm7QWvUYe0u1ja8/L/E/y7k
TLSH
T19DC20B3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 3cd5520f978bcb03b99f140773928ee49d3d853a252e4351eb8178d9080cdfee
MD5 aefe7267baa0efd80222b5a5fe32751b
SHA1 b9fedc0b2198fa546a0de17b21553bb70a7ade80
SHA512 74fa1367ee2d8ef9808787751e07f3238bf31b3e9e2e340d09dc3724f1c4f395cd8c2f765dab67787e00dafe7921a103e29bd9cd978a23399a3226df789cc7b6
TLSH
T14A218D9371B746402ABD350A82E6C51F935132B53194E93A377B10D61D27E185EFC5CD
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b944.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b944.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6cc97995f36aa132001918af25faa10a310442e531c18372825a15fec2d714eb
MD5 687e5c338a51feca8230e71643302465
SHA1 df1389d0ac4ff3015cd2389c71ede690a6a1a211
SHA512 8234fa502f233022f959bcd5baed61c862c7fa12c51d3c80337ddc317f0287b9c6328018595935eb0189e2647c9dfc91c5417715d87b356502c9526b400dd265
SSDEEP 384:hZcIhsNrPlrvbtRsh//PequtgOIwZOyITox:phY/A/buXsfS
TLSH
T175827C7AAC785C766EEBE644B44737134E788467E6C55F80D5EDAB1D00DA1A8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92005c26d6d26c2e1b184ac57c852aa9f1a221096135c4e8ba4a3a52b461b686
MD5 e7c19fca78390a0a43eb1404b6fa25b7
SHA1 1a66dd6a6f2265384f91db5444e9e7a76684ff26
SHA512 2b585da79e860a69c026303aecad4830767ce20bc790cc0251bca1ea20b45fd48e9a16857c42e79d469c22b3f57fa41132780c14f6b655ecabd72f63d1ca75a2
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5LaDzBKP4v+Y1xf//ojdexBywvBCLq:BONX6JUm0QmiUy4tso//3ywvBCz/VSU6
TLSH
T1B402E838BC687C7B9EF3AE45B4877B235FA4106BAA952F80DAD85E1D01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c05e324ce18f93ea61da625d41f68f7e85795ddc780fd4d0a05a9a11aa99cf8a
MD5 f6d8a36916df05678f3c20b79887df73
SHA1 17302c89afcb89e491fe18541c86424b736c3c4c
SHA512 aca641bd193cb59e1d39bcf9758c9ce71e7140329b9537d231c0b670c5dad78dcdcda70a535790176b913ce64fd03ee964d61f180a4f912d1f8c730ea0739d7e
SSDEEP 192:BONu6JU4QmiUyRt8o//3ywenezZNxrc/rU6:BONu6+Yw8o//PeIuU6
TLSH
T10F120A39B8787C7B5EA3A994B48736235EA44167DB896F80D6DC6B1C01DF19C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 77666b3d3a746cfea1e107df41447b240ebbdcbb495741a912b0ae8b82dfcfa3
MD5 3734ca6cf99284ea911d647ff244efe5
SHA1 462323530b0eba11fe1f9f6b8e710cfcf6a68a50
SHA512 5cfed1f1e49681ca0543c3ba9f6f1c23df8a194ea830f09db200a96a53fd41025a70903639ff38917da34f8549bca81eaa90c26da64b3adb0cfc90da15668acd
SSDEEP 384:CZcI8sNrhlrvb0h9+h//PequtgOIwZOyITox:w8AS9e/buXsfS
TLSH
T179827C7AAC78AC7A6DFBE644B44737134E788467E6C46F80D5ED9B1D00DA1A8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b47548860c2c797e735a8574f72701bbe1b2cc5a9d76e594250bcb0b825d41bc
MD5 1b4af5d438eefd3eaae27422654c8dd3
SHA1 594e5d0e71718e4cda00ad9f9ff0e450e4222f25
SHA512 20646cb7fdc764d057ff79668054071a2e334169f7b46285c8eddb40fbbf96f587e21e6adc8fc8dea320414b4e3efcf0b7e1433613834d30cf5cab6a891416ef
TLSH
T1D941F859B7E95148B3B77E5AAFF7A82E447EB8772E06D16E00110E4F0623A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads