hxxps://cdn[.]discordapp[.]com/attachments/644687559611645984/1450006437999939636/togif-5-1[.]gif?ex=6ad5b3ba&is=6ad4623a&hm=6fc5fbe0ba8a7e7dfde17a0ec7adad001bb20f13a7be93bd9a3c3d0a73271054&

Analysis

user interaction
yes
max time kernel
28s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/644687559611645984/1450006437999939636/togif-5-1.gif?ex=6ad5b3ba&is=6ad4623a&hm=6fc5fbe0ba8a7e7dfde17a0ec7adad001bb20f13a7be93bd9a3c3d0a73271054&
Sample261018-wpvenasyd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{88E0CD75-8898-4713-825E-296CDF03A53B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4620	5068	msedge.exe	84
PID 5068 wrote to memory of 3816	5068	msedge.exe	85
PID 5068 wrote to memory of 4852	5068	msedge.exe	86
PID 5068 wrote to memory of 4368	5068	msedge.exe	87
PID 5068 wrote to memory of 4852	5068	msedge.exe	86
PID 5068 wrote to memory of 4852	5068	msedge.exe	86
PID 5068 wrote to memory of 4368	5068	msedge.exe	87
PID 5068 wrote to memory of 2968	5068	msedge.exe	88
PID 5068 wrote to memory of 2968	5068	msedge.exe	88
PID 5068 wrote to memory of 2968	5068	msedge.exe	88
PID 5068 wrote to memory of 4124	5068	msedge.exe	89
PID 5068 wrote to memory of 4124	5068	msedge.exe	89
PID 5068 wrote to memory of 4124	5068	msedge.exe	89
PID 5068 wrote to memory of 2040	5068	msedge.exe	90
PID 5068 wrote to memory of 2040	5068	msedge.exe	90
PID 5068 wrote to memory of 2040	5068	msedge.exe	90
PID 5068 wrote to memory of 4104	5068	msedge.exe	91
PID 5068 wrote to memory of 4104	5068	msedge.exe	91
PID 5068 wrote to memory of 4104	5068	msedge.exe	91
PID 5068 wrote to memory of 3808	5068	msedge.exe	99
PID 5068 wrote to memory of 3808	5068	msedge.exe	99
PID 5068 wrote to memory of 3748	5068	msedge.exe	98
PID 5068 wrote to memory of 3748	5068	msedge.exe	98
PID 5068 wrote to memory of 4152	5068	msedge.exe	102
PID 5068 wrote to memory of 2600	5068	msedge.exe	108
PID 5068 wrote to memory of 2600	5068	msedge.exe	108
PID 5068 wrote to memory of 1412	5068	msedge.exe	109
PID 5068 wrote to memory of 1696	5068	msedge.exe	110
PID 5068 wrote to memory of 1696	5068	msedge.exe	110
PID 5068 wrote to memory of 1696	5068	msedge.exe	110
PID 5068 wrote to memory of 3444	5068	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/644687559611645984/1450006437999939636/togif-5-1.gif?ex=6ad5b3ba&is=6ad4623a&hm=6fc5fbe0ba8a7e7dfde17a0ec7adad001bb20f13a7be93bd9a3c3d0a73271054&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffef294c188,0x7ffef294c194,0x7ffef294c1a0
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5822703343179619469,11521952277461278604,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,7640467084594404787,10519557783446050738,262144 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,1291350028670743284,11238559750132019445,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13162038025217520316,6660704107462457277,2097152 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14818932502244072488,8222776290419665957,2097152 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,16802951859883158256,2553679028421008195,2097152 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6825339751555222878,14628357242743285540,2097152 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1583118821401118434,3930616543379952237,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,18156626439939152570,13190495065002739045,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,16719321531690417447,207048795400029452,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,16719321531690417447,207048795400029452,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,17216651254306410627,2303112024570938517,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10680237370006671971,7226620324386518217,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4556,i,2034315955855769014,5525785128193050802,2097152 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,110739727393071283,8710719510304018969,524288 --field-trial-handle=2484,i,11437521427276615336,4511488495978202984,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

18bc1f74-5ca7-498c-9b3f-de9c15960c17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18bc1f74-5ca7-498c-9b3f-de9c15960c17.tmp
Size 9KB
SHA256 9f63f27581eaa795e232c20dcff1ef83c3162ad2d679fdd8c5bb32b5162ba7a4
MD5 8defe974917b455ca4fe4c3ef291916b
SHA1 7328aa45b75e11354a1a5fd0676fa43c300c0509
SHA512 3d679b5b9a48bc8226f5344f1e2a3a39d19b966c8dbd6e828d55862628f98f40d0c0ffce6456bbcfb73133bc70c74b0afc38d4d1bf2259526f2299e3cb143332
SSDEEP 192:sxZ9RAW3m/f8slMklIdpPjHW6+WN5BoX/YrpKaM+AIgrJ:sxZ9J3m/f8slBWbHb52/JR9
TLSH
T18022BA526E38A97B8CC7D20DBA59BF13D6F9507251E51E48E6FC861C08E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44991d8f-d06b-4d9f-82cb-6f167d95eda3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44991d8f-d06b-4d9f-82cb-6f167d95eda3.tmp
Size 10KB
SHA256 23cd0b74312c2db79fc4af116539060818f0283a4974924628311b6913a20590
MD5 75683a67fe3340aa34b0048c2695882e
SHA1 96f6815a4325af3cc1ac93b9a4c3372c77d4c325
SHA512 cdf510423724dc7e4b77a4bdbec8ec7b0f6153e8cb0f275ef2fb5a174b5e48e5dcd524a39ceefeefd5950d2ab3e0f40aca3c4cc7c4cef0f4ab6c202ea2c9717d
SSDEEP 192:sxZ9RAn3m/f8sNMklIdpPjHW6+WN5BLXXYraKaM+AIg5yJ:sxZ9M3m/f8sNBWbHb5JXoR8
TLSH
T15522C9526E38A57B8CCBD20DBB59BF53D6F9507261E51E48A6FC861C08E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

883ed0d3-77e5-44c4-b1f3-4d47d1a4d613.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\883ed0d3-77e5-44c4-b1f3-4d47d1a4d613.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 170KB
SHA256 e77ebc93891fed0c394614fd0aa3038764ba1895586bdcb20849e7508af717d3
MD5 af24b5fecfc3a1331214db606b380f1d
SHA1 206f1e61006c86e6faccb6c050f55017173c478b
SHA512 14fbff772d62c1727f17764fa63f35b3e99df611532c57ba2602222bc6332a0d9f707fd679c6c896d7759d7ff2f5833a68c8449e8cff782bce79937a42a70b8d
SSDEEP 3072:iC8OVivUJF7If0JDdu4Yn1WQqxtJG0Ep0YJ4wyK7fBFO3bs6wXb1P:iC8sivrsDdUMdPM0Y97ZI3bdob1P
TLSH
T1370423146F50630C9417B3EE194228635B9A77AC5BF0B16E296DC983377723B2EE7017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 671d50769c345d157047b7f9a5bc8837a5344f2d9d4bc7c31591a5a4f620e93c
MD5 3f28b830e34a722729eb351dbccb5d7e
SHA1 ae143b52e8dbeebff7ba8a1dbe3dbe5cc8a9d1e2
SHA512 4e0a392e4a52af005147e8809b432f58df0c94dc5887e6fa27e415eeff8b8d21072dd7b6f73e727419ad03998a3d029b3da016c5f45668faa5695a2a86a8517b
TLSH
T1A0612E86E58E4463DBB491FD8DE12CCB3938C6F046AB1D5A0398D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e710ed1ca5f3905546c32b965b126112e28f331d501b3369062e90d208d924cc
MD5 614695c3a086ad0625d6026957110c8e
SHA1 41566202ea6daf4dd2de976f88aebdde1f99d675
SHA512 495ac759a49da27959148b96b5f1f9756f945167c12e66ed43bf0f22f77a2638574ee2e827b4af566054aebddb1a88041c32873345f762cd3bf9d0daa38f9316
TLSH
T12B612E86E48E4463DBB491FD9DE12CCB3938C6F046AB1D5A0798D8795F26F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

27f8d34b-f534-4173-a502-076ab0433555.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\27f8d34b-f534-4173-a502-076ab0433555.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

a02c33bf-e678-47a6-8d1d-db0ddf37b057.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a02c33bf-e678-47a6-8d1d-db0ddf37b057.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c4d4a578-5dd0-4ed0-a27d-98ca19ca040d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4d4a578-5dd0-4ed0-a27d-98ca19ca040d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9fcd195a252349216c3d5961b26f55813a369b50dc80787f4c1c175cd4f8dd18
MD5 687cbe66c67a3c0418c25bc6a664dc9c
SHA1 28f9084b9628c9c624e60ee7a8e5c70b6a622bce
SHA512 83536189ef129c3f8f81ed5098d6016360ba45390b46f37d7434494b793d98a998aaff8f3a4ca82038d6d9651fe90b93c2c0bb098ec406e626a600c561c5a3cd
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLIST0IvKlOcfyJaIfKDd:KIDCKs0+iSt0AKlOGaaUKDd
TLSH
T1E0915C54756B83023CFF2A5C41B9CA6A625235B33019E56F3BB985A54E2BF050EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c125de8f-811b-485c-a24c-2785c273626d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c125de8f-811b-485c-a24c-2785c273626d.tmp
Size 27KB
SHA256 c88181baf91167a61105149f2310c6b6f6a28cda2536676b3a100cfc707b0a10
MD5 e8e0082dce14534c32ed89b4ca7db414
SHA1 e1dfa413d88de97bdfafb6e140af737f390ae675
SHA512 4d59ef9abaf1aa197ea10730cd66092a3df90fe366bde527f62ab8c20023a01de212b99461db93674488a2ecafdc076c9ffadbeb66ed11aece614113146b51c9
SSDEEP 768:c1y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbHroRXY:c1y4J/DWvbtBhu1jajiLm0bUJY
TLSH
T1FCC20B3B684CCB7E4FC01A9DDD5E6F973E9802C796A48D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afbf7122-d626-46c7-9fd7-f04242ed3bea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afbf7122-d626-46c7-9fd7-f04242ed3bea.tmp
Size 8KB
SHA256 e3d8cdf9075a5468cc76bc3b3367c522dce599bf71401b57b24ce5ded3094ba9
MD5 2f9daa77a6964086bd6f2f83b946ee7f
SHA1 61bdb6a52af8c2b6d8c33b36d33e0ea03b912fbf
SHA512 b7d7c2ca7aa87a02be1364655cb605a386f5b0fe8db97f80582a2791cb5ebb05e88fe4a60b2a228fda78f3ed71c6263cd3276b282059a60daa42a4606601b8f2
SSDEEP 192:+qONSB6wlDZ+QmiUyMhMg+T4X58gZejzorxJgXA7R+2JveZdqePBU6:ZONA6kIjA4X58EC8xJgXw+2I7BU6
TLSH
T11E120935E478AC2B9DE2A545B08B31039FEA512BEB896F90D6EC1A1C01DF69C534ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0f5c19b-0a21-4ace-815e-4fe9b5310e43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0f5c19b-0a21-4ace-815e-4fe9b5310e43.tmp
Size 18KB
SHA256 3c5a79ee28188ed1be5e6bb427ae8bf5aec797fa8dae341636e5ef7d24d1d79e
MD5 35719c2d0052114a8096fbf108131d06
SHA1 5119049a03ba1782f7204fbbd548266aeff50e65
SHA512 aea3e90b2b603747f0b408428b55a3f5f717d9d4905ccea341c653a88abaa4b872ef10d09351c30746a4371ecf0dd78a3e50388ebdcd712c1fe0f0f27c4c7581
SSDEEP 384:sQkUSv0sN6UM2MvxZcygHX58EC8xJgXw+2i7BMTqIIlJ:s0Ckd+aHwlilMTqLr
TLSH
T14A828C36A878AD3B8AE3A215F58E35039FB89117DBD91F64D6DC6B1C01CA28D130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8cfd7ed-67e6-483c-8872-f05b848bbfac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8cfd7ed-67e6-483c-8872-f05b848bbfac.tmp
Size 8KB
SHA256 17be1e442b3e327711f46cf110afa071044d386b4f8e725c1036df025814f883
MD5 140aa849024f831f08671f7b06c56ab9
SHA1 aaad4edc7ef0fed1049ec24f5bbe603b7cd21d0b
SHA512 3cea0cb875c512efed4990cc780062ce3782de4899181c68bff60791e969b6415ba322a58783411168860f7a0cdc77f2797bd1f8aa8ea6c590faf1c0904b4e6a
SSDEEP 192:1ONO6wlDgQmiUyMgMgW4X58gZejzorxJlDlZcFU6:1ONO6kgCW4X58EC8xJL+U6
TLSH
T1CD020934F9787C6B8EF3AE0AF48627139FE5112BE6552F44CAE81A1D00D765C130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f037364601c0a8159b92d2faec79df18150465c57d74f7cf8cd8b605b42e57db
MD5 8795fa8bc16565c240970815458744ac
SHA1 8e344e8141f40e160571fc73c7822e5424d95b5b
SHA512 40dcf8ab83bfb88d8429858c32afe114c1d16f100cc2a42ad3ea2c42c25aec4fd97da033ffae48a9ce6a0bebbd5c6faefbe44e011b00a3ae19c8de63cad8d06b
TLSH
T15741F658BAEA1148B3B76F5A9BF7A86D447EB8772F0AD59E00010D8F0623B41C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads