hxxp://ARCHIES[.]COM[.]CO

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ARCHIES.COM.CO
Sample261020-nkhlaszs5j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{45CC291D-3573-41D6-A96D-9CCBD340F0B1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 5072	548	msedge.exe	88
PID 548 wrote to memory of 5080	548	msedge.exe	89
PID 548 wrote to memory of 2368	548	msedge.exe	90
PID 548 wrote to memory of 5080	548	msedge.exe	89
PID 548 wrote to memory of 5080	548	msedge.exe	89
PID 548 wrote to memory of 3820	548	msedge.exe	91
PID 548 wrote to memory of 3820	548	msedge.exe	91
PID 548 wrote to memory of 1124	548	msedge.exe	93
PID 548 wrote to memory of 1124	548	msedge.exe	93
PID 548 wrote to memory of 1124	548	msedge.exe	93
PID 548 wrote to memory of 2420	548	msedge.exe	94
PID 548 wrote to memory of 2420	548	msedge.exe	94
PID 548 wrote to memory of 2420	548	msedge.exe	94
PID 548 wrote to memory of 4984	548	msedge.exe	95
PID 548 wrote to memory of 5092	548	msedge.exe	96
PID 548 wrote to memory of 4984	548	msedge.exe	95
PID 548 wrote to memory of 4984	548	msedge.exe	95
PID 548 wrote to memory of 5092	548	msedge.exe	96
PID 548 wrote to memory of 5092	548	msedge.exe	96
PID 548 wrote to memory of 2800	548	msedge.exe	98
PID 548 wrote to memory of 2800	548	msedge.exe	98
PID 548 wrote to memory of 2800	548	msedge.exe	98
PID 548 wrote to memory of 4988	548	msedge.exe	101
PID 548 wrote to memory of 4988	548	msedge.exe	101
PID 548 wrote to memory of 4988	548	msedge.exe	101
PID 548 wrote to memory of 3788	548	msedge.exe	102
PID 548 wrote to memory of 3080	548	msedge.exe	103
PID 548 wrote to memory of 3788	548	msedge.exe	102
PID 548 wrote to memory of 3080	548	msedge.exe	103
PID 548 wrote to memory of 4124	548	msedge.exe	105
PID 548 wrote to memory of 4728	548	msedge.exe	110
PID 548 wrote to memory of 4728	548	msedge.exe	110
PID 548 wrote to memory of 4728	548	msedge.exe	110
PID 548 wrote to memory of 4232	548	msedge.exe	115
PID 548 wrote to memory of 4700	548	msedge.exe	116
PID 548 wrote to memory of 3020	548	msedge.exe	117
PID 548 wrote to memory of 3056	548	msedge.exe	119
PID 548 wrote to memory of 3056	548	msedge.exe	119
PID 548 wrote to memory of 3056	548	msedge.exe	119
PID 548 wrote to memory of 2608	548	msedge.exe	120
PID 548 wrote to memory of 2608	548	msedge.exe	120
PID 548 wrote to memory of 3012	548	msedge.exe	121
PID 548 wrote to memory of 3012	548	msedge.exe	121
PID 548 wrote to memory of 3696	548	msedge.exe	122
PID 548 wrote to memory of 3696	548	msedge.exe	122
PID 548 wrote to memory of 3696	548	msedge.exe	122
PID 548 wrote to memory of 4504	548	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ARCHIES.COM.CO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffafa1dc188,0x7ffafa1dc194,0x7ffafa1dc1a0
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1124668389145294045,5745905865193874045,262144 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,10281265996700765539,18434380461748354793,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,18435543942895022843,13210364044494033846,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16995152032716750888,4174862287896199254,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9060694736611743433,1665160346227999372,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12374866245229531133,6348106857956509344,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10919479675079136031,14725256857612868927,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,7749877844181566844,4722676731105191550,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5360,i,15617712020065346851,10053774836212369370,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,16646571348260006158,10602079506418321500,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4128698677142938101,16098423898837291803,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6180146934291975210,9966723837904051092,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6180146934291975210,9966723837904051092,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6196,i,2118216331453389168,13646876970694960266,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,12927517106229771549,4419071370354145288,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,9031116688373985539,7513201071947813533,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,16151532523408805362,3374346336832288544,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4780,i,2276240518546450156,15462523012499373681,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,12769851554063687440,1007239466176806467,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3144382996487733895,141162965952015265,524288 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6416,i,8561524978695938252,14285522227781941229,2097152 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5652,i,14293183485116392734,17511172615250059076,262144 --field-trial-handle=2268,i,14911718592826270856,18138778725718774845,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d5a34d2-c153-46b9-baea-493ab2cc391f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d5a34d2-c153-46b9-baea-493ab2cc391f.tmp
Size 18KB
SHA256 44785ca516c248342b5aa3e1bc641a254b86c7cac67ac0cf0d29b6239fe7ce79
MD5 3a943af77f97e717af00706fee118af4
SHA1 99d005c648efadbc0fa494c7f9547caaee0ba39d
SHA512 ab4f368c551ceee103461dae96e3dd4495e042cbb1e4fc6d7828f9832a2f3b574c0c85e1547e5eef8f872a624be850806d2045a5d263406c75d940e565595888
SSDEEP 384:YQkUSv0sNd+erz/bWRwuh//oT5VedgMTbIIl2:Q0Kwn/AT/EgMTbL4
TLSH
T16A827C362879AD675D93A250F14B36179FB4803BEBC50F54D6CEAB2C02CA29C6307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c119fb9-b397-48c8-8a50-0d40447b2160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c119fb9-b397-48c8-8a50-0d40447b2160.tmp
Size 21KB
SHA256 e2a04d1208dd53485a860a5e75ddb43ca04ee24bdd208cc2008278bce77f05c3
MD5 05342465858d279db6ecd2bab903f48c
SHA1 a61361bb88dd092e2f36a24b8b8532b162f7a52b
SHA512 2ef7d70c2083bb2ac31c9fffa30b7be93b2b78ba1e6024aaf210b46d65cf64ecbd699e26c99f267017a1372bf194bf3b002c11ee0bc2be46e5eec0f4f56dcf59
SSDEEP 384:HiFzQkUSvOzsNn8TUNTUlIl+erz/bWRwuh//oT5VeXgMTbIIl2:CFdOawgjwn/AT/wgMTbL4
TLSH
T1DEA25B3658A8DD7B9EA39B50F54A3617DEB08077EAD15FA0E7C9AA1C01CA1CC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72e43ea9-db1c-4cf4-9b4d-0859e53c0977.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72e43ea9-db1c-4cf4-9b4d-0859e53c0977.tmp
Size 18KB
SHA256 cb84ae905f21aa87839e2594af9806b455aefd18f6a44991c616a15d5a0fbff5
MD5 91e2585837a22f10b65f2035c77fb092
SHA1 30fa732671d263abdf506fac6a419ab9f82917c7
SHA512 8c49017122b67730d7b75a0900630a8817f17aae4ff9e8987c40c49e4e78106e6d07e7d1989a76d703c1602147b05c062b524794812389055f6fde0eb4e619ca
SSDEEP 384:VQkUSv0sNdHerz/bWRwuh//oT5VedgMTbIIl2:v0Jwn/AT/EgMTbL4
TLSH
T145827C366879AD775D93A250F14B36179FB4803BEBC50F54D6CEAB2C02CA29C6307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18aa4f41-e4c3-42fa-bba0-335aaa5710ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\18aa4f41-e4c3-42fa-bba0-335aaa5710ed.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

2759ff19-5615-486c-94d0-2d188bcb107c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2759ff19-5615-486c-94d0-2d188bcb107c.tmp
Size 10KB
SHA256 f2153f48458fba89fd3d2d65bb1682df4495c382e6cfe411dc7176ddae77aaac
MD5 724e505f0417bc5724ccb4d20d78060f
SHA1 bd849309cb786c126c5c744bc32cf7d0e0c10066
SHA512 8780a79d6c2c2c86db7404408bea00d08855546bdcc89838638fe5f9b179cfdc146e56a3ad6fefc7dc8e27fa64005215fec2a64f00d620f7abaebb35e35c53a5
SSDEEP 192:sxZdRGWJ/fGsrHbIdpWlCH0C6+WNGY36nXWfIg5SJ:sxZd3J/fGs7EFHoGXi0
TLSH
T14C22C8116E386A7B8CC7D20DBA55BF13E6F9503261D11E58AAFCC61C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a1fff6a-1c19-474c-afaf-977096055a63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a1fff6a-1c19-474c-afaf-977096055a63.tmp
Size 10KB
SHA256 9878087d84caa48d55007f430204285c6ec00cb8907b08fae12b4a61696b1987
MD5 0539c3052eb50ccfa3ed863cc9c85823
SHA1 131ab6a2d0668e45267ea35a5e504f71b97d9dfe
SHA512 af3ce87571f042ceb7b8b82cedf699b3167ffe94cfec3af26e2665072cff0d77d3f33ed5b95d825cd050eb993bd8753154d5bf00950c141a6c1b52a03f1e4be6
SSDEEP 192:sxZdRGWJ/fGsrHbIdpIlCH0C6+WNGY36FIvfIg5SJ:sxZd3J/fGs7EjHoGXQ0
TLSH
T18722B7556E386A7B8CC7D20DBA55BF53E2F9503271D11E58AAFCCA1C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69584cfc-6fa4-4c77-947d-d0a0769b3dae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69584cfc-6fa4-4c77-947d-d0a0769b3dae.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c0d7de2-e67b-46b8-9ea4-cafd27f415b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c0d7de2-e67b-46b8-9ea4-cafd27f415b3.tmp
Size 10KB
SHA256 096b578c4b1e77078c2105879214d51fe3a1b69e61a290a305a0bc9cb177b701
MD5 97245b7e14c50894e4fd80598ca71ad8
SHA1 23625c575d0049a20eb252edac470b61b06a4d9d
SHA512 33d7554092a0dbf83bfa5f69004d07465b27c3ecb0e4b46da9d2f3cfd582a1ab45b65d06cab5f43726ec38bd2b52daf0400aa741583a614416d6e0828cd3efa5
SSDEEP 192:sxZdRGWJ/fGsr2bIdpWlCH0q6+WNGY36WzWfIg5gJ:sxZd3J/fGsaEFHoGXf2
TLSH
T1BC22C7156E38AA7B8CCBD20DBB65BF53D6F9503271D01E58AAFC851C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7add8c28-63b1-4a0d-8430-1ccd37eadaf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7add8c28-63b1-4a0d-8430-1ccd37eadaf2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

84346a73-5771-47e2-a113-e436614e383f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84346a73-5771-47e2-a113-e436614e383f.tmp
Size 9KB
SHA256 204a9fae4ba2323b1baa40b5fae5edd008089c9cd6ffded4cfb5bb692c92d757
MD5 0f78de5cac9f64c48b2392b269b21d18
SHA1 1081e074ada57d7e749d46f399cf52133a077d2f
SHA512 883c7693b18c6876b9e3bd96480c3245c438a79c91c848601fa52b9ffea4d8d4339cf14544d1f1c2d3df2bd4474059805f20311f8b88980f25d1d601f8ad099a
SSDEEP 192:sxZdRGWJ/fGsM2bIdpWlCH0q6+WNGY36WzWfIgrJ:sxZd3J/fGstEFHoGXf9
TLSH
T14722C8116E38AA7B8CC7D20DBA65BF53E6F9503271D01E58EAFC851C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7edacfa7eb3011d5dd7c55bda1ac64685b1a9b9f2b7b26614c82ea7b3e79c2d5
MD5 ec4b8d6f068ad1f81eded3681802c9fe
SHA1 d3041dc0b49ab009844976ad9c2c303db3b1bc96
SHA512 4402610bf88d7ca763dc42e9d72e56320ca2e518ad6ee3a0fce6a42ac30ef5209d87ecd96a2c0f0c150632ea9a807f48ed714e0c78d5edf2bed1509ec1684bf3
TLSH
T10EE026C454E8C23EE20D74A7437C634CCBA0361A93C0EDCE170CC584B606848AB93FD0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7d561483c2dd2f33d2c785b2c6a0820b6262e97d83eeb04c5018afabf5f56a50
MD5 84ff03546fedfa08bc5c85cf3c9e0c41
SHA1 060ba33b2c3582e7352d7a2c6055d3d43be78b37
SHA512 ab5c0a763cdcfc8b37acf22b62dcf397b11a390f231904abfd11150cfda0976df093d32534377f6d0a73de42506270de42ed5bc5dfaac8b3007831fe698e043e
TLSH
T1CD6160B5F45888F9F7E8A47086C61DBBB2347A744E8B5F5270E0FB78018AB8E4C02007
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5db4620983872637074fefd54c6945890d34b8f3c19e89ad3e674b423ea8c93e
MD5 e36e306f45415c5e26c09cba462926dd
SHA1 d9d8f5dd01ac2526f25df539669df7080d0ff5de
SHA512 68fd41da6472186c4f06ea048d0e53e0938b4310aae67ca61d3c3efd4e9268d914d1dc81ae5454d0254b8ece800624ccc43bf2887909fe6b02d10247c351b7d6
TLSH
T166614075F49888E9F7E8A47096D61DBBB1347A744D8B5F5270E4FA78018AB8E4C02047
MD5 SHA1 SHA512 TLSH

Submit Download

b0f8ddd8-d4cf-4bef-aec7-2516548c133d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b0f8ddd8-d4cf-4bef-aec7-2516548c133d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

27e0aab8-f706-435f-b479-9ca08d15f4b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27e0aab8-f706-435f-b479-9ca08d15f4b5.tmp
Size 949B
SHA256 d5bb7c151d6a3655203b1a16c30181f7661fdd9ac20530ca7f0b110e74d05cfb
MD5 75cc68acacc4bf965239c381159c68ee
SHA1 173b7f1ec6fb69d6627013afe28942fd847c07dd
SHA512 80c5edb74094f872f1af4da4c1b3ba9d7850e024fb76cc807205b86204b45ae28d7b0dc6557012fd83f78aa16fbe8e83cb901720e665d8d2d1160224ff5a0bd6
TLSH
T165117DB3C3E5956EC90156F05A24EE2BCF2D0605821C7C1685D4EF67D3F3479D00195B
MD5 SHA1 SHA512 TLSH

Submit Download

58d33e29-0295-46ba-9c62-19d16cde44e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58d33e29-0295-46ba-9c62-19d16cde44e8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9b80e181-c592-4bd9-b837-dddaed068c75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9b80e181-c592-4bd9-b837-dddaed068c75.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e10278f508159e015509e539cc1e1ffcb3ab5335d2325197214fae703900d2c5
MD5 2e208d19404d7501c229cbccfbce8762
SHA1 0d6762ab509b40635b82c0fa475a1939566522a6
SHA512 85073a3b57349bb88b27cc006b5317ed7f5d53f0da4ec3df5ff1d12aa0fcbb4ba8db58c9fa90e5fbcc7c2df529a29ff48b26be96bb2d306f72ccb49315719d5e
SSDEEP 96:KcmEKbKWu9yKmIuoZsYmC+kOC/PMwkKUBMekg4Yfm45Cz:SDVrtK
TLSH
T189916080317F46013DBD298846AA965E525231B33058F5BBBBAC61F15E2FE001DFFAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc44b846-9b26-48b7-a72f-22ed4712836c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc44b846-9b26-48b7-a72f-22ed4712836c.tmp
Size 27KB
SHA256 753469ee8211b00e3361e9ba513802e954a0dcce96efe6fb6d399bb8d8b3a90e
MD5 18868ef24b04f2b8c609e940368ec491
SHA1 753c6656d6ea4debec9b67ecdcf22ae54bb78e6f
SHA512 b8c2cec5ed3aa464b07660244b0d3bfd2057f93279379c433799558ea62f33d6382e56d07d8993c384aecafb84c765e8b084e0d517ca9ce2479f7a54e9cd35e0
SSDEEP 768:kaKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/UrooK:kaKlm7QWvUYe0u1ja8/L/E//oK
TLSH
T104C2FA3B640CCB7E4FC05A9DDC5A6F9B6EA802C7A6588D4047FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2261e68-0b63-40fc-963d-5ac568c38777.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2261e68-0b63-40fc-963d-5ac568c38777.tmp
Size 8KB
SHA256 d36da5b7ed803441274c7a0c4963fd2c58cc0d96e86d91dc70b865fb664289ed
MD5 4d01994bacb77ad0d8657cfd95246d37
SHA1 8f8a1f7af686af78512fec6dafc2d47f58470070
SHA512 3e9e8fd4c854a234cb2056d870f0ba346d9858c44ef244bfcc3b18cd2d13001dc364590eb1dd1dcc098ddca0107c2208075f86d3c460f3d4609f13fd3245d8b3
SSDEEP 96:KqONkFQsjpfbUmjH5ih/cIPURHl8h4otop57aDDBKP4v+Y1xf//ojd2xyY5qsoTp:BONh6JUm0QmiUyodso//oTpBC6lU6
TLSH
T12D02D835BC74ACBB9EE39E45B0477B239FA4106BA6915F44DAD95E2C01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caa42d29-6559-4ed1-af3b-b85cacdc70fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\caa42d29-6559-4ed1-af3b-b85cacdc70fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f41c27b6-b64f-4beb-9067-42529d3df266.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f41c27b6-b64f-4beb-9067-42529d3df266.tmp
Size 8KB
SHA256 eed0e6450ee1a7fed7965615505b71e9a35e03439e015da9966d144453987adc
MD5 1ef7d463d8ff31505890514ae22a82a7
SHA1 13eb2c4908da9e548926be983647d189d613f6b1
SHA512 881680e7a931d75234a5e4bb227df271c69b55ca7e6c733abb4a4f06db20b2f00969ce2d145f06024c65f1116deb7cecd1da036f3c3cba7f095cd003da564733
SSDEEP 192:IONA6JUeQmiUy3dLo//oT5VeqwNxPqXU6:IONA6+amLo//oT5VeNgU6
TLSH
T1C01218357878EC6B5D93A580F08336139FA4807BEB856F90D6DD6E2C06DB19CA307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bcaf95df3a52f6132c3c3ff15f5001840cb5c7cdcbd6bcb04d69cc30a9b9edc4
MD5 f0f4966d30bc43b0f5d6604f543077ca
SHA1 627516330346571feb5f3967cff705bda2c8145e
SHA512 8aa84bb2e526b4b0c21a9580f28493e53930a082a15551c8eb32be6ecc89c5cf123d638ada8ba64a4932b3ec344df6d76ce13dea4d81c0f94db69b9c2b2be218
TLSH
T1E4412A5CB6E91148B3B76F4AAFF364AE487BBD772E06C45D00110E4E4A66B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download