hxxps://ar24[.]rsecurt[.]ch/

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ar24.rsecurt.ch/
Sample261020-rn3mes113r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
216	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{116A3736-6492-455D-A9BF-AD9957784CAC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	msedge.exe
876	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4632	4932	msedge.exe	86
PID 4932 wrote to memory of 216	4932	msedge.exe	88
PID 4932 wrote to memory of 4308	4932	msedge.exe	89
PID 4932 wrote to memory of 4308	4932	msedge.exe	89
PID 4932 wrote to memory of 4308	4932	msedge.exe	89
PID 4932 wrote to memory of 4736	4932	msedge.exe	90
PID 4932 wrote to memory of 4736	4932	msedge.exe	90
PID 4932 wrote to memory of 4612	4932	msedge.exe	91
PID 4932 wrote to memory of 4612	4932	msedge.exe	91
PID 4932 wrote to memory of 4612	4932	msedge.exe	91
PID 4932 wrote to memory of 3264	4932	msedge.exe	92
PID 4932 wrote to memory of 3264	4932	msedge.exe	92
PID 4932 wrote to memory of 3264	4932	msedge.exe	92
PID 4932 wrote to memory of 3600	4932	msedge.exe	93
PID 4932 wrote to memory of 4100	4932	msedge.exe	94
PID 4932 wrote to memory of 3600	4932	msedge.exe	93
PID 4932 wrote to memory of 3600	4932	msedge.exe	93
PID 4932 wrote to memory of 4100	4932	msedge.exe	94
PID 4932 wrote to memory of 4100	4932	msedge.exe	94
PID 4932 wrote to memory of 1992	4932	msedge.exe	96
PID 4932 wrote to memory of 1992	4932	msedge.exe	96
PID 4932 wrote to memory of 1992	4932	msedge.exe	96
PID 4932 wrote to memory of 4232	4932	msedge.exe	98
PID 4932 wrote to memory of 4232	4932	msedge.exe	98
PID 4932 wrote to memory of 4232	4932	msedge.exe	98
PID 4932 wrote to memory of 2424	4932	msedge.exe	99
PID 4932 wrote to memory of 2424	4932	msedge.exe	99
PID 4932 wrote to memory of 2424	4932	msedge.exe	99
PID 4932 wrote to memory of 1372	4932	msedge.exe	100
PID 4932 wrote to memory of 1372	4932	msedge.exe	100
PID 4932 wrote to memory of 1372	4932	msedge.exe	100
PID 4932 wrote to memory of 1876	4932	msedge.exe	101
PID 4932 wrote to memory of 1876	4932	msedge.exe	101
PID 4932 wrote to memory of 896	4932	msedge.exe	102
PID 4932 wrote to memory of 896	4932	msedge.exe	102
PID 4932 wrote to memory of 3456	4932	msedge.exe	104
PID 4932 wrote to memory of 5072	4932	msedge.exe	112
PID 4932 wrote to memory of 5072	4932	msedge.exe	112
PID 4932 wrote to memory of 5072	4932	msedge.exe	112
PID 4932 wrote to memory of 1900	4932	msedge.exe	114
PID 4932 wrote to memory of 3048	4932	msedge.exe	115
PID 4932 wrote to memory of 4420	4932	msedge.exe	116
PID 4932 wrote to memory of 4472	4932	msedge.exe	118
PID 4932 wrote to memory of 4472	4932	msedge.exe	118
PID 4932 wrote to memory of 876	4932	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ar24.rsecurt.ch/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff92c9ac188,0x7ff92c9ac194,0x7ff92c9ac1a0
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,2235928952252677399,18306875059436873831,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:3
  2⤵
  - System Time Discovery
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14133448857243529911,1935760420121399702,262144 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,2364475201309396725,5316292656659342727,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17847940505166173604,6803901442130393017,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,14172636030330014064,15576108905286595990,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8589439379278878441,15939695311549281187,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,2265578840883283827,4047707820529385739,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3580,i,4754593261367758699,1458317571501666250,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,14909591844624834439,8560464460469282376,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5364,i,6204880969658649756,2262891992326849079,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5172,i,9822386195062280732,14021044389755940660,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,18310796496822411471,7686509638775349424,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,7729820414276774687,15108036679652463634,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16373841038143757411,15516876659830552378,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16373841038143757411,15516876659830552378,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5088,i,3699542423622108877,343662419073773995,2097152 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,1842749167048280896,15858960317669909972,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,9585686810407087716,7730018181296484723,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,73075307217441715,17033195049922574868,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,7302839593380948755,14753917021955927383,524288 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,7264985734888669705,302846002543774561,262144 --field-trial-handle=2996,i,971673947696688668,6728677956338998454,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

127e9ce9-81d8-4498-8d95-8261e6133510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\127e9ce9-81d8-4498-8d95-8261e6133510.tmp
Size 8KB
SHA256 bbd6547224fde57b64a8e3373e89c2eb185df456e6c30574833a821595787791
MD5 f2146c4b8fe09ab8aa50e309cb827653
SHA1 1241e10b5a8f82a6159289fe5fc1d0a1fb3bae88
SHA512 a02f3351df20f78cd2c4701a5988d5da44898f6633de8b1927bedb415709ae731050577934fa419882c742c99a845e34d8e1a4930314683a7cc801abcb559fb7
SSDEEP 96:PqONkHOQsjpfwDISp5ih/cIPURHl8h4otop5NmDYBfPGxvw45RxmJm78lFtxSY+3:SONGh6iDCQmiUyGsHq5u88P3ESq6nsU6
TLSH
T1D3020B396C787CBB9DE26D15B5873B179FA4113FE6942F84DAE8162C01E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e3255ee-ed2d-4ac1-9c8f-170809e87062.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e3255ee-ed2d-4ac1-9c8f-170809e87062.tmp
Size 18KB
SHA256 6bb1de502da5e788ccdae1bcb0b98e791b69b6089d414b9fecc1e6fd0b8efae0
MD5 98bd7117ea8f75e93d798dd14d17b243
SHA1 71afac14956b8907e26f7e32cd897ded5b08f076
SHA512 7263443e286ce58ab24ad52c7ce8618a246ca012b9ec08c831a6d8d05ac4542e0fa86b9c48322035d783e6f16605b2b4cf1ea10ea63c0e96b913420e51bcdddb
SSDEEP 384:3QkUSv0sNuUzcKIRup5u8i3xK32RAMTTIIlf:J0rWk3oGAMTTLl
TLSH
T1B4826D362C786C6B5EE2A520F55A36579FB8D127EBC41FA4D5CDA72C01DA2CC2307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9210c979-12bb-457d-80d1-6f200913181d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9210c979-12bb-457d-80d1-6f200913181d.tmp
Size 18KB
SHA256 4811864769654a1adbcf3af53c9d0294efa9d088671dec9d06b27b568d776a93
MD5 b85385d83c4da8e8ae5e3f176afa5d3e
SHA1 283bd1986d4c1a3a79fe865b91387aab91274656
SHA512 8d22568ff0df6c5b0291a444dd28defd71bf9d700b65fb4d1c227bca9da2057e1b1e6b76dd18bc488e11a1ce5226fe2a80d071a8500e988866ffbf94b857e0ba
SSDEEP 384:FQkUSv0sNuUucKZRup5u8i3xK32RAMTTIIlf:f0hWk3oGAMTTLl
TLSH
T1DC826C362C786C6B5EE2A520F55A36579EB89127EB841FA4D5CDA72C01EA2CC2307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

940afa5a-61ed-4c43-b188-02e891d4c276.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\940afa5a-61ed-4c43-b188-02e891d4c276.tmp
Size 8KB
SHA256 b31f3a685ee7a484e5bb1a3227af5a07f1414d012bc7001f139b237abbca955e
MD5 a29e335e464e403d3bbcc9a668605407
SHA1 9a5d664238dca38f6a7918bcfd31931dee01fcec
SHA512 2192c0d361d812e9b1722c92186977d6536f6047886c9b0c71b4ccf5b122906270860761e684918cb21d5be80dc7faebad2e6550326624ac94fa018097f80892
SSDEEP 192:EONk6iDkQmiUy/s8q5u88P3xiH3huZBqxU6:EONk6Rb8q5u8i3xK3YAU6
TLSH
T1F3121A366878BC7B6DD2A960F58736139EA4412BE7886F94D5DC272C05FF29C130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

946eb950-96d8-4b1d-9ca2-d988344a118f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\946eb950-96d8-4b1d-9ca2-d988344a118f.tmp
Size 26KB
SHA256 7216a673ab6c4bcc2356da62247faea715059f5e8790c6ee7340ab45ba982555
MD5 db34a8b4eb65fa72a7ec18f561421fed
SHA1 ebb4335a7d228b38d1d59f6dd4543c59cf236ea6
SHA512 d0af18a0eadbde4078f5f63757dc5a8c18245765be696b5a4a629aeb74a0243e147862c9bb65b800dc4dad741d94797e5951abbe582a8dd4539ee96940444349
SSDEEP 384:DiFzQkUSvjzsNz8TUNTUlIlzcKxRup5u8i3xK3TtAMTTIIlf:uFdnmwg7Wk3opAMTTLl
TLSH
T121C207F218E7583ADA9E9B13A77E2E038EBCC017B5845A54B3C8561CCD961BFD207912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

3fee4eca-f5e8-495f-b95d-44f2d1576d11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fee4eca-f5e8-495f-b95d-44f2d1576d11.tmp
Size 11KB
SHA256 201b2823fcbc180856ce4ba8922bcb16bc1bc4b10b9ad69b0ba529b15f942c55
MD5 e3d308c89c2b6f825e73bdfec6008aba
SHA1 95f5c3d25b8d3a960f254437efbf6d4a2430e606
SHA512 01bfaa0d842f0271db0b46a8227773090baae6f82c8cad6fa96cac88d47de13226daa08e7eb5065476caa7bf542f44297b4ceb6ab2e3f9fa329a1083f7988e14
SSDEEP 192:sxZPRQWa/fvse/fIdpTN4wHW6+WNofPEfRgI/YaXJU+/Ig5rJ:sxZPNa/fvse/QPHb3T/CMT
TLSH
T1F532C951AD286A7B8CC7D209BA55FF17E6F95032A5D01E58ABFC861C04E7BDD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

650dc0e3-b0fe-4294-971e-997b78e786c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\650dc0e3-b0fe-4294-971e-997b78e786c8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f3366a6-b54d-4976-9c7f-c7e83e4c8af2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f3366a6-b54d-4976-9c7f-c7e83e4c8af2.tmp
Size 10KB
SHA256 18ce5abb0bb2f0fd9308395662c4eec37bcdb6c464b706c46c68797c9903053d
MD5 a458a28cb2a14138cb13286acebb3330
SHA1 e89ba635fcd1b04c225f4210ac8b6835d379fbb1
SHA512 2f6aae9ff3ba51d6497ce86011a6b4b0fc31d31c69a61e4ee2275aac451641b4cabb72d6df70587814152816b8ab53648d30ec62d97e94790b203ede3aaeb0dc
SSDEEP 192:sxZPRQWa/fvsH/fIdpTN4wHW6+WNofPEfRgI/Ya0rU+/Ig5xJ:sxZPNa/fvsH/QPHb3T/tMd
TLSH
T1F832D852AD386A7B8CC7D209BA55FF17E6F95031A5D01E58AAFC851C04E6BDD320780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 00177f0998a8a0a7926514ddf5b8eaf88042f74c1b4c99d1ab754154b2b594e6
MD5 9db2120870f40f4c9db55a9c9f242b30
SHA1 4e3a802b47f8e70f562033f7a486cf8891063116
SHA512 e793113c4684981dda6009c829e6efa5fed50e96ad461cc813768a1505f49827a67c6cf666022691ca977a619e6e242203b41cc713db6a1f9de9104c860a9543
TLSH
T1386186E1548C9035F77C64F757DD414B353895867FE3FD1125E8E83C982636A3398A84
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4f84cdaeffc40a1c8a24f4dc5b836c5c7c446dff245a357dba400d904f07c0ba
MD5 61fc32170d25b45f62d40e9bda12b08d
SHA1 f71598b923211eac2a28de37438fe802d7d24d64
SHA512 f8c66a18344d8cea0868c5eac9719567e8f2ee1df9305dd8ef9323e432e0da7bb03d1ca6b453e65ca18c83c42bf8639e6057e1aa7a04b00ff820817a733a55a6
TLSH
T1976184E1518C8034F77C64F757DD815B3538D9867FE3FD1225D4E838882636A3398A44
MD5 SHA1 SHA512 TLSH

Submit Download

5ad9147c-c1b8-4061-ac82-37796f106a44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5ad9147c-c1b8-4061-ac82-37796f106a44.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

25fee3f0-a96f-40a2-8c83-a2530a70129c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\25fee3f0-a96f-40a2-8c83-a2530a70129c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

61752422-d74f-4296-94b7-09f515aed51f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\61752422-d74f-4296-94b7-09f515aed51f.tmp
Size 2KB
SHA256 9b9a946ea9e989e52b4876ee61236c8eaa3f748541ceb455c8ac84562b2e5a8e
MD5 a365fb199400e935e2552c414b46a9a5
SHA1 a6b764a73b85bebf8d7f1d285137492d21d48675
SHA512 2f78a3ba47d9460b1e038e129417f457e8e9428201b9e5ed62e71b6da48d7f9390b6dc876a679eef7ec3e95758ceefd564c37b67e82539173fbde6e217735312
TLSH
T1C5517DE3CBE58A5EDA0196F05A247D2BCF5C0A18461C381F89E5EF1B53F20B5D2116AF
MD5 SHA1 SHA512 TLSH

Submit Download

8a97222d-67fe-4738-ba93-ef85aa70a47d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a97222d-67fe-4738-ba93-ef85aa70a47d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b34c6a24-a278-4619-b26c-7741faa56d56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b34c6a24-a278-4619-b26c-7741faa56d56.tmp
Size 27KB
SHA256 9d8baff7cd1b24cc0c874d5f6ca6b6b2849073e4bb4927058a21cb31b9264881
MD5 ddc4913759b468c6b27dd72f9585fd06
SHA1 d83eb947c98be7ca64f1a4a43c7376a65c9f9a5e
SHA512 34a4488500a826224a749f055e374ad786d95171194ae5ce00063bbf38c3a5d48e8bd9f25603b8f397d533af6cb541c76fb4b8843998a0c4ab8328f76f641179
SSDEEP 768:kNyQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3HroGZ35:kNyQRbrWvvlRZu1jaXKLf33UGZ35
TLSH
T1C1C2E93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6fea115-57eb-4bec-823a-f4f0c1687e86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6fea115-57eb-4bec-823a-f4f0c1687e86.tmp
Size 10KB
SHA256 e8ffb69cec10025a33a6cb92a205987b5053e1332e071e0f1016c77736a4809a
MD5 1e759f695016169361e8415adc35a117
SHA1 10e0be424d3f96bcb19f9b9e2ca3f0a93782497a
SHA512 dc169a1029f4192cceec6adc520014bf88dec56ac3f6c5301731d0b74ebac071b6b383bb75df35e4d74f2e0c46a019191fc817eb22ecec4f3b0d5988b8ad7117
SSDEEP 192:sxZPRQWa/fvs71fIdpTN4JHW6+WNofPE/YaurU+/IgrJ:sxZPNa/fvs71QyHb3/7M9
TLSH
T17122B9526E38667B8CC7D219BA55FF13D6F96031A5D01E98AAFC851C04E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df2d324d-742d-4164-95fa-0147bcfdf751.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df2d324d-742d-4164-95fa-0147bcfdf751.tmp
Size 11KB
SHA256 c44c13f9ba179682b1108c6921fdfb0a59ed131ead9434807d24750b8007e342
MD5 7bf91921158c40b34b46996001f6c18d
SHA1 98d4846a00dcda9e43edd94c17569942ab925b6f
SHA512 e55b065c2287796cea5e69c68309ef44b2eb74a43a47a34b103e54b81e6af4ef992b59a87570d762618a01081db1c48040804a98de30d9cb4d953ec2f8a5b9bd
SSDEEP 192:sxZPRQWa/fvse/fIdpJN4wHW6+WNofPEfRgI/YalGU+/Ig5rJ:sxZPNa/fvse/QhHb3T/bMT
TLSH
T1CE32D952AD286A7B8CC7D209BA55FF13E6F95031A5D01E58ABFC861C04E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c511d92-13f5-4892-86df-574117563f54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5c511d92-13f5-4892-86df-574117563f54.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e05ac51f-708e-4181-8c4c-fb1a27d71e83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e05ac51f-708e-4181-8c4c-fb1a27d71e83.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1dee03ad208babfdfbc0a6af07d632510dc75ed8a2b61dc514195e4ae78fd9f1
MD5 c9cb36720459f6d17d8fd71776d5ce3c
SHA1 a4bca558f75b3ef69f9dcc6c5d7c254091062997
SHA512 463421308f2d04801f1e3b333903b37878378dfcf4abb9dfd01168f3b51deb7351d0ae413940ede9b332d79a1f96a8499805579b1325eafda666848f5648c1a8
TLSH
T195412A9DB7F91148B3777E16AFF7A86D487E79672F06C86D00010E8E0622E41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download