bab730f4f5b85a3b32d3093df9b5938fc8a05b7699aa225de033e9095e2f6a3e

Analysis

user interaction
yes
max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHProto.exe
Size 321KB
Sample261023-d6vsmswtew
SHA256 bab730f4f5b85a3b32d3093df9b5938fc8a05b7699aa225de033e9095e2f6a3e
MD5 14fe5da307bf68c3f54100090f642976
SHA1 79864c890da986bf65037a5d813131ae56b04fb0
SHA512 5cabec1c2174f537dc5bf49f7835fe8cb258a9fbff0d1f42821768aba0deb6f41783ad33d9fc6d3a418b23d1c615dfc7d713a6afa6fb81e4a88bb0fb45d855e9
SSDEEP 6144:TCWBkj3AvPv4x24Fy/P74PXg18iDc35so9qxLfSLBn:TCWBkUXv4x2OyL4418iIB9qALBn
TLSH
T15F647C0A2585F4DEDBA5CA78C9E0C70EA73D75300E714B274E6E45EC4F21F9C6EA9218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1788	msedge.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1788	1824	msedge.exe	105
PID 1788 wrote to memory of 4372	1788	msedge.exe	106
PID 1788 wrote to memory of 4540	1788	msedge.exe	107
PID 1788 wrote to memory of 1936	1788	msedge.exe	108
PID 1788 wrote to memory of 1936	1788	msedge.exe	108
PID 1788 wrote to memory of 1936	1788	msedge.exe	108
PID 1788 wrote to memory of 3656	1788	msedge.exe	110
PID 1788 wrote to memory of 3656	1788	msedge.exe	110
PID 1788 wrote to memory of 4948	1788	msedge.exe	111
PID 1788 wrote to memory of 4948	1788	msedge.exe	111
PID 1788 wrote to memory of 4948	1788	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\SHProto.exe
"C:\Users\Admin\AppData\Local\Temp\SHProto.exe"
1⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf6e0524fh6ea7h4964h991bh64faffada281
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf6e0524fh6ea7h4964h991bh64faffada281 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x20c,0x7ff917aec188,0x7ff917aec194,0x7ff917aec1a0
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,8749464953745655533,629467297105202930,524288 --field-trial-handle=2092,i,351195289774102733,15760555526714041523,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,9790404264683183999,3793577777113610059,262144 --field-trial-handle=2092,i,351195289774102733,15760555526714041523,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,7299359349925850100,3765771195797849007,524288 --field-trial-handle=2092,i,351195289774102733,15760555526714041523,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,183870389949023316,18309641420644615986,2097152 --field-trial-handle=2092,i,351195289774102733,15760555526714041523,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:2
    3⤵
    PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7e81e6f6-691f-45a5-919e-b71c81d2d098.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e81e6f6-691f-45a5-919e-b71c81d2d098.tmp
Size 8KB
SHA256 ed0bc3eb072256497603987771e2ff3f4a351e70042087f0152aa6d88666b6eb
MD5 57d6450d5e8183211f6bfb0af870968e
SHA1 2a70545da4ca5f52b70f7169e57606c71785fc72
SHA512 3d753e723eb8071022013a9c23d2002a60760c9752b230687cfc21aa9265803e88218aa0abc3a69daa5b492e0314f0e996026c269e16b655d66718bb8b65d381
SSDEEP 192:LJON46DphmqQmiUycfq8wGYX59ezSCtORX/kk7OnU6:lON4619zRwGYX5EDtOxncU6
TLSH
T1B002F835ACB87C7B9DE3AE45F58B37139FA4102BAA942F44D6D81E1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94cbb74e-3255-4750-9b4e-205e3016d88a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94cbb74e-3255-4750-9b4e-205e3016d88a.tmp
Size 9KB
SHA256 4e0ef014544a2f32760577e27de8f03d7d50a4d0be8873acfe3497b44ef3d4fd
MD5 8967ef5b3514f98d6320630a5d2d72b8
SHA1 b52f516560d93be684139f9840a3c12eb4f2d043
SHA512 5b23c0d745f08ea4232ed83f95e90c43912efd9c648c1f7b99927e2afee649f16327988dcbcf9e71f65d79d4b42232f0a976941912d5c7d12675a77181eeaf5d
SSDEEP 192:zysNR6Dphv9qQmiUyFkNBGYX59ezSCtORXlLUkI13eq5nczUO:zysNR61587NBGYX5EDtOxlLkhUUO
TLSH
T17012F935A8B8AC7B1CE7A554F58B36539FA42037E9846F54E6D81F1C00CB78C374A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02b012ca-35ba-4415-b1e2-f0fac059cd18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02b012ca-35ba-4415-b1e2-f0fac059cd18.tmp
Size 7KB
SHA256 cf26f318f0c6f00203a1e1fe6a0120ff493822aa7b3f4063e13e1cb9b79e6cb9
MD5 b0ca08d3519cbe661bf5200a2805b81c
SHA1 1216f8b8cc67faabee053e9685f7025e7c4ad5df
SHA512 39f704a62e68a2db44a1962ec10ea4e85f80bf56b9958391dd086afb705903256b325288e6fafd4d31366ddb016eeb0038ab216cf137cc718450acc20c7a1205
SSDEEP 96:sa2jDiEDW765scwsb9Hnsb5dHW+i046W6hfuH9EOx+WVoMfm+uecpYQjzyK+gskZ:sxPu8sH0snrpMHW6+WNGYgexhgF
TLSH
T178F1B7526E28697B4CDBE11DBB257B53E2F9402176D51A48AAFCC61C089BBCD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08a3e5e2-b06c-4e20-9583-c3ddccec0d54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08a3e5e2-b06c-4e20-9583-c3ddccec0d54.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22b5ac0a-2a60-4138-8cb2-646f0ee6c0f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22b5ac0a-2a60-4138-8cb2-646f0ee6c0f7.tmp
Size 26KB
SHA256 0fed93db9d042f95ce13cce4e52909c0ab893389427f7c327f1cd897965fd220
MD5 3af5887d50d21c41cba3cb0fd42279d0
SHA1 51017aec04f698d1a206b138470c7195316ea566
SHA512 4082aa26f8f0c9eed9fb5a76c9dd013e58618468fd4a709e60956db85aacec101c27f01046f36dbeda36b5eb90e7bc4b1cbf8fc554d58c1548ff79da10c1e609
SSDEEP 768:pCichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKX7Kro8SG:pCichfPWvPZplu1jan+LKg7hbG
TLSH
T146C2E93B640CCB7E4FC05E5DDD166F9A7EA802C7AA688D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3138f3df-5572-4a8d-9abf-d3d3fd010445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3138f3df-5572-4a8d-9abf-d3d3fd010445.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2278a181-35b7-4578-a4ac-99e8b5ed373b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2278a181-35b7-4578-a4ac-99e8b5ed373b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

00a38c0a-e520-4943-bedb-91c72f47e81e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00a38c0a-e520-4943-bedb-91c72f47e81e.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

df2d8b5e-43a0-4590-b389-bd95d032fc8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\df2d8b5e-43a0-4590-b389-bd95d032fc8a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b006003a-b99e-44c3-9ddc-2b12dbf125b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b006003a-b99e-44c3-9ddc-2b12dbf125b1.tmp
Size 9KB
SHA256 0bb1f5fa1e4b56ca97a2fcedac0ad0dd1a731c7bb2d53e2a96f711f13b559aa3
MD5 f26557db1f102b550e86cdf6823ca11c
SHA1 b8c53f04085290c7534edd996d6f98de257095b8
SHA512 0c0ef69d02ac068b290da4a8fa0b33e7acfd91c6a66860fdcd1ddbdd32a85162149ced73945089e6a0d61400378d556809ada2b97cd574ede23d50feb9afc247
SSDEEP 192:zysNR6Dphv9qQmiUyOkNBGYX59ezSCtORXlLUkI13eq5nczUO:zysNR6158ANBGYX5EDtOxlLkhUUO
TLSH
T1B212F835A8B8AC7B1CE7A554F58B36539FA42037E9846F54E6D81F1C00CB78C374A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba945c6b-052d-4451-b265-8cdde77c554a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba945c6b-052d-4451-b265-8cdde77c554a.tmp
Size 8KB
SHA256 04dbd90ce07f45a0f5cd7098db25ad9a756878a9a21508c5acc80b5bd53f8d35
MD5 cbb7c92f59ace49dcbf27ec35496da96
SHA1 829ccea0f2188824dd903459e20624f0ec3466db
SHA512 2560363ba59a127973e5b6a44a443bfef77047008d4b131055301c5676dc097802b2b77ad361f2ea2ca044a1dba85f843a2afeb8ff1f4dfcca4960103e959761
SSDEEP 192:aONg6Dph/qQmiUyKfNwGYX59ezSCtORXlLUkIIuq5nczU6:aONg61UvNwGYX5EDtOxlL1BUU6
TLSH
T1C212F835A8B8EC671CE6B655F18B36539FA42037ED84AF54E6D81A1C01CB78C374E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e550ca23-0a0a-4e73-825e-61b4a8445952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e550ca23-0a0a-4e73-825e-61b4a8445952.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads