hxxp://175[.]149[.]94[.]220[:]40202/i

Analysis

max time kernel
89s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://175.149.94.220:40202/i
Sample260418-mqfhfsft21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1146826057\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209842222330830"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{92AA7968-12F1-4022-A9A2-54364F236468}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4448	4428	msedge.exe	85
PID 4428 wrote to memory of 812	4428	msedge.exe	86
PID 4428 wrote to memory of 3972	4428	msedge.exe	87
PID 4428 wrote to memory of 3972	4428	msedge.exe	87
PID 4428 wrote to memory of 3972	4428	msedge.exe	87
PID 4428 wrote to memory of 4508	4428	msedge.exe	88
PID 4428 wrote to memory of 4508	4428	msedge.exe	88
PID 4428 wrote to memory of 4004	4428	msedge.exe	89
PID 4428 wrote to memory of 4004	4428	msedge.exe	89
PID 4428 wrote to memory of 4004	4428	msedge.exe	89
PID 4428 wrote to memory of 3876	4428	msedge.exe	90
PID 4428 wrote to memory of 3876	4428	msedge.exe	90
PID 4428 wrote to memory of 3876	4428	msedge.exe	90
PID 4428 wrote to memory of 2928	4428	msedge.exe	93
PID 4428 wrote to memory of 3272	4428	msedge.exe	94
PID 4428 wrote to memory of 2928	4428	msedge.exe	93
PID 4428 wrote to memory of 3272	4428	msedge.exe	94
PID 4428 wrote to memory of 3752	4428	msedge.exe	96
PID 4428 wrote to memory of 3752	4428	msedge.exe	96
PID 4428 wrote to memory of 5456	4428	msedge.exe	95
PID 4428 wrote to memory of 5456	4428	msedge.exe	95
PID 4428 wrote to memory of 5456	4428	msedge.exe	95
PID 4428 wrote to memory of 3528	4428	msedge.exe	98
PID 4428 wrote to memory of 4320	4428	msedge.exe	99
PID 4428 wrote to memory of 5656	4428	msedge.exe	105
PID 4428 wrote to memory of 4920	4428	msedge.exe	106
PID 4428 wrote to memory of 3288	4428	msedge.exe	107
PID 4428 wrote to memory of 4180	4428	msedge.exe	108
PID 4428 wrote to memory of 4180	4428	msedge.exe	108
PID 4428 wrote to memory of 5348	4428	msedge.exe	109
PID 4428 wrote to memory of 5348	4428	msedge.exe	109
PID 4428 wrote to memory of 5284	4428	msedge.exe	116
PID 4428 wrote to memory of 5284	4428	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://175.149.94.220:40202/i
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbef0ac188,0x7ffbef0ac194,0x7ffbef0ac1a0
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10320107962219887062,10611744625870090251,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,6297766764711664518,8007079362564775166,262144 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,14421106975098114082,10839695743241267536,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11872376944245250126,10219872515823209784,2097152 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15335252670851053436,2662229653023905258,2097152 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,10212259290836582847,8253217652465931295,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8702196532136245196,13047516754714422235,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5524,i,14989405920864033191,11854251932824458272,2097152 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15491791255273943689,3474294963228325928,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6185011476463128062,16076193692527211005,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6185011476463128062,16076193692527211005,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,15956460156554175636,11545443409493846259,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10633959275253879043,4902123274059069704,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,2341129601308017832,17076491116541765622,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,10682098938152824132,14677030844672401986,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,11496259638976134791,10209562170882411691,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,9200637895761858565,17345448932231013282,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,1240068886824239741,4226879308197863179,524288 --field-trial-handle=2304,i,2725400837558136205,9130372562482976143,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e672d16-1f89-4861-bb06-ba80cf9b485c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e672d16-1f89-4861-bb06-ba80cf9b485c.tmp
Size 27KB
SHA256 b490883f1307f3af5dc3baddfc813d3fa2b3dfe507f91076d3ac4faa47727de5
MD5 909e8ce7316816f89fee8d8768e5b981
SHA1 2adc187b3c553cd4e03a64a97640b8db54caa9cf
SHA512 29370c807805383f4392a719585c873be83be429053c1a6b6720322ea44c793bfab2abc3e41bb7d5e5dd9d9715bacd3ee84a03493f98d4191d5a28aba9c4c8ca
SSDEEP 384:nViFJjccCs+Bt0S3xsNO8TUNTUlI4VRihl/U3mvfDY0euVNa4Kcqy+U9sXnW8SB1:cFJccQRZwg+iEaYJuAcPrq3RS4Cp3
TLSH
T1A7C23A31E894DEBBEDF68FD9B34A3A07DEE000A785884AD4DAD94E5D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

4ee6812f-112f-4932-8ba1-c53150d83f66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ee6812f-112f-4932-8ba1-c53150d83f66.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 af79bda9c1be6b024890021615824c2171122cdf303fc0bb4ca5c2883affcbbf
MD5 25c11d2a2ff9c5afc2ffb8d01e0c831d
SHA1 c7f548e3d9cd59df5df28e60c0dde155b6992afe
SHA512 d9a31ff1255cdb9a929971d34ac8b9ec43bbebb215845d60cccea496f20eb12089d8d53d98faefddc6218057cda7e122b9c8bbe6f6186c50a0d43b4ae66b1932
TLSH
T1E2E02BAAC8219C3B05FD0B1924124747FF51175B1B50895F3B3ED1088FB46370955C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e7260d1a51aa7539d0e66348db65de263b9dde8ad63d62fee8d7d6fbd395deaa
MD5 d92027e26aa3529cc532321844ec3a5a
SHA1 3917d30d3c3a8aee3363613b2bcd69547ebcddd1
SHA512 10d0021f0aa50f1720e51138ee3c6f58ac03faea6a0f3bada0916c58ff446e2c3c3b3dd339b833b6a1647406bd83e277ce554abf93a5eeef467cc38251f0dbfa
TLSH
T18D41CCF783E4857E8A1196F0AA287E2BCE2D0551432C7C9A89E4AF1BD3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f93c213c3bcd03f281f6dea3781345a5ada0c1de90dadab90b71e9645d5eeb8b
MD5 f67bd1431b0ceddfa9a0dae01ffafe5f
SHA1 fa55356a5e9ead0bd7c7e55bb2fe974196b2117a
SHA512 968f82e485bd344b6c7259342b9ebd5d7b60dcfbef80049a679c684255ae47be378bf6c5d882f308c872476332a4670cece42d15bb73dee6dd892968c50e26da
SSDEEP 192:sxZ2R0yMqZ/K1Ml8M9l/fMsvtpZZELgvrzodpLHW6+WNGYKbccNSS/IgjWJ:sxZ2P1l/fMsvD3hvwLHbGnNSUji
TLSH
T1D962E8156A38697B8CD7D219FA457F53DAF9553392804E44AAFCCB1C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ee0a96324d42a88b7288b50a9091c5538dd69760d5c8d44531494fe7770f3247
MD5 f5f5e81c29eee7be7aeda3c7f2c17d1d
SHA1 1b76dee50646f8fcd6b0c231f7e4bfa582258ee8
SHA512 135c9d72f297e571531a6dde23a3d67aaec09dac137f4447f3d468d36d92f29f6aa14c8c4cb229af479afc64061b967380431fc4d54ebaff3de791b05293b337
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpEx4Llhf51YroK:A9sqZl+E/BlWvBDeTu1jaUEx4LXB1jyh
TLSH
T10AF2F93B6C0CCB7E4F804E9CDC2A7E8A6EE8018B9698895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e1506f6ec5bad4f72cc2ef562a485bfcd1842a4137a5c77898bc534ce6a1c2a4
MD5 ead906575dc9c23ed3af4d70b805b81b
SHA1 e29b0612e34ef7ec17cab410ce259a7cbea8d0ee
SHA512 f557ac62a8d78579ccde10e611b6efecc91f9f749fc2fe1440d031a0167a5b50421d7750edfdd3263d2909cc8fd906b68afb6389a20e9c0d206403b9527dc05b
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnk:+BOVglYXrbtZqRvJtBE
TLSH
T162B23C11753B03803A7E259E9194B46F62C270A37098B42B7BB945A64F6BF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0a24cc6caf3bf8ce01669ad976bdb7428021369e551bcc850ea7ec9508890e27
MD5 3b721be0f0849dd6e4c1824e51892d27
SHA1 7ecbb3c6ed534e83e09cc2e8721a70b42e8b4628
SHA512 4c98bfd8b4048a8db666d145f01274698a939c5d6b3549bce6abb041209ada20511be4a26f5dd68c92ebb0235b01e7a4c158887e68a3201fe2d37920f296a686
SSDEEP 384:nuriFavqMg3sN58TUNTUlIm2RihY/nrmvfDY0euVNa4KcQQWdS7o1dKuiNuXurNu:uGFayv3qwgTiu2YJuAcJ0mo1tioXiw
TLSH
T12CC24B31E898D9ABEDE69FC9E7097A07DEE001A7C58C4AD4DAE85D0D10D71DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 27c4a832ac8a0e9573c9b9976f27b717640329dd20fd8156f483076e9a67085d
MD5 d4b9d65fc403c11247cd0a3e7ffee78e
SHA1 f1ccde2a1c31293766f1a42092ecd87916c94985
SHA512 5da95cfe483d02ae18c276d08133f4b257689b6b7b69e5306946f55d87d9cf2ccfcd1023927fe663d1607c44c02a0e07687ddf27fab2ccbb93b03d050a5f6b96
SSDEEP 384:n2iFavqM73sNO8TUNTUlI4jRihx/U3mvfDY0euVNa4Kcqy+U9sXnW8SBFwzCrN1N:dFayI3Zwg0iUaYJuAcPrq3RS4CN
TLSH
T100C24B71E898DAA7EDEA8FD6B70A7A02DEF0019785CC4AD4DAD90D0D00C71DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 347e398d85186b039f3b036e069c17e307869d2be985b5d5d53ec5e8ed223a31
MD5 e8d804f745511f40c1c1313f149fd5b3
SHA1 886fb8c0d4bc61d313ba69d1731138a507979dfd
SHA512 57510705894f198e1fe8aaa019c8c7086e738e771f74a89e2f45d1b97d64c751d8ccf9ebc0d17bfa565bfa639f42b6c79fb61c18260654284ccaf52263370de8
SSDEEP 384:neiFavqMg3sNi8TUNTUlIm2RihfwCEmvfDY0euVNa4Kcqy+U9sUnW8S7o1dKuiNQ:1Fayv3pwgTixnYJuAcPrquRmo1tioXiw
TLSH
T149C24B31E898D9ABADE69FDAE70A7A07DEE04197C5CC4AD4DAE80D0D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 856e8b6d38faf9999bd627a70577183619f99385e29b700bd42ede6fa9b5fb78
MD5 3c7f28d69b9506346238bd403f3696b3
SHA1 62f0ef5f50351bd8791359c900bad8778e6b6b97
SHA512 f93ef4a84aa4ab112ad0779ec48a25fe1932e1522a746fb28801421ed1e5ce01a2868c6143002ee68c240f42ecb1ab22a6a07c2523686f15b0e6055bc2e4e8d2
SSDEEP 384:n2iFJjccCs+Bt0S3xsNO8TUNTUlI4VRihl/U3mvfDY0euVNa4Kcqy+U9sXnW8SB1:dFJccQRZwg+iEaYJuAcPrq3RS4Cp3
TLSH
T120C23A31E894DEBBEDF68FD9B34A3A07DEE000A785884AD4DAD94E5D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 902d9e44faad9c642485352551d4c89c0a140c50891a8a1621dcab4cac0de440
MD5 609de503db1d269e9fa122831be33b79
SHA1 190bb7a79a216e159195162da6baa190e06eb535
SHA512 77929012b0be2444ee398cb430cd63c79ee8af5cdcc0a95716887a4998aabc0bf5e3435a370b9d5820eb55e9d3b6c91f4330878e3f5946d069361eaa4f0cf29f
SSDEEP 384:ntiFJjccCs+Bt0S3stsNO8TUNTUlI4VRihl/U3mvfDY0euVNa4Kcqy+U9scrW8Sn:kFJccQuZwg+iEaYJuAcPrqeRS4Cp3
TLSH
T1C1C23A31E8A4DD7BEDF68FD9B34A3A07DEE001A786884AD4DAD94E4D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f8753b9205d7330a9746f899f972294f40fcd2264ac4a52808bf4dc5a08ad880
MD5 821809c028c33d04a3475c2eb52e3283
SHA1 5853a77dcfee00a4db4010768f9a5dc48c67152b
SHA512 5a4b68b861b3253251f61fdadfc02a057eca5dbcd38b85286f59dd164bcf2f9820ffb877a71b919bb80054a76a0f9f37a5b3655bc5729df22d4ec6e4f8410c88
TLSH
T1FD41F698A7E91158B3B77F56ABF6A8AD487E7D372B46D45E10010D4F0A22A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads