hxxp://foyerlux31[.]org

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://foyerlux31.org
Sample260730-dfxvbaxhpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298538664306824"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{30BCE35F-791C-4B9A-80A7-0BB3EB85B8CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	msedge.exe
628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2120	3092	msedge.exe	85
PID 3092 wrote to memory of 3828	3092	msedge.exe	86
PID 3092 wrote to memory of 3572	3092	msedge.exe	87
PID 3092 wrote to memory of 3828	3092	msedge.exe	86
PID 3092 wrote to memory of 3828	3092	msedge.exe	86
PID 3092 wrote to memory of 2552	3092	msedge.exe	88
PID 3092 wrote to memory of 2552	3092	msedge.exe	88
PID 3092 wrote to memory of 1400	3092	msedge.exe	90
PID 3092 wrote to memory of 2336	3092	msedge.exe	91
PID 3092 wrote to memory of 1400	3092	msedge.exe	90
PID 3092 wrote to memory of 1400	3092	msedge.exe	90
PID 3092 wrote to memory of 2336	3092	msedge.exe	91
PID 3092 wrote to memory of 2336	3092	msedge.exe	91
PID 3092 wrote to memory of 4000	3092	msedge.exe	92
PID 3092 wrote to memory of 704	3092	msedge.exe	93
PID 3092 wrote to memory of 4000	3092	msedge.exe	92
PID 3092 wrote to memory of 4000	3092	msedge.exe	92
PID 3092 wrote to memory of 704	3092	msedge.exe	93
PID 3092 wrote to memory of 704	3092	msedge.exe	93
PID 3092 wrote to memory of 4640	3092	msedge.exe	95
PID 3092 wrote to memory of 4640	3092	msedge.exe	95
PID 3092 wrote to memory of 4640	3092	msedge.exe	95
PID 3092 wrote to memory of 2808	3092	msedge.exe	98
PID 3092 wrote to memory of 2808	3092	msedge.exe	98
PID 3092 wrote to memory of 2808	3092	msedge.exe	98
PID 3092 wrote to memory of 1096	3092	msedge.exe	99
PID 3092 wrote to memory of 4724	3092	msedge.exe	100
PID 3092 wrote to memory of 1096	3092	msedge.exe	99
PID 3092 wrote to memory of 4724	3092	msedge.exe	100
PID 3092 wrote to memory of 4384	3092	msedge.exe	102
PID 3092 wrote to memory of 4420	3092	msedge.exe	103
PID 3092 wrote to memory of 4420	3092	msedge.exe	103
PID 3092 wrote to memory of 4420	3092	msedge.exe	103
PID 3092 wrote to memory of 3504	3092	msedge.exe	114
PID 3092 wrote to memory of 4620	3092	msedge.exe	115
PID 3092 wrote to memory of 2796	3092	msedge.exe	116
PID 3092 wrote to memory of 2216	3092	msedge.exe	117
PID 3092 wrote to memory of 2216	3092	msedge.exe	117
PID 3092 wrote to memory of 2216	3092	msedge.exe	117
PID 3092 wrote to memory of 4140	3092	msedge.exe	118
PID 3092 wrote to memory of 4140	3092	msedge.exe	118
PID 3092 wrote to memory of 4516	3092	msedge.exe	120
PID 3092 wrote to memory of 4516	3092	msedge.exe	120
PID 3092 wrote to memory of 4724	3092	msedge.exe	121
PID 3092 wrote to memory of 4724	3092	msedge.exe	121
PID 3092 wrote to memory of 4724	3092	msedge.exe	121
PID 3092 wrote to memory of 628	3092	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://foyerlux31.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17400261591578782921,4173995163655661166,262144 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,18330378722449499980,10321202444320743613,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,9280412225545898504,959210620979628609,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3619678000358090390,7079221546408888259,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13928879221101739417,12026609493424218339,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2574630495806416035,70984259135354011,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2047020295325896546,8676434091199178306,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,14963693256319304794,12913190014586166279,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3556,i,11349102231632351448,8946521600853606721,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,11406463029201521480,10002725978482065969,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,16570713592430705285,13875082976804293178,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,5265747515090931471,970037653487140236,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,5265747515090931471,970037653487140236,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5168,i,3896352041984291325,5110457654102782325,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,5489445194193481231,10266727713199860808,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,5699529837951845584,17906776735153793203,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,10196856581773327938,8999243228464954503,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5436,i,8250760140001186498,9836556922547351499,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,1978825939745671270,3636100999533267996,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,1929026464176960145,1674318610680037072,524288 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3540,i,806104983649721464,4373647052159882502,2097152 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2768,i,8959746286453340255,9578016061921935693,262144 --field-trial-handle=2412,i,10968433873758866943,18147351671370090417,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 80e2abbf8c3b3d203f938a40126a13f62a891c51e6206b1b4c9ad44af2bf6471
MD5 0a79475af139c9c720b960813444c578
SHA1 08a83ad14936cdcdbc0918e9006fb9373e2ecbde
SHA512 5c2ace5fafa0c82913b0c97be789e5f1efaf11f76f17e58cbc429bd179c4191e270a492834a42a2d44bacf0014b30f1a8548678bd97d1e3b21b25d7ef05ff1f9
TLSH
T1CE714DF912AB34A1D7248230E4D306FDB47B4495DB237E51C100ADBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588901.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588901.TMP
Size 3KB
SHA256 eeb9d801c71f28ef50ef941ac25b55db600e90a98105bb554314c889a0f2a267
MD5 06fb0448d5fcffc8ea6eeb3342fb8bf0
SHA1 67fbaee831ca61a36ad658bc6e5c8a697b081765
SHA512 4519f5484379bea0c99d1344ac21f143ad306f007118102686b5d53d208f848e34ba0a5298942723730c8fc086f8387eff8966210123acf1eee403657f6cb85d
TLSH
T191714DF912AB34A1D7248230E4D306FDB47B4095DB237E51C140ADBCAAC6BD997EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e46f060af41c2315d97e008da31f0d25b4dc3789dcaeaed16866bac03af2203f
MD5 26992a3cd4d46fc759ef816f5a35c742
SHA1 7068450dffe9dee80e799ae988d89b35f06035e4
SHA512 88f061eca527abaea404bdc3f20b4e91eafeff7b0baac51b467c81b318e27d03154826a8d12eb1a62d888f61748a67dbaf7050fe63ce8bf64a70023a30c643dc
TLSH
T113117DB3C3D585AE895516F06A24AE2BCE2D0506831C7D1589D4EF2BD3F3075D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a2ad41bc8ab45bdcd2603ffdc2573fc6f45298855c1a0bfda9cf34d71f3af1b2
MD5 91755e89ff29a2d4ac326c3e03275085
SHA1 ee8b1dcbc0253353fb6ed52b0203b9d9aca82657
SHA512 adac749c22908f31b69fd10264ad8ec50c50ed39f882ae17c861656845c83f0e5942e1dcb0e4d33cf726de5b27c2683905ae36ea8bb5626f1c42098a9fa1b135
SSDEEP 192:sxZCRoyM/jK1Ml8MkX/f6s0bZIdpIkH6a6+WNGYHj5i+qIgrJ:sxZCuMX/f6s0bylHGGnN9
TLSH
T13442D5166B3499B7CCCFD209BA45BB53D6F90572E2901E44A9FCDA1C00E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7a8ee38e9c2c7326346a4bbe7cbe02144476930cfc22cde5c17d08c85b4dd557
MD5 1619b9a6a2b34eb8710da9315bf9c280
SHA1 1598948cff5da5536fe9d4157913dd294b2bc2da
SHA512 6254aeb24d41208e341bd7b6894a291a076a86eb83c8f09f2209aad39c91945016b11e467b182f294da3981b4bb8a7d832f804e86d7814ef280b19f76b13c23d
SSDEEP 192:sxZCRoyM/jK1Ml8UQ+kX/f6sunZIdpykH6u6+WNGYHBUf+qIg5aJ:sxZCuqVX/f6suny7HyGRNA
TLSH
T10052D616AA3499B7CCDBD209FA41BF53D6F50572E2901E44A9FCDA1C00E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f69227e087588cb7af23d07665f9cb8922f63a91e1c12d5beb10947ab076a261
MD5 ce27dde8f14dd477c0124d10df2b5b24
SHA1 f0a04a05df9d8146b04e0e3021644adccd5ce8c5
SHA512 276bd3ec914fb7d4eabd2acabc6cfd4560b5ad4c0d7926695bc1fd0d0b9d7c73923a2df5e2f4ec81321e617c4f500d4c9173ba04d238c5fe7f69bc4b75edc4c3
SSDEEP 768:xIUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R6roV10bk:xIUZYTMWvg0Pou1ja7eLZmRxAg
TLSH
T147D20B2F280CCB7E4F844E9DEC266F963ED801CB9A584D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f8249b9aab21e38ed0e0d462c122ab738a2b3532b1934f66eb9c6ca4d1fb5b8f
MD5 7feaa0bfcfe09005e0c8fbb318553dc5
SHA1 3c67d96af43c71f433d0d00998c0690ba1acad02
SHA512 6079bef6ccb6cb1d56c7602c9505a66da1ffd1718153d488f08bc66f2745356432740c9159b3c98b6fc4b4adac364897a352fc391a354392017b478bb226ef70
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQS:E0BFlb
TLSH
T1F8B1360232B712433C3D2908A299973B4F85F1933424A46B7FA944B25E67E744DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592457.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ff72f88ca2712f72e04c8a17e4464b71265b8760b49916f59c4edad3afb58e6a
MD5 c28cd07d5434396897f7bd93bc4d2359
SHA1 ce14186602c3a703c2dd6bafea98c579a81df0b8
SHA512 ece372b4ca84e2e41544d39040ef96fbb06e017934502ea1aaa5c0469fadd68e419f5d9f3593fe010f7d2906b5a4c64b78a1ffb6fda633edb98ab1256c4a96e2
SSDEEP 384:bKZcIhsN8UtYOYczX5od+KOrk9OObjI9G6w7wJ:ch5UOzOrk929MO
TLSH
T168928D32AC385C7299E7E555F88B36174FF89177D7882FC4A1EDAB1C059B5AC130AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 cd7ec6675c41a743ad49fdb0a537d67b413d11e993c1a077b56791e6dd96058c
MD5 26422b755dcae3dc1c6a068a22aff164
SHA1 12a489c9addcb332e7d901928f20f39793daddcc
SHA512 d5a8000acf69530caed197b32d206e1dd0a109df314395de9d16f380b64af48922f6bdbf14c0be8088f1d65a4a2499b41fdd4ed76f29694fa2e638fca32b74a1
SSDEEP 384:cWiFiZcIDzsN98TUNTUlIlMYOYczX5od+KOrO9OObjI9G6w7wJ:KFQH0wgNUOzOrO929MO
TLSH
T11EA27E335C688977DDFBDA55F98A32178FF45177CA88AAC0E2DD9B1C019B59C130AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d6cf0915ee3610d9987cbb4ffb289ec467c68793c3f0634aa3ced2b51099a629
MD5 3ff20247bdd7402dcaf63ec0cbe7c3ae
SHA1 f7ee5097667c00dc3ee6ce0f7b55cb369614883e
SHA512 2f1d801a346d27c2e4eeadfbba870b0fa6decf67e565abb7b887fde3868cfcbb5945399a991057c33bbcf4ccbcc52212a6cb94a7325afcc6cf26090e27527e1a
SSDEEP 192:yONc61VWQmiUy63gGX5Obd+juOFmI/ar3s5U6:yONc6WfgGX5od+KO645U6
TLSH
T16602D83569687CA78EF2BE49F48B37135FA8217BEA546F84D6E81B1C00D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74b325bd1827ae35911c1711f3c694e39994074de987117d08067d7daf83768f
MD5 34794a622baf2a58ac50e2ed46dc2702
SHA1 269f0f8ed8630253bb969f8f2d15fd3a7aef9d4c
SHA512 10d96ada3d5effc1e8a0e21cd1f6956f8fa31300648ef20f56f3100c0ae9073fa67f2daca8d6e69d7a9555b9802032722105ff1b30d93c4149706fd34240837a
SSDEEP 192:XkONe61w8WQmiUyL3XcGX5Obd+juOFm0be1jJPq+U6:0ONe6OUMGX5od+KOre9U6
TLSH
T1F812F9366568AC679DE3B584F48731135FA95167DB897FC0D2EC2B2C01EB69C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5618ff555f349112fdac3f614eda42a4959533b97dd8ca0370ab711b714df1dd
MD5 895ce91f48cd196bda6a3758cd509ce5
SHA1 57e10efcae48fe012fc3fcedf2bc15181c9fb7c4
SHA512 8513ee6262bf6dde4d60752e1f9769c56107bbd77edf5d0039e2590ae301d1353fdbf5e17bc1759fe5771f5bfd9679f832816d58e74698b1d3c60a17f164241c
SSDEEP 384:0KZcIhsN8UMYOYczX5od+KOrk9OObjI9G6w7wJ:VhkUOzOrk929MO
TLSH
T18A929D326C385C7299EBE555F88B36174FF89177D7882F84A1EDAB1C059B9AC130AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f3f5cbfaa7eedc3c404fd83d9e8801fbe4c019594890ab9ec67ba7f3cea05c7b
MD5 96238ebdf54118fe8f58ff50cff8d2a9
SHA1 f8d01602696ed3f4c2612b8cd2d870d253b7adbd
SHA512 ad4bd48c121422a58305c002df5171a455c35f129b6dd44aa1c29f3c5107d224576802ef8baf4fccc3f25f79d4d6a577846fc43b7e0259f0cfe975feae883d5c
TLSH
T102412B5CA6FA1148B3B76E5A9FF7A86D487EB8372F06D45D00110E4F4A22B40D971B37
MD5 SHA1 SHA512 TLSH

Submit Download