hxxp://kenyawebcam[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kenyawebcam.com
Sample260804-rh9hsaca87

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303263788726819"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{8D02C3F7-395F-44A4-8FFA-050187DA1E6B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4576	4952	msedge.exe	85
PID 4952 wrote to memory of 4856	4952	msedge.exe	86
PID 4952 wrote to memory of 2464	4952	msedge.exe	87
PID 4952 wrote to memory of 2464	4952	msedge.exe	87
PID 4952 wrote to memory of 2464	4952	msedge.exe	87
PID 4952 wrote to memory of 2268	4952	msedge.exe	88
PID 4952 wrote to memory of 2268	4952	msedge.exe	88
PID 4952 wrote to memory of 4764	4952	msedge.exe	90
PID 4952 wrote to memory of 2052	4952	msedge.exe	91
PID 4952 wrote to memory of 4764	4952	msedge.exe	90
PID 4952 wrote to memory of 4764	4952	msedge.exe	90
PID 4952 wrote to memory of 2052	4952	msedge.exe	91
PID 4952 wrote to memory of 2052	4952	msedge.exe	91
PID 4952 wrote to memory of 2276	4952	msedge.exe	92
PID 4952 wrote to memory of 2276	4952	msedge.exe	92
PID 4952 wrote to memory of 2276	4952	msedge.exe	92
PID 4952 wrote to memory of 1560	4952	msedge.exe	93
PID 4952 wrote to memory of 1560	4952	msedge.exe	93
PID 4952 wrote to memory of 1560	4952	msedge.exe	93
PID 4952 wrote to memory of 3800	4952	msedge.exe	97
PID 4952 wrote to memory of 3332	4952	msedge.exe	98
PID 4952 wrote to memory of 3800	4952	msedge.exe	97
PID 4952 wrote to memory of 3332	4952	msedge.exe	98
PID 4952 wrote to memory of 2068	4952	msedge.exe	100
PID 4952 wrote to memory of 4876	4952	msedge.exe	101
PID 4952 wrote to memory of 4876	4952	msedge.exe	101
PID 4952 wrote to memory of 4876	4952	msedge.exe	101
PID 4952 wrote to memory of 3384	4952	msedge.exe	102
PID 4952 wrote to memory of 3384	4952	msedge.exe	102
PID 4952 wrote to memory of 3384	4952	msedge.exe	102
PID 4952 wrote to memory of 1248	4952	msedge.exe	113
PID 4952 wrote to memory of 1248	4952	msedge.exe	113
PID 4952 wrote to memory of 1248	4952	msedge.exe	113
PID 4952 wrote to memory of 4524	4952	msedge.exe	115
PID 4952 wrote to memory of 3296	4952	msedge.exe	116
PID 4952 wrote to memory of 1536	4952	msedge.exe	117
PID 4952 wrote to memory of 4680	4952	msedge.exe	122
PID 4952 wrote to memory of 4680	4952	msedge.exe	122
PID 4952 wrote to memory of 4680	4952	msedge.exe	122
PID 4952 wrote to memory of 4100	4952	msedge.exe	123
PID 4952 wrote to memory of 4100	4952	msedge.exe	123
PID 4952 wrote to memory of 2752	4952	msedge.exe	126
PID 4952 wrote to memory of 2752	4952	msedge.exe	126
PID 4952 wrote to memory of 4648	4952	msedge.exe	128
PID 4952 wrote to memory of 952	4952	msedge.exe	129
PID 4952 wrote to memory of 952	4952	msedge.exe	129
PID 4952 wrote to memory of 952	4952	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kenyawebcam.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,14641930855313993643,3961132934651265464,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,14184922520631205860,3689096145232198146,262144 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13108446381797873167,4497863705168517174,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14814642914914116307,14563053050430979724,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11060292595864903667,3104645408085251850,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,2350010837974391371,1021516951284816966,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,7126765420538320072,7915304314095088523,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2184288117509474302,11561752723819493382,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17622280344028160877,4080536297740157182,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5157660141296764112,3853332795019051938,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5157660141296764112,3853332795019051938,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,14117920065690350697,8526233732628886082,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3528,i,17065705022697034657,10524342718661021221,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6324,i,7523023669413188209,13260899017945630119,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,7875535787003760783,17913090688207351697,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2962384168684450025,12720707004136537386,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9974460849750722085,9410349259038115712,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6140,i,8923033815361479503,13842303614445414068,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17309213491463692360,2974633893911208427,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,16745704197325768097,4975794800695305875,524288 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6312,i,3922077747224312572,343898913205455376,262144 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6160,i,15904560065142772706,12006350467007679323,2097152 --field-trial-handle=2280,i,1803452501042846995,6837569442071377479,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eee2ac7678e18f871136a4d23f9006e1070b9805ce2857f29f5801c7ff1b73f3
MD5 9b122ba1441d44c64f4c13f6ee112fff
SHA1 7b95d5b24efc45930b062fd41dd12567f758aa4b
SHA512 052947e9e2cc2bd2aab3c9ead28f0593f36f147f7729d91d09296f7f71702582af551a2f828e28115cf312dcab41114d2e183a0930d33178abcc62b5d480cc04
TLSH
T1F471A20B06693E95EFE71170F3ED460D38F283F54D632E661D6CD83E652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903a0.TMP
Size 3KB
SHA256 b1c8916642da7e7e05c9457b93696d26abcd6fafcb603964c82d4b228e796a83
MD5 8dc3553d28a2f7f4db9fc7d312fcd4eb
SHA1 6f9d5d40bd83c089ffd40ef95153572aa3790957
SHA512 adc68b7d15e4ea94982a26fa5cf6be9ed42b7aac7c779c758e654274c560d905e45ca6dc5406eaf31bd8b1047bbb46c8f0f3288baec97c050072cb96981b2850
TLSH
T1B371A20B06693E95EFE71070F3EC420D38F283F94D632E661DACC83D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 694B
SHA256 2b9e8b8ae713df979238bfd45149d0c9a8c2a6068a36e4bdf6430404e83a21c6
MD5 0670c014c26d1fee6902ee0bd14e03f1
SHA1 48f83f6c64b14e8ae620014cabcead28e9449574
SHA512 e432cf5ba0a8fad7ef8d2c065213532027f144fd5816e18da88691d8c6bc40c4db901683344e607710127dec4803774ecc4f98c589cfa0ca936312150f47a3c3
TLSH
T13A017BF387D595AE8D0517F05A24AE2BCE2D0602821C7C25C9D4FF6783E3069E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bcc1ca1d0700dabb663495bbe2cedc347555e886a428c40b10c411bc25b2f79e
MD5 7523aa260012e1a0db6dd6672fd533ab
SHA1 e8eda3cce16c5d83c5486f1b7956a94e5ae3bc05
SHA512 9b893cc092d3eb48609b052dfe1b8ac0fa0c1b672856566a661082ab3ecf7e899b0219f917ca3ef80e4cac3261cbf9c3244c44dfa916448d3d7be5a1c32de7db
SSDEEP 192:sxZflkK/fVsMwBTbbIdpJH+V6+WNGY4kk1m+2IgrJ:sxZfuK/fVslBTbEJHLGtm59
TLSH
T1F422C8156E38A5778CC7D21DFB257F43E6FA503261941E58EAFC961C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3bcfbf6c9f760f12d6497ef264577b130c9fd85f55a947d79bb8b28dbea9be10
MD5 788a3078157ea9282709bd1ad93a51d3
SHA1 1ca1d7fa70b8a3bedcb2fb181625f836a667f2d8
SHA512 aa0448681735f24cff85168f0d5c100374b4c1b4e9c4b1659541d14e3cc22ae6a3b9c63c6f69eac37606432d5e10dba6a3e4bdff7fead360a2e75f2700117279
SSDEEP 192:sxZflkK/fVsIwBHIbIdp+8H+Z6+WNGY4kS1m+2Ig5BJ:sxZfuK/fVsZBHIEnHnGlm5x
TLSH
T13E22C7566E38A9778CCBD20DFB157F53E2F65032A1911E58A6FC9A1C05E6BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5a3d26324b962e76ca7ee54f930bee5dda40584d7c6160711c063f391e17820
MD5 5117ee25c0732135d7b98000d71bd9ab
SHA1 0be123a50d16d5691de9e28301f3e30ddedaa434
SHA512 c2a1536a93e3589292be5527e7d214ed7d9947d88145e3f58107941fbd88511099eecadc1c003c65475cd3998fcef9ddecf4e12aa6f6735af8520b5e6caa7245
SSDEEP 192:sxZflkK/fVsIwBTIbIdp+8H+t6+WNGY4wk1m+2Ig5zJ:sxZfuK/fVsZBTIEnHLGxm5v
TLSH
T1A322C8566E38A9778CC7D21DFB55BF43E2F65032A1901E58A6FC961C05E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bcdba814f4ef16a2b9d8e04a0820d7c621b38a6b4e3b0470ead4a0eee8c077cf
MD5 f72f422ef7217bfa5531db575ffc6f44
SHA1 80af07b0897e80a0f8a05eba3846646bd1de0592
SHA512 34eabea0c8613c4c45ea30ad2fcf509edaac8e6cb1cc67f78a5cf9450368d4faa0b3331b073df4b2f878855cee2edd8ef0a236fff3b4dd83fa5c56347b0d7df2
SSDEEP 768:t0qirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTOroToUnf:t0qirTNWvx7jru1ja5ALocTFcUf
TLSH
T1DBC2EA3B640CCB7E4FC01A9DDC5A6F963EA802CB6B548D5087FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7874cf517705e10bd053afa2172cbb47a05cc8a8b9d6b91ddda451c83b0e70fe
MD5 32b6c04bd7cb6274ac485d4655823c7e
SHA1 4bc6fd8aa2b3c09fe2407ca85be3de177d58b4b4
SHA512 975e887db6844e9ce2fdc26f8ecefcffef84eb02ca2ced84cf38ea05f1101704f210c7ffd45a18164b8cc9f4ff816bd2a6659ebed59db74b7ba31692d710b9a4
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGMdpIlKqI43ya:KEIgK9WK6A4KBGGpGKqIal
TLSH
T10B916F1271BF02027D3F2B0CD26297175682B0A7741CA42B7BA941B24EA7E250DBDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b368374f-facc-415c-8f9c-eea52e678234.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b368374f-facc-415c-8f9c-eea52e678234.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599f63.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7806f164ba87c04bd16a6c4fc4dd55a5c0956f3d15115a45e62625a3dbbb25cf
MD5 0b9569cc5deebf09f24c8b7d1935af07
SHA1 57628bdff8d2be5f071fb220fe467919779a3edf
SHA512 7f529b8d9bfe52b54238b3cbee00a9a43a540d137c32dbf1c4d8a3a15a8d085e4c05f798c20c66ec07b96a33b0c8b45d020907a9d9540cc86ead5f16714557fd
SSDEEP 192:ulLsNu9UzQLgXpRKjimiLQmiU1UfW4k03NoeNoLIaPqe6Ni:KsNu9UzegXp4eE5kvMlaJr
TLSH
T1B24239356C786C3B5CA3A665F14636139EB48077DBC82FA4DAED6B1C05DA2D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3c997e67be5c2aefe5529080a93534fec91b218fddefa969c5bd7b4c915868db
MD5 757dc7325b0098fc2710d4ee5c180e35
SHA1 8ab29904ff56d977322f4077f3f3a033075cb7cb
SHA512 d43066056b67bd3b52c750d84e563a949db9f62e892908071be555277333e0f3073f82995b63cf27a249706325e633640be085602b6828153e3e29e6ee645630
SSDEEP 384:LiFiZcIozsNuu8TUNTUlIlfegXp4eE5kvMYaJBeRs9JKgqijUvf:mFQUiwgHk8aJTjKgqmUvf
TLSH
T1EBA27E324C64997FEDB7AF91F58A36178FF49067DAC5AFA0E6DC6A0C01961C8130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ba4e83d1c1db4661389ce399e31107f678bc496633d2506257217633dec3a6f
MD5 7bd47ffad40fd2c2872f3e1f7a79e986
SHA1 df08310857192e1f92c51f88ee65e2c24c0d7d61
SHA512 4857d2178469c4337260fa9beddfe4e88115a05f6417a7c6b4fa8d7dac28b33182d8a4b34ab77bd98a1168a7fc8f2ff2c97c4aff7abe6df0c3f710a688801203
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5D5DvBhPwivh50xy0SFYK7Ax6YLgc:gONc6kDfQmiUy1ZZ903NIQiakEU6
TLSH
T13B02E939AC786CBB8EA3AE05F48737275FA5103BEAD42F80D9E81A1C40D724C1703827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 819bbbc0e8364a85018ecd5fa015bfecf3c147b0b87daa86680d8486491bf98b
MD5 e10adb414ec39eef90c1aec98025003d
SHA1 1ad3174df514c93815239f178e1c97ce15046ea4
SHA512 883710173fd284d961d3267b3e5ab74959dfc425760bf605065f071d9af536d6953370a376a72301070feec437a48e1874424c1cca33a3ad2aa2483915125ad8
SSDEEP 384:VZcIhsNu9UfegXp4eE5kvMlaJBeRs9JKgqijUvf:thmkRaJTjKgqmUvf
TLSH
T162929D305C74697A9CE7BA91F48636274FF4D027EBC46FA0E5ECBB0C0189588130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9897d3b9115d0f354478fb155d4ecb37cc6f0d983064fac0383a668160d5bf66
MD5 dc58d430def989e102a34d485151a3df
SHA1 2340d2f89c0a6dff7fed607c37d5fe710ee2360a
SHA512 925229ef5957803d6265a5ebc9da88d85ea5ad590ed71641bd2926477f89a31a96ba4c2f51e20a5338602c664d4dfccdcbf8719f1f8a9210127a248641db1f5e
SSDEEP 96:HqONkfAQsjpfmUT3K5ih/cIPURHl8h4otop5DPDvBrPwivh50xy0SFYK7Ax6YLge:KONCr6kCQmiUyvZ7903NoeNVcRaPqeU6
TLSH
T123122A35A8B8AC7B5DD3A951F08736135EA18127EFC96F91D9EC261C01DB69C130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e740c2e5299f0690d86adb17c8e683df96caadd502e3286925220ce04c211cd9
MD5 4d0513ce3347191323efda8ce54bfb53
SHA1 41b9af6be8b07a4e2433b49a79311b0c00e974a8
SHA512 9913579a94b2a430ea0df514fb22f2521dcc9f95546f46e1bf2918d7eaedc26049b21c3901dc77569f15d5a99bc92aab31e50806815c4b8a3fb22c6685272248
TLSH
T1CA41E858BEEA1158B3776F56AFF7B46E443B7D272E06D45D10120D4F0622640C961B37
MD5 SHA1 SHA512 TLSH

Submit Download