hxxp://ping-nae[.]ds[.]on[.]epicgames[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ping-nae.ds.on.epicgames.com
Sample260806-a9f7wavya1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3084	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5004	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304512889690663"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{16D7331E-0EBE-4724-9312-9108D40C4A9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 5104	3084	msedge.exe	81
PID 3084 wrote to memory of 5004	3084	msedge.exe	83
PID 3084 wrote to memory of 3196	3084	msedge.exe	84
PID 3084 wrote to memory of 3196	3084	msedge.exe	84
PID 3084 wrote to memory of 3196	3084	msedge.exe	84
PID 3084 wrote to memory of 1884	3084	msedge.exe	85
PID 3084 wrote to memory of 1884	3084	msedge.exe	85
PID 3084 wrote to memory of 2484	3084	msedge.exe	86
PID 3084 wrote to memory of 2484	3084	msedge.exe	86
PID 3084 wrote to memory of 5016	3084	msedge.exe	87
PID 3084 wrote to memory of 2484	3084	msedge.exe	86
PID 3084 wrote to memory of 5016	3084	msedge.exe	87
PID 3084 wrote to memory of 5016	3084	msedge.exe	87
PID 3084 wrote to memory of 4308	3084	msedge.exe	88
PID 3084 wrote to memory of 4896	3084	msedge.exe	89
PID 3084 wrote to memory of 4308	3084	msedge.exe	88
PID 3084 wrote to memory of 4308	3084	msedge.exe	88
PID 3084 wrote to memory of 4896	3084	msedge.exe	89
PID 3084 wrote to memory of 4896	3084	msedge.exe	89
PID 3084 wrote to memory of 1204	3084	msedge.exe	91
PID 3084 wrote to memory of 1204	3084	msedge.exe	91
PID 3084 wrote to memory of 1204	3084	msedge.exe	91
PID 3084 wrote to memory of 4332	3084	msedge.exe	90
PID 3084 wrote to memory of 4332	3084	msedge.exe	90
PID 3084 wrote to memory of 4332	3084	msedge.exe	90
PID 3084 wrote to memory of 2860	3084	msedge.exe	94
PID 3084 wrote to memory of 4604	3084	msedge.exe	95
PID 3084 wrote to memory of 2860	3084	msedge.exe	94
PID 3084 wrote to memory of 4604	3084	msedge.exe	95
PID 3084 wrote to memory of 4968	3084	msedge.exe	97
PID 3084 wrote to memory of 4136	3084	msedge.exe	98
PID 4968 wrote to memory of 5048	4968	msedge.exe	99
PID 3084 wrote to memory of 1744	3084	msedge.exe	100
PID 3084 wrote to memory of 1744	3084	msedge.exe	100
PID 3084 wrote to memory of 1744	3084	msedge.exe	100
PID 3084 wrote to memory of 2440	3084	msedge.exe	101
PID 3084 wrote to memory of 3184	3084	msedge.exe	102
PID 3084 wrote to memory of 3036	3084	msedge.exe	103
PID 3084 wrote to memory of 4568	3084	msedge.exe	104
PID 3084 wrote to memory of 4568	3084	msedge.exe	104
PID 3084 wrote to memory of 4568	3084	msedge.exe	104
PID 3084 wrote to memory of 2240	3084	msedge.exe	105
PID 3084 wrote to memory of 2240	3084	msedge.exe	105
PID 3084 wrote to memory of 2240	3084	msedge.exe	105
PID 3084 wrote to memory of 2528	3084	msedge.exe	106
PID 3084 wrote to memory of 2528	3084	msedge.exe	106
PID 3084 wrote to memory of 4036	3084	msedge.exe	108
PID 3084 wrote to memory of 4036	3084	msedge.exe	108
PID 3084 wrote to memory of 4036	3084	msedge.exe	108
PID 3084 wrote to memory of 4148	3084	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ping-nae.ds.on.epicgames.com
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa2e93c188,0x7ffa2e93c194,0x7ffa2e93c1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,4914886025022107298,1095561080405810777,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,50157150560801423,2230541251941498994,262144 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1617143545231447618,7610856142509544963,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:13
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1738602352467533417,13248140342191175272,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14265605587097684276,12779517593390736104,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,4384253568249955365,3057656051854872689,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,1456168509968014589,16927974315933462641,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:9
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4140,i,15669628390201375908,2919198532855615704,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4168,i,8031435555772623177,13422643734050169004,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,13854657957168248635,521275986386821613,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,17291858557242717205,3914628108314330331,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3926510329840644383,571512689133722282,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,17621082097984711083,8040407707540871640,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3926510329840644383,571512689133722282,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6228,i,3272625718357904797,6210921385461729947,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,6297403686940482590,3236781843795567658,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10675434843934253310,2265323741881906290,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,8093317023389512584,4560270828642687546,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3740,i,5335818928645291026,13652771476917002447,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4996,i,10111870484680690869,2696817115143420479,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,2819304719717093472,9936602165224708960,524288 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6300,i,9955004346888940849,13214148892948010794,2097152 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4928,i,6734412794862384702,12293836029805851393,262144 --field-trial-handle=2176,i,12244463640207977479,449709892262080246,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f73cebe-d9e5-469e-ab21-28d40e042108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f73cebe-d9e5-469e-ab21-28d40e042108.tmp
Size 8KB
SHA256 ac94c6cb5b11247d61f63aa73edfd814653251d161c6c222676ba6449927d4be
MD5 f9c3729a3a79c02e2d71cef9b5316d68
SHA1 005d79a71a6659211fd26e69a42c7d28853047c6
SHA512 e8ea37c25b44d9273a41d1abdbb17a299db5e46dc2c6785daa461bded9c293c283101ace58714a0d467ed0a58536f02f30d3923150213d77e1106e22a7349471
SSDEEP 192:7GNB6fNNQmiUyqzHyPL/GPTkmVV7qhJWU6:7GNB61LRzSPL/AUDWU6
TLSH
T1BD02EA34ACB8787B8DE2AE49F5473B175FA4212BDAD52F94C6E81B1C00D729C2347832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12e7cbb941c3023db4f822d1f2c98fb0cae07852284cb119a6496a1e413ee6a7
MD5 a74fd0ddefaee0626444fd4411e7730b
SHA1 4aa4e89cdd69b07ad1923a1b08a8faeabbbb0e9c
SHA512 ac7baf622680c4c54c4fd586e6b67ce23fdd94601e095e716107034cc30a8ed15991c47d07144f6775f968126b0a883f9b2b5a0cd9ec5a094dab6e6c634bc2e2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T1CAB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0b5154bc0cd72312495ad7675165998c337229deed6c0fb90dce7da2599b96c6
MD5 4f5271169f95a64ff0746ea09644f07e
SHA1 4a7dc45f3f5e4a27ca4f286b91611700b3679f6f
SHA512 d88add1abcbfa5d554a406df8851c1772a08da696ae895c571f0b3edf819b20dec2bba69cd311ac33a554e7816c9cc48dc03b7a15ae76454bc8c79860dbb4f60
TLSH
T18E616E21C72EB7F0F36008B1B2C6A10C3275B0DE396B0E2971D458FDA607B1ED2A651C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7d2044a143ce0b4929d2e035f32b9d83d9e739120f48d4015b9d67583d5be20c
MD5 cf6c286550fda901ddeba177a46d0920
SHA1 28b404d8462045143517fd19eae87eb4a695f435
SHA512 77dc2ecf207e15b33493ef689fe14eea619a6e7cf25a20c982c59d3b32dcf1664c0c28205a581592002398bb75022fc9d8809f7611634b08d8d038df449103a2
TLSH
T11E11BDF3C3E5856E89011AF05A24AE2BDE1C0602422C3D2985D4FF2B93F3479D00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dc5fc95b7e97e87cc6ed0ca12831e81db253b3c7ee42efcb722b8ea55206a232
MD5 30eb886fcbc390b0261e09eb4b93b885
SHA1 04f93b3425f3eb3c64b54557452b1f7a77bc2de6
SHA512 2db15f84ba8476f768e2bec9de02cfe2cba525be68cf273c6487fef97300144cef7596b5d6dcc6d30b54421620945dc353f59dcc2cd6d2b869bff36789453e86
SSDEEP 192:sxZRRlyM/jK1Ml8UQyFQ/fTsmHy8IdpQh/qy6+WNGY05qcR+Ig5RJ:sxZR1q4Q/fTsmHylA/2G5GV
TLSH
T1E352E815AA346977CCDBD20DF651BF53D6F41572A2900E48AAFCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3f0856e365a24d16257aad2c4279eb265fea0a5c182b09cb1ffe5c44c290e219
MD5 ac549109776d6de45e866a2d2be584a1
SHA1 d105af00f82757e2b8dad5feab9c3a19f2af5b0b
SHA512 a188012c504b96665f5f315efb8a24c7241aecafed6b4ded676dd05cd2694a2ecc0bfc646e0a0c7f54a345ad03d22dcaddd29e83d65b7c5e955073706a12e9c2
SSDEEP 192:sxZRRlyM/jK1Ml8MFQ/fTsQH/3IdpM/qG6+WNGY05rnG+IgrJ:sxZR1dQ/fTsQH/YM/CG5H9
TLSH
T16D42F8116B34A977CCDBD209F655BF53C6F90572A2900E48AAFCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 10be0ccc10065ae3d1f7b4743429fcd32823d8f0ece7feb9bb8a396b8d0b2944
MD5 c7eff6a5fe597f8a0bfa7c3bf8bc5d64
SHA1 941935ac51008e2b4853461f35059b12e82c652d
SHA512 f8544ad3d040525e532ad808067d406a6c506160ba77cdd23262d30cd0294b953d3cb44e9f2b3e3666f6f87ded170a9169eeab5b0f697a1f093e6f589e1ba154
SSDEEP 768:WZzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hp1ro0n:WZzXl8pZ221WRmsYQL0u1jaKu/Lpd8hp
TLSH
T158E20A3F244CCB7E4F844E9CEC266F966ED802CBA6984D5447FA894C03C67DB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ff38e42be0abb7a099c4cc1ae1d6b8369f3a15d1ecf06e0cfed77be0d565a357
MD5 dcd85553386d762c8a24e7715e44790b
SHA1 0c139d8e9761ec9c3aa35df4c448022b0bd9bad7
SHA512 7d69aba8bc470e927e8e2b5c4794c703b9af90a008178d1f6320fac22cdc67cd49ef8b253cf8c590df65b3bf76fcdcd8123d23c8f71fce335e7c16e70828b847
SSDEEP 48:Ke1qJl/7nk37MPIMtkKhBpHkdF06s/F5y5qI/KjiYnyRIInKd2c4:KUOkKjCOaqUKjiSiIgKd2z
TLSH
T15D91158570BE02A63C7E255CC3A597268A4173A37255ED3B3B9C04B60E67E124DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0663b875f5cb59b9e65e484a2cc22704d7506d877469ebeccad72a01e01ee610
MD5 cac3d7cab6d81244cb4847e3dc0bb63f
SHA1 fa5e3dce5f26f8bb6060dd38f9635f3abf1569fd
SHA512 5a7a36968339e5ddec684b9f672e8e52fb13c3a0916e1439622e0e44e9ebec1b5898a7439c5120f5e5c09f8473206aba8ec38c24ce6300a769bc5e56eaa588e7
SSDEEP 384:2ZcIN8Nqrw/HlHERGwfK/+jYoXtwnTKwBODNZOCNWOPa:kNAHl+C/AftwnewBKZOsWOPa
TLSH
T17D929E716C786C3B4DE6A649F84732074EB89163E6C82FA892EDBF1C00D62DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3e9bcc89364e0606f3319970070fc962ee94f5af4709a64baecf51fc9e712d79
MD5 bfa6a63d57d72e5cff2f99fecf9ee249
SHA1 9e8b6f433d15f3391d989f9d6b6365056d9891e0
SHA512 1d4217335a3c0ec089612fb8de100ccbe02649cf31e0a4a37f5fdde4b1b88373cc562c9ffe0b5a03a2b7445286517c15a991bf8965435c117a39ac9d16e2e84f
SSDEEP 384:qF4ZcIs8Ny8TUNTUlIliw/HlHERGwfK/+jYoLZwnTKwBODNZOCNWOPa:qFGsLwgdHl+C/AjZwnewBKZOsWOPa
TLSH
T1A0A27D735CA8983F9DE69A49F94A32078EB45163E6D86FA4E3DDAF1C00D61DC1307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ec4e85362700fd966c95bab6a63dbd762e268b2b55aa74319e84ebc0eb867c63
MD5 b91f89985fcd1b826ed0ef68ae7de324
SHA1 53f2e8651ad449bf8b8cfc2d5edd67e9a1e5fb9d
SHA512 5201393f2d17d316e151f44bf37b76027b5119504a19b3209c60c11f8f56bc28aeea013557997050ac22bf6af0b3f5b21c9d6d289688b4c22ae53abc600ac185
SSDEEP 384:8ZcIN8Nq3w/HlHERGwfK/+jYoXtwnTKwBODNZOCNWOPa:qNQHl+C/AftwnewBKZOsWOPa
TLSH
T10D928E716C786C3B5DE6A649F84732075EB89163E6C82FA892EDAB1C04D62DC1317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad6e5da7a4a9387d164725333cbdd78cbf67a0dd1234d323550c1240439e4697
MD5 8c069d701a537c5790ed812adcbeb25f
SHA1 53fafd517d79339eba51d01d41c4aa9469de2770
SHA512 12a378c839a8bcda1b18a5dfc356140aa80ac7f0f1b9180c51d50b9a031035d90340cffce47952a69324a1d9457934e149886aabf3a791a4f640d3025dff58ed
SSDEEP 384:0ZcIN8Nqiw/HlHERGwfK/+jYoXtwnTKwBODNZOCNWOPa:yNxHl+C/AftwnewBKZOsWOPa
TLSH
T118929E716C786C3B4DE7A549F94732075EB89163E6C82FA896EDAF1C04D62DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfec57b7a6d5bc0056a956aba7d18bc1389646fd8b9f953ab30da7c47d4a4686
MD5 5add52e7e18e684a07ea76c2f86f3cfd
SHA1 2d3108af039d0c8a2da5021298e846a2c2b4d333
SHA512 2e87b1b44e9920029ace420c1528e2e73da8366cd6b50d7f921a2cfbbbc5bfb0e442c71888420e41a123faefdb9c933f5732f2a6779b127203216ccfdc75ee05
SSDEEP 192:1GN76fNdQmiUyLSy9L/GPTkmTF1PwogcV3ZOqVyrU6:1GN761bq39L/+jYoVLwU6
TLSH
T13D120831B8A8BC3F4DA29595F48736175E645217DBC92F94C6EC2B1C05DB2AC2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c2143ed-90d2-4577-8ac0-b66020db29e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c2143ed-90d2-4577-8ac0-b66020db29e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download