hxxp://www[.]ezbustoys[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.ezbustoys.com
Sample260809-j5t3lsxtft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307369423173506"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{974369D4-2D74-4F84-97BE-A2845AE35D03}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4616	4504	msedge.exe	85
PID 4504 wrote to memory of 632	4504	msedge.exe	86
PID 4504 wrote to memory of 4836	4504	msedge.exe	87
PID 4504 wrote to memory of 4836	4504	msedge.exe	87
PID 4504 wrote to memory of 4836	4504	msedge.exe	87
PID 4504 wrote to memory of 1144	4504	msedge.exe	88
PID 4504 wrote to memory of 1144	4504	msedge.exe	88
PID 4504 wrote to memory of 3632	4504	msedge.exe	89
PID 4504 wrote to memory of 4552	4504	msedge.exe	90
PID 4504 wrote to memory of 3632	4504	msedge.exe	89
PID 4504 wrote to memory of 3632	4504	msedge.exe	89
PID 4504 wrote to memory of 4552	4504	msedge.exe	90
PID 4504 wrote to memory of 4552	4504	msedge.exe	90
PID 4504 wrote to memory of 3892	4504	msedge.exe	91
PID 4504 wrote to memory of 3892	4504	msedge.exe	91
PID 4504 wrote to memory of 3892	4504	msedge.exe	91
PID 4504 wrote to memory of 4896	4504	msedge.exe	92
PID 4504 wrote to memory of 4896	4504	msedge.exe	92
PID 4504 wrote to memory of 4896	4504	msedge.exe	92
PID 4504 wrote to memory of 2512	4504	msedge.exe	96
PID 4504 wrote to memory of 2512	4504	msedge.exe	96
PID 4504 wrote to memory of 4600	4504	msedge.exe	97
PID 4504 wrote to memory of 4600	4504	msedge.exe	97
PID 4504 wrote to memory of 3124	4504	msedge.exe	100
PID 4504 wrote to memory of 4920	4504	msedge.exe	102
PID 4504 wrote to memory of 4920	4504	msedge.exe	102
PID 4504 wrote to memory of 4920	4504	msedge.exe	102
PID 4504 wrote to memory of 2016	4504	msedge.exe	103
PID 4504 wrote to memory of 2016	4504	msedge.exe	103
PID 4504 wrote to memory of 2016	4504	msedge.exe	103
PID 4504 wrote to memory of 4280	4504	msedge.exe	106
PID 4504 wrote to memory of 4280	4504	msedge.exe	106
PID 4504 wrote to memory of 4280	4504	msedge.exe	106
PID 4504 wrote to memory of 4968	4504	msedge.exe	110
PID 4504 wrote to memory of 2332	4504	msedge.exe	111
PID 4504 wrote to memory of 2172	4504	msedge.exe	112
PID 4504 wrote to memory of 3308	4504	msedge.exe	120
PID 4504 wrote to memory of 3308	4504	msedge.exe	120
PID 4504 wrote to memory of 5020	4504	msedge.exe	122
PID 4504 wrote to memory of 5020	4504	msedge.exe	122
PID 4504 wrote to memory of 5020	4504	msedge.exe	122
PID 4504 wrote to memory of 2528	4504	msedge.exe	124
PID 4504 wrote to memory of 2528	4504	msedge.exe	124
PID 4504 wrote to memory of 4332	4504	msedge.exe	125
PID 4504 wrote to memory of 1984	4504	msedge.exe	126
PID 4504 wrote to memory of 1984	4504	msedge.exe	126
PID 4504 wrote to memory of 1984	4504	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.ezbustoys.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,17315773103104471651,15620478681589615021,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5632049113579394010,4949877725568481903,262144 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,13501716450015187373,10999095111630214168,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,17576383213948284401,2031859132777901036,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,2769122166248093802,304901367545700394,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,11784963765075221796,18223461888595738585,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,8122923367795060138,1930455652768147574,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,18258312641649970051,6755625932439354729,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,18170999958208985991,7907903548132017443,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4347295462233149679,7236225509860911727,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4347295462233149679,7236225509860911727,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6164,i,16972060623320553980,17604863255706675887,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3580,i,296186781279581010,3323946590265627595,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6424,i,8435937470098214764,15231469713545285113,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,2727003474328777714,14772868397346914263,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,703644879653853696,3137666845139760937,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8837301719273636814,4431914642975478838,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,11635464867276539694,4353351490716582770,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5816,i,16357047323199816007,5278516453849915817,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,15216572503392539232,1670882652477457781,524288 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6112,i,837622315548716847,13761469053949865801,262144 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5156,i,17811749485242085791,8821971835594853456,2097152 --field-trial-handle=2300,i,17559326441522350985,2265966871080239713,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6a00f9cf3d49127ddc773737da17f70effeba44fe183833a5f30da26d78ee53
MD5 1f24910ce2167e6d478de1d069f00aa7
SHA1 1f0845a8bdf531c1aa6b9ae4046f4f3bf057f6d4
SHA512 d8a55c43efbad5bfe5acd60f4dc524c55fec278399cd0ed3586cef2bda13ba6baef7888cb05c2bc755720851988a13a9e99ba6db6a83301835a9052d1607b0ab
TLSH
T12671433923108058E3220872DFD916EB763685E7FCAB3E8111F2BC749521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589352.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589352.TMP
Size 3KB
SHA256 29616a52a262cace077fea3dd8c9aa9d82203675ca47ee99c5f6e5d1e06846e9
MD5 844b4816c3c0836dd45ffa6b442faebb
SHA1 d5539168204a16fcec77c1e65b15328569cf5592
SHA512 682dd213ac2d671e83ba2c7f4069907fe7de2b0147657a3a6831700f761eb628b3b33d6319e44215f6d4820d1a2a83e4ead0b46b83248e013ea9c1bf9f33ad08
TLSH
T15A71333923518058E3220872DFD916EB763685E7FCAB3E8111F2BC74A521F728666B5C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 694B
SHA256 c7f9f47e1c587a619463c58ad208cd6898b137d0f0b1d57873bbe396d5cc0f8b
MD5 07b2a0c5852ead76e3645c4999496596
SHA1 b7e96579b4460af1a15be5f0dbf39a7e20d20f2b
SHA512 f2c5af1942fe4b9d42d3c758d0000febc9bec6b2c868f6e669d2da2b2bd67357617d56fcab7259b5ba8a56bff4fb8806a08a91b3a923b86fc3713fd0187c8ef3
TLSH
T19B017BB3C3D595AE890512F05A24AE1BDE2E0506422C7D29C6D4FF6793E3065D002AAB
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4b12a05f676b9b85227b5072eb923ce5b85dce97352222006c76723a89bff9f4
MD5 b572a86da2e6fdb61333eb5085017003
SHA1 c7d321051c66e83ec9be65a9ed121055cc5ce30b
SHA512 193e4d86b69e5f583ad26841005d6c9fae314263915b4b11234b51bed1f11855f15aa74ca46f5accd39a2fa384e631f0242e1e9bca67f61731c5fc6fea805630
SSDEEP 192:sxZKlkI/f1sSRd7VeIdpFzHgK6+WNGYvrwjj9IgrJ:sxZKuI/f1sSRdZBHsGdN9
TLSH
T1B122A8526E28A47B8CC7D21DBA15BF53E6F9503191D11E58EAFC961C04E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0dc010af61d192080f382d6b404ebf14cffd49b569c6e6b2777e735f7f245ca1
MD5 bc49f3acafe0f43f8c2c59f8c84fee65
SHA1 c7c698719d6ddce03242d48ec1ce711d200eecc2
SHA512 05e79b105a069837cd6c9cc5df3b27c2f4ee8b92724c64444a9116e2aefe129b95fc82f4ecaa95ddcd1a3dbc4dfb9873e5bafc913cecb02a9542fb8f79069447
SSDEEP 192:sxZKlkI/f1swRd7VeIdpFzHgS6+WNoMIU/YvNowjj9Ig50J:sxZKuI/f1swRdZBH07/6N+
TLSH
T1A622C6526E38A47B8CCBD219BA15BB53E6F9503191911E58EAFC9A1C04E77CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 843e64f950940074f2d43b58c2debbf99b08f7fad4689ec02dc688f4e1790100
MD5 9beaa131592c4110860847cfd6df927b
SHA1 db4b0147cde1739137a6b2667cf1ac17235ccc15
SHA512 0cbdf42a2ed28bc0d018d81ee4de7c9ee4a700f9452f1b9fb407888fa272f3017fc5b144215ea64c5b9463620d0af2c8ddca82061bb088c735cf21bad7885183
SSDEEP 192:sxZKlkI/f1sw+d7VeIdpFjzHgy6+WNoMIU/YvNImYjj9Ig5WJ:sxZKuI/f1sw+dZxHE7/nxNs
TLSH
T16332D8526E28687B8CC7D21DBB55BF53E6F5503291911E58EAFC9A1C04E7BCE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 198fbfb765e239125764e58176e1f5f1ae334fe403a3a5a545af5b9d7aa2211a
MD5 6529a0d5e0d591c060a42680f8458311
SHA1 67398bac9a287f94a0bf11f851d088cb94413200
SHA512 3ca2491101cfa1e4abb8beb622137603c16c151733d3db77850e91997f4f624e474a49ba0dc34ccb09a31cac838649b67988efa1e0d0b06494a20043834aa3e1
SSDEEP 768:eZee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbWrof:eZee3rxWvhffnu1jatcL88btf
TLSH
T116C2FA2B640CCB7E5F800EADDC5A6F977FA802C7A7588D4087F9994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 6c224740ec73770840358155ba9a966cbb4fb3dacefe8cd84ffc88a3b3a405b9
MD5 71e976444d9f2334167b3f965cf85a99
SHA1 b6c5a6cc181928c67bcb95564a264be684cf23ca
SHA512 5b7d874a7acbf64b1e5f1d53c40ca2bb3821206b2491192f5c4d5b0802dc3721d3cbc6c3995f6b7174e8a54c29d7f3f391dddfc3b6a8936ddabc9dfb96c2e429
TLSH
T120211080A3FF1094BECAFA49C10D5507F0A13E67271D5832B31D85F44F89C680B2EE69
MD5 SHA1 SHA512 TLSH

Submit Download

5adb3d7e-0dc5-4ba7-897c-322a932df25a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5adb3d7e-0dc5-4ba7-897c-322a932df25a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4b51509423efd590ac086924770b522a7f3180cd907e310e7e91d66a2a980891
MD5 3156aeea60a4303f56adba97b1993aac
SHA1 6aa28d91b607d3bc3e571ece622add313b836404
SHA512 7bff3c7b2908d87812375b2526d7ae7c63797ae5cbf1c4a722f050bd2911538d9a1f587aac7ff21372e9aa5d6f3b61f1bdedc9ddd7745cbd9540936bf26ce50e
SSDEEP 192:ukLsNzEQ+6AxSM7pBYQmiU1qCYa4MTbt+FdLjv3mhQc8z1tqnQnx:RsNzEp6AJ7v4YLFDd/DdSQnx
TLSH
T1264229316C78AC37A9B3E185F44A36135EB4816B9AC42F58E6DD6F1C01DB3AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1f764f5a437b25f04582294bbad9cadd42f78830fe25d004fe1a35fe8e42c40e
MD5 04a7e832a59a50d5f5d98796fc5890ce
SHA1 b73536d898e1670aa2ef34fd051944605819f895
SHA512 8a5277c26366c4f0fd495f60509dc93ad44ea2737b44395f8ed7c558ae31f96bed45c9e55ffabb2970473981dfa0e36af8a8136ebb5f5bda90d9a24c6cf6b272
SSDEEP 192:ueLsNzFQ+6AxSM7pBYQmiU1qCYa4MTbt+FdLjv3mhQc8z1tqnQnx:fsNzFp6AJ7v4YLFDd/DdSQnx
TLSH
T169422A316C78AC37A9B3E145F44A36135EB4806B9AC42F58E6ED6F1D00DB3AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 b3a4ddd905fa3432e794b342abc4b04173d02b39ab77d92b3d21bd1148132693
MD5 da9768df612df0cd22bbaca57545e8a0
SHA1 85d14b2c9ae2191149567826e5da4972ae996bed
SHA512 9ca6152ad4d50671d4e939089801358d68e67dd6df9ca7070d22a7cf96c2c00a7086f057f4d5343bdf1e657700ac99b662487b8df8b2ce8fea17fcb6320316bb
SSDEEP 384:NiFpzsNa8TUNTUlIlFp6AJ7v4YLFDd/DxSQnx:EFJVwgpJlZlddnx
TLSH
T1F8621A325C58993BADB7AA85F54A32139EF4406BC984AE64F7DC6E1C00DB29C130BD55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1da34157d807a8740ed338a058d38da9f588d74e11ecf3b04bc71a92d1e9374
MD5 0710e144995163821db5f55a25832505
SHA1 9301bfe38c1cfafec8f7516b63c9c7bd9b03b865
SHA512 4a40a17e68fd0ba292a5ac9025472ac431322d476c19e69c28a5bc25a3cc4c563210f829c91d85fff4196498dea44753eb82d7b9d10999bf47db10f2cbc5171b
SSDEEP 192:lONe6vMtPQmiUyzTThTbt+FdLjv3mR847/ajU/u:lONe6UtR8TMd/+iU/u
TLSH
T12602FA35AC786C6BAAB3BD45F48A27171FF4117FA9912B54EAD82F1C00D775C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 a034dd42944ed25487468d8814bb2e8ae9bfd022aeeab1f2c877220e460a16d3
MD5 e48229951c238d32bd25d0b5f8234648
SHA1 4ecd8b56c1a29e26b52575f9e4b11260bf328511
SHA512 63332fb812085a645600e6b1ae89e1d5b1801d229a9c3fcccf70d94395ae1449a1272c25a24ced56bfeb4f02ae331b1854c09d95c5c4d1cd5d7830474585ba60
SSDEEP 384:NiFpzsNN8TUNTUlIlFp6AJ7v4YLFDd/DUrSQnx:EFJ4wgpJlZlordnx
TLSH
T18C621A325C58D93BADB7AA85F54A32139EF4407BC984AE64F7DD6E1C00DB2AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 841614256034b23fdcee249fcd7c99640727abe2adea028e65d09ba2de02b42f
MD5 38971c668cad31b9bfb66b04c8a3f7e9
SHA1 967deb9d17531f656d1e63ff6ad0cd58d5b757e6
SHA512 6ba46c5a372c0e1792caea47c68dcf22507a9fcf55651b704c4230829ea8a684d5d0425a09bae6f0409300f6ad25b1dc772765d9a55d42c9ca9a4652a0aca884
SSDEEP 192:GONG6vMnPQmiUyWRT3hTbt+FdLjv3mhQO80ItqnQU/u:GONG6UnRFJ3Md/DHSQU/u
TLSH
T194120A31AC64AC6B6EA3B585F48B36175EA4813BDAC46F54EADC3F2C01DB76C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

347fbd27-c74d-439a-8cc1-7ade38f7a561.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\347fbd27-c74d-439a-8cc1-7ade38f7a561.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e83e38671e7fb9500c8c0012fa63d7729f3745468e7f730af968e9b7e2b17d98
MD5 b15533ed66c37763806b1dc978b24d15
SHA1 6c0c77ec56a47d53a80577e0ed2c02c140effbc9
SHA512 900a38bb85bf28c9d3ea34a8f9661ce8bbfc25dfa434983e48e43e1f81da418b2f685068c303f54ca176f9e00fdc53da6bf4341add6345f277ffd1b201d851c8
TLSH
T19B411A5CB6E91154B3B76F5A9BF6A86D487A78372E06C49E10010E4F4A63B41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download