hxxp://entersistealporete23232[.]iceiy[.]com/

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
300s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://entersistealporete23232.iceiy.com/
Sample260810-vbprksdk91

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308541692579325"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{78786D46-DF0B-4F00-A410-9E23B4431B41}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4524	1768	msedge.exe	87
PID 1768 wrote to memory of 1044	1768	msedge.exe	88
PID 1768 wrote to memory of 4596	1768	msedge.exe	90
PID 1768 wrote to memory of 2592	1768	msedge.exe	89
PID 1768 wrote to memory of 4596	1768	msedge.exe	90
PID 1768 wrote to memory of 4596	1768	msedge.exe	90
PID 1768 wrote to memory of 2592	1768	msedge.exe	89
PID 1768 wrote to memory of 2616	1768	msedge.exe	91
PID 1768 wrote to memory of 3380	1768	msedge.exe	92
PID 1768 wrote to memory of 2616	1768	msedge.exe	91
PID 1768 wrote to memory of 2616	1768	msedge.exe	91
PID 1768 wrote to memory of 3380	1768	msedge.exe	92
PID 1768 wrote to memory of 3380	1768	msedge.exe	92
PID 1768 wrote to memory of 3912	1768	msedge.exe	94
PID 1768 wrote to memory of 3912	1768	msedge.exe	94
PID 1768 wrote to memory of 3912	1768	msedge.exe	94
PID 1768 wrote to memory of 1456	1768	msedge.exe	95
PID 1768 wrote to memory of 1456	1768	msedge.exe	95
PID 1768 wrote to memory of 1456	1768	msedge.exe	95
PID 1768 wrote to memory of 2852	1768	msedge.exe	97
PID 1768 wrote to memory of 2852	1768	msedge.exe	97
PID 1768 wrote to memory of 2852	1768	msedge.exe	97
PID 1768 wrote to memory of 948	1768	msedge.exe	98
PID 1768 wrote to memory of 948	1768	msedge.exe	98
PID 1768 wrote to memory of 948	1768	msedge.exe	98
PID 1768 wrote to memory of 4800	1768	msedge.exe	101
PID 1768 wrote to memory of 3448	1768	msedge.exe	102
PID 1768 wrote to memory of 4800	1768	msedge.exe	101
PID 1768 wrote to memory of 3448	1768	msedge.exe	102
PID 1768 wrote to memory of 4448	1768	msedge.exe	104
PID 1768 wrote to memory of 2916	1768	msedge.exe	113
PID 1768 wrote to memory of 4012	1768	msedge.exe	114
PID 1768 wrote to memory of 4816	1768	msedge.exe	115
PID 1768 wrote to memory of 3028	1768	msedge.exe	117
PID 1768 wrote to memory of 3028	1768	msedge.exe	117
PID 1768 wrote to memory of 4812	1768	msedge.exe	118
PID 1768 wrote to memory of 4428	1768	msedge.exe	119
PID 1768 wrote to memory of 4392	1768	msedge.exe	120
PID 1768 wrote to memory of 4428	1768	msedge.exe	119
PID 1768 wrote to memory of 4392	1768	msedge.exe	120
PID 1768 wrote to memory of 1772	1768	msedge.exe	121
PID 1768 wrote to memory of 1772	1768	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://entersistealporete23232.iceiy.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff807ddc188,0x7ff807ddc194,0x7ff807ddc1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,134990803568736233,15906552130746740918,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,3297356770062265472,7547264224247641964,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,801531803301618374,15455182776325261919,262144 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9604720134621011623,13658115088323136980,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12526223098874247653,164466321347764547,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8635129426687425721,5827785443630929823,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,9433371993091484128,16590485649491716274,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3428,i,15914707984439046669,9739860334409337681,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5204,i,13387450510874920465,7541449522174247132,2097152 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,852844004488468629,14819910615875179485,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,10280915124491671410,9784211201237830056,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,2475727539445332907,6772744168781029031,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,2475727539445332907,6772744168781029031,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4707049473458378153,14337500617774878060,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,8477069484362146112,1338046070847696145,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,10748129891150102590,3097071798249168928,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,7834375116300774862,15473685977382289976,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6360,i,17516673932729191108,3794317864346335416,262144 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,2011415762797780721,8824557073263225688,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,3363309012848055052,17643559056816452143,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1060,i,15590570317613720734,11737937478732241763,524288 --field-trial-handle=2692,i,9631943781796516229,15910253352306988956,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:8
  2⤵
  PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c04a5bab84e2d164081bb6d4d605f6022fd2bad8cc07ca60809c06d35e09ed6
MD5 33d3a5856eec0915ab76af18d1233229
SHA1 732f6b127bde8dbcbdebf8a0bbbfa0717087fc32
SHA512 dd826e5edcaa873ccd771aa34db901e18103515278d6378d2e1493d0c841200bd9f519915c5b9397c8310bf9cfd8d1af3630eebf3ffdb62d586930b61a1316ac
TLSH
T166717209825308B2F3959A3DCCF2551B7878C7060A5B1F76CE10BF3DFD05B11A61AC05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ae7b.TMP
Size 3KB
SHA256 0fb52fcaf6029e535458fe4580f29136983155cbbfeb31f0d87c4549ac43467f
MD5 3787718f5bf941ca3a4ba4d66c1f1c3e
SHA1 83193277af27d27d1ea1effe1af39ab648b72b0b
SHA512 457c35e5a9905997757321881729513374de2772ac162fb118e6ccff13b0721a730b2b0a705372f9f21960c9bfc1c8fc3ef00bd0e69d2194418152078ad2394a
TLSH
T1B4716F09829308B2F3829A3DDDF2551B7878C74A0A5B1F72CC10BF3DFD05B11AA2AC05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5825c9b61caa68d6d0478569c88d2e05a08b291cbe0e752a2a1f0fcde9ee62ff
MD5 2e7d87f81c12015c00f8d4c97cb1f50b
SHA1 42d619ea98ef5480a7ec43a05646e28654eddee8
SHA512 a0c8b5b598a7b629d763d244a96250cea44ab2ae531f29a6b1cd90110c80bf1912604c2c487e51ab99bb4bebbbc9def3aea6d9113c3513a196007897de6238e7
TLSH
T117519EFAD3D8956DC91152F1AA146D27CE1C0A19B75C3D0ACAD8BF5FA3F2470E10098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e29a208d0dd948ece94380fd6dfd3ffc809701c6a3741e86ab7254a929f1a293
MD5 e9bd8dbdc43468d504afe2ffc6b48743
SHA1 adcea96d4d5e43d3d75f5f306ecc8c5bf2e0e11c
SHA512 f9891eef0acdf4e5499363c687c8c1d5b83a52046b9b7a43120df0f0f0cdfa0d25bb256a1573fcce87bfa04149c0cd6205b93f628eb628cda219a2fea3362445
SSDEEP 192:sxZaRGyM/+K1Ml8Mkx/fesIToEdpdS1HW6+WNPDB//YHMl4rzIgrJ:sxZa1Mx/fesIT/cHbB/09
TLSH
T1EE52F816AA385977CCCFD20AF941BF53D6F9146292940E54A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e56003d45d06e891253cc578226b56566db0304a74f4f966d864c62835f6c164
MD5 703aad73d8c1566d6a1e383584d8cb42
SHA1 60e8566dcaae86bace3929885f4d26f1cc174903
SHA512 a43747fc98ba8125894d45ed516a54be1074282b1527937e5cd6f5d8dd72a25e9f227f058b934cbb816f4ef7d8a2318bc8ff23fa253ca69d3743228a863ea597
SSDEEP 192:sxZaRGyM/+K1Ml8UQHkx/fesExoIdpDS1HW6+WNPDB/Qu+JYH6lv+zIg5BAJ:sxZa1qEx/fesExZGHbBoJErk
TLSH
T15E62E716AA385977CCDBD20AB9417F53D6F95472A5D40E44AAFCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dd26ca098157a2fb2a6ab93a2a62fe51f2b56c8fae024296b1a1466d555fc69f
MD5 7150d896446049867c840cf7f03b21b9
SHA1 d554fd4800503cdfd23606a54d43e8bd9019916f
SHA512 30bbcab1a11b481fc44b1e44a66ff10df5ce656e73dc9c50feeaea6a101e9fbf82be8f9615bda6a3c75fef1928202023b620aac52a8d68cd7d8a18f2ef0370d3
SSDEEP 768:HiUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1eLlPZ4REroVXa0b:HiUZYTMWvg0Pou1jaQeLZmRP3b
TLSH
T11BD20B2F280CCB7E4F844E5DEC266F867ED801CB9A984D5447EA884C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3fbdaca9c971966b6dfc3f29fe2922e714aea709392788b190a4af6a6f68d66e
MD5 ae553b99474c3d9b3726a699480c1457
SHA1 784cf4ca25b6b6c4184ee9af46b574467602c30e
SHA512 3322d040ac862b0ffaa03b254471b23dba8e0f193cccd9d4e6ac422da1beaac8b9e4b2660347ce445611cd6866f92e3b9179dd82ef266a89e14653c9fcd953db
SSDEEP 96:KA1eK2AgHWKIAWSi0KDi0+0KjKWG36K0Io:E0lPUzNx
TLSH
T1D7D1075272BA02117C7F3A4893D4976FCE42B1633018E52B7BAC01B58D26E269CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c56.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3486783c758d0a1d230d517fedee7717d1386359c2a1606ba5021f5b83383895
MD5 b516f132ac34a3baf3397f57bd668530
SHA1 9d1c6478677a7d1e89b190588448f26669b75832
SHA512 0829fea48ad0da069e4b679528ea997b7b1a2ca994fe8719cccd55c9604e75e08d1d64effa58e220b8521dc06b7ffb244f8bc7a8e993bf81882ab2593693ab39
SSDEEP 384:lZcIhsNQB3p12Q+6zX5od+d8yiXX5fUgx/FEzJ:dhn1kuO15fDi
TLSH
T10B927D31A8786C775DE7F586B84B35138EB8903B9BC86B9095FC7B1D00DA5AD030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e78cf380cd280fadd3cf3d32174d06a1e76356d102dab52992ffce839600035a
MD5 d93ce6c5977e5aeffb3e15330e9834cc
SHA1 853d748bdd095871060b88f4e6610aa5a7a73fb5
SHA512 ea07a4cd4fedbfc3a5a616cfa5ce79acb2ed7fbf9702b536be2d99cdc353b32e4aeb89e241a13ee7e5edf8402f0cac7a6bbc7a6b44019bda43df31e5ebec3f95
SSDEEP 192:yON761VWQmiUyJkgGX5Obd+j1jzoryiyR//al3EQU6:yON76W7gGX5od+d8yipqQU6
TLSH
T1AE02D836A8686CBB8EE2AE49B44737135FD4106BEA952F80D6EC1F1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d256e7357a1b294c35264ffd98abe41d842cb58db18f23ebfa115c11609a5360
MD5 bc4406e9e47dfddf546c88535371b4ec
SHA1 a854155ad98b322cce9bd1b4a7443996b1dac0e7
SHA512 8c6aa4de9b586aa67c6d08a820e8458738e634205d5b26edf701c2568b1834defe3d22980a70e320838f4172d307b57eb3163bb1272d697873eea725b0dca120
SSDEEP 192:xONZ61sWQmiUyekmGX5Obd+j1jzoryiyR+XjTDjJNqiU6:xONZ6ZgmGX5od+d8yiXXJfU6
TLSH
T1F012F832A468AC6B5DD2B595B48B36139EE8512BDF896F90D6EC2F1C00DF59C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 498183ecdae631ad6bd238a31d64b0ee4497bbd76b17223e051fbe6ef2c9a8f9
MD5 f8b7b680121c638feb1cb9737e2c9e9f
SHA1 bc3f4e451d764df51698363e73e1fc3e02724629
SHA512 8b169d33f83464add8f97882eca3b6340c955e8fcfc71c7d0131cdcecb66de3bda3aca9e17c5da7d019cd271a76c8566a7b68d0e2fbf2932c288b32e1d79130f
SSDEEP 384:eiFiZcICzsNQ8TUNTUlIlU3p12Q86zX5od+d8yiXXBfUgx/FEzJ:1FQKFwgS1muO1BfDi
TLSH
T12EA25E3398A8997B9DE7AA45F94A3113CFF95077CAC4ABA0E7EC6B1D00961DC0306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 631f213616d720ed5450baa76720dfa918b9f577f63601f0e243c75ddfb021d0
MD5 1b9390b2389c811f527b438cdbfaa2b6
SHA1 9d10782c68a9905c32eb8fe63c146ef1832ca36c
SHA512 49a417ef9007c206c29b1b58d8c7362816001458efb1eeb54e6768e88201ba4c89512273e53018dd68230a6c8d07fe68149f99f248dfa7eee2ca99ee9feb2c3a
SSDEEP 384:0ZcIhsNQU3p12Q86zX5od+d8yiXX5fUgx/FEzJ:yhI1muO15fDi
TLSH
T1C3927D31A8786C675DE7F586B84731138FB8907B9BC86B9096FCBB1D00DA59D030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef5c2672-f03d-4bc9-aae7-d01221437138.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef5c2672-f03d-4bc9-aae7-d01221437138.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c34bd8cba16f6c49eb7a638f648e7f4b586b1e91d3afca46b064bc28a6a02e9a
MD5 76bf4cd6d18046c8c9d18df900d22652
SHA1 dce16c48f57b3b4997e74eaa3db41d4d331795e2
SHA512 91b1a91720496f8b40211bfb950c98bf20b792d68b5b6a9e717aac78fc10baf5018c3ec6dd4503fb4b962e94f9347470fcdd65a16dbac43a8c1a443eae53d983
TLSH
T13B412998AAF91109B3B76F4A9BF768AD487ABC772E06D05D40110E4E0663A41CC61737
MD5 SHA1 SHA512 TLSH

Submit Download