hxxp://3[.]141[.]220[.]255

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://3.141.220.255
Sample260812-vb2fdayyav

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310269918782697"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{25C29653-8EB2-47EF-9C24-65B71C09D438}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2296	3812	msedge.exe	84
PID 3812 wrote to memory of 636	3812	msedge.exe	86
PID 3812 wrote to memory of 1840	3812	msedge.exe	87
PID 3812 wrote to memory of 1840	3812	msedge.exe	87
PID 3812 wrote to memory of 1840	3812	msedge.exe	87
PID 3812 wrote to memory of 4804	3812	msedge.exe	88
PID 3812 wrote to memory of 4804	3812	msedge.exe	88
PID 3812 wrote to memory of 2416	3812	msedge.exe	89
PID 3812 wrote to memory of 2416	3812	msedge.exe	89
PID 3812 wrote to memory of 2416	3812	msedge.exe	89
PID 3812 wrote to memory of 1320	3812	msedge.exe	90
PID 3812 wrote to memory of 1320	3812	msedge.exe	90
PID 3812 wrote to memory of 1320	3812	msedge.exe	90
PID 3812 wrote to memory of 1452	3812	msedge.exe	91
PID 3812 wrote to memory of 1720	3812	msedge.exe	92
PID 3812 wrote to memory of 1452	3812	msedge.exe	91
PID 3812 wrote to memory of 1452	3812	msedge.exe	91
PID 3812 wrote to memory of 1720	3812	msedge.exe	92
PID 3812 wrote to memory of 1720	3812	msedge.exe	92
PID 3812 wrote to memory of 4928	3812	msedge.exe	96
PID 3812 wrote to memory of 4204	3812	msedge.exe	97
PID 3812 wrote to memory of 4928	3812	msedge.exe	96
PID 3812 wrote to memory of 4204	3812	msedge.exe	97
PID 3812 wrote to memory of 3836	3812	msedge.exe	99
PID 3812 wrote to memory of 688	3812	msedge.exe	111
PID 3812 wrote to memory of 688	3812	msedge.exe	111
PID 3812 wrote to memory of 688	3812	msedge.exe	111
PID 3812 wrote to memory of 4672	3812	msedge.exe	112
PID 3812 wrote to memory of 4672	3812	msedge.exe	112
PID 3812 wrote to memory of 4672	3812	msedge.exe	112
PID 3812 wrote to memory of 4056	3812	msedge.exe	115
PID 3812 wrote to memory of 1540	3812	msedge.exe	116
PID 3812 wrote to memory of 4624	3812	msedge.exe	117
PID 3812 wrote to memory of 3840	3812	msedge.exe	118
PID 3812 wrote to memory of 3840	3812	msedge.exe	118
PID 3812 wrote to memory of 3840	3812	msedge.exe	118
PID 3812 wrote to memory of 4612	3812	msedge.exe	120
PID 3812 wrote to memory of 4612	3812	msedge.exe	120
PID 3812 wrote to memory of 3248	3812	msedge.exe	122
PID 3812 wrote to memory of 3248	3812	msedge.exe	122
PID 3812 wrote to memory of 3248	3812	msedge.exe	122
PID 3812 wrote to memory of 3520	3812	msedge.exe	123
PID 3812 wrote to memory of 3520	3812	msedge.exe	123
PID 3812 wrote to memory of 4152	3812	msedge.exe	124
PID 3812 wrote to memory of 4660	3812	msedge.exe	125
PID 3812 wrote to memory of 4660	3812	msedge.exe	125
PID 3812 wrote to memory of 4660	3812	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://3.141.220.255
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff947f6c188,0x7ff947f6c194,0x7ff947f6c1a0
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,1603100041377115131,7824296877036111383,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12184924145641562712,17290284625344148263,262144 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5826238847367239122,9051599605266494863,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13544093414148301874,17571831088107384939,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10200255350029332094,17004250110460344622,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,12236599910009583187,13096980067073822395,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8591786112282694656,17448239961701374923,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,2271820702301416528,3832870590908161646,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,1198002101798191558,14286023401376597921,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11585676345437885415,12658710209322068894,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11585676345437885415,12658710209322068894,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4500,i,3525296688430132234,8347965551947698459,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3396,i,5525033881260111586,4944199478889190259,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6256982139057522622,9244982924553092684,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,1409433329198282514,10398267650146450408,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,250140595803006501,15667910862135763619,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2144,i,8676461255246205760,18177059718091588331,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,10475534150619746385,11524458448954281677,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3688,i,11076610235505451323,11131422919948694457,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,13237955690339771123,13096900878988615664,524288 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6224,i,9262421573354539584,3782900324554712341,262144 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5512,i,4610166736897409039,132364876928027545,2097152 --field-trial-handle=2328,i,9202475440953122583,10284130102724000840,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dfd94c748e674ea9fd9501a156f36fe98a91bc30e4fbb7a050b3e07b6da87251
MD5 48d2a74b9f9b337cd4d5ba5e79dfdd84
SHA1 6ba022dce5af70c1a5595b902b4e5bce7ba7ee3e
SHA512 26bb29893c5ff0f3c85dcbf16f331db1f6ab01b4ae8d6d9c68be344cab219d9861e101be415b454fea0375470c85b7e982f35351ad4c64e248be7c2bad9702e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 731af987d28d0db2e435432cfca4859b53ba9fc61262e25cbafd8512f87357d8
MD5 34917b7462d3065569ad447081a8d5cf
SHA1 cc3f48dde837a1f0d72c5de78b8c7fe832b09cc4
SHA512 9065a88b1021b47ce14804fa954dc714928a9f8c3320c9b8c8adda9fe63caf974f67c0c600fe3097624456d6891a1a3c4f15c1137548993a085a4dc3d2050417
TLSH
T11A81D7F52A3200A0E720057D94F96E6A3A75A7EAFB0B5F5A71807C706D16FF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5876d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5876d1.TMP
Size 3KB
SHA256 0420c504863a57db7526335ef7cee4d397bbb6c95397f67e5607b84bf64356a1
MD5 171b255cec573e98226f0f15c1b0d1b9
SHA1 8e7b46b22d93699c56c5b834a98f8f539d6132e8
SHA512 cfbac56a88efd007e8cc2ee2edb1a4cf53f2819e15b716799b8f78daaabb6b129af6d4159c62c4e95fd4967d1663d3ed895679a72c19b8572683e699f419721c
TLSH
T1AA81C6F52A3200A0E720057D94F96E2A3A75A7EAFB0B5F5A31807C706D16BF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 dbe5d18786a090c2d61096ce0c6f8975c4336564634c15b314d6af85c760614c
MD5 baacd18b1fe495dfedcceedb36c5ef21
SHA1 b39b620bf7020ed778add936f411a6645ebc9c0b
SHA512 09803ea5783bebbff717658977b3b96f78c3ffe25cd6d72d15b6c5d92835546425bca7b65c18136311563d490908658a876c099359963ea9ab383b222905c4e1
TLSH
T1750140B3C3D4996ECD1156F06618AE1BCE2D0546431C7C5AC9D4AE2B93F3475E11149F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b6368e6e2ed17f08e705418bb2545f78f7b720a7796501acb02c44b2c172ad0
MD5 7c64a6ac499fe35e5f6fbbbfd5f3ffbd
SHA1 2723ada2d7076d8b80f1f7c71ba080b829dd716c
SHA512 59566a5a8164de8766102aaefd400e171182e13046d95f6052c460291f26a39e748fec79c56ec3a5da1a97c62edfcedbc8580121ea30c94cad1104cb29e97b96
SSDEEP 192:sxZPRTyM/jK1Ml8MkQM/fwWs5n6VAiIdpJHPx6+WNGYvxYjB5IgrJ:sxZPPMQM/fwWs5nvLJHKGFb9
TLSH
T1D942D7116A346977CCCBD20DFA41BF93D6F91572A2900E44A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0a46df2742713b157137a68be89b1b4bacfb87b65e324f66e3e827e5c95035c8
MD5 31c1f0939094cfa7149bc65963234c35
SHA1 08fee687e54540ab95767a6553494a171b77ea6b
SHA512 5110da91ea1ca5d088b989b8b5749c7cf0efd6498c29473ae3b2654a569fc74b0e5debbee21d7e148ae387c82babe4d372fd7b021842cf701216faabf12e1960
SSDEEP 192:sxZPRTyM/jK1Ml8UQYkQM/fwWs+mzVAiIdppUHPh6+WNGYvUPjB5Ig58pJ:sxZPPq7QM/fwWs+miLWHaGDbaT
TLSH
T17A52F815AA345977CCDBE20DFA417F93D7F5547292900E44AAFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5fe94dce55ae7ce7c91dd0d2387f780f91dc1d58c441df70e6a0edb61f032349
MD5 e6627e042e14d217cea4c98af9101db7
SHA1 c1ef0e44b5f82c51841b8cb75d83f80a66bb181e
SHA512 b7397643bdbeb9c344219fa3157b88a1cb029b6e87df81ce096eb1f704a962a82ea32cf0c24524b85ba8d377ce03888b4e9c0745289efacbf0e5d8bf5b8147eb
SSDEEP 768:ltseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppOroTJ:ltseJ3xWvhfynu1jaVcL88pFl
TLSH
T145D20B2B280CCB7E4F844E5DEC2A6F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 37b81b432da74da3245c5d26c7daf92bf33fe15d7c87508e85872b31b289855c
MD5 46b919620e02b95d6d2e68a42c50dfee
SHA1 9f0824359c9b3313799e047cddcfb0665ef2b70a
SHA512 bca6434a92ca7cef4759acdc257b8679b9e66a5bd9a3aa178ca4b6d18e72ef3fbde99591c3cd2c2157d2b9f9a61631f4badb86d1994e7942e940df02068aceab
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm0n6C6T68646y6I60:49SRkVBnTfuTq9ZdB1/+hBKnh5hS7Ivt
TLSH
T129914246353F02023CBE284CA29AAA765F4175A33554A4FF7BB844A30E66E110DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21ac3d1c-be89-4c55-b527-1d0619d1ccac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\21ac3d1c-be89-4c55-b527-1d0619d1ccac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 641766407d06691bcf4fe78cd50221bbb68c3f1a1a07bd625b6a6c1bb6e86956
MD5 c9ba1ba22cb41e106e2aa25d6e0dcaee
SHA1 1433854e650e346737ff46f1dc3ec644091e6429
SHA512 ca4c959704a4eaa279f8271f6ba1580346a258c85892d82768caf751a939fd55d1b365206c92fa6d1d89fe4f5e0b02788d0a82163dfc9a4d87cee646202d71d8
SSDEEP 192:uSm+xasuheOwQxMGsNfxQF5pM7R4SQmiU1ULK4MTq4+FdLkxdtSJrN8z1BqNCB6N:OZcIhsNfxUM7GO4VJd4xGJraCCBQ
TLSH
T16D626D71AC749C3B98A3F246F48A37134FF89067A6C45B94E6ED6F1C00ED668131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1017d330eb7204f1fd576671e672f9719826220824cdcee458bde8c6c44ccb05
MD5 2eab079975cbb807b60c57c428de1ed9
SHA1 5a30e8b2a92c9e4e5179999691093484b4acf164
SHA512 ad12d7c302e7aaeb80866a68b330ba2ac5a0aa8254fd97412f1e6ba64862e8457bac4b2d4a3c36e2341c8f391b40149934ece81fe4364bdf4446d1f79a101987
SSDEEP 384:YiFiZcIvsNB8TUNTUlIlrUM7GO4VJd4xGJrMCCBQ:jFQvkwg2M6/zhMtBQ
TLSH
T189824B729C64C93BA9A7AB45F58A36038FF48167D5C4AA94F7DD9F1C00EA1A8130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ecdfb3cdbdd7a8854068601e71f00d7a72b344575c0c9707fa9bb032f690c9d
MD5 fcbf8d559e662fd98e0692dee2a9ee55
SHA1 7c3cd0d8b084a7e12d71b329ea9ebd7b2c411c4c
SHA512 82dbed247c37f2f35d7c3eeda4ca8cf86041b2d3fdd0e5819372d5bc7d0a62a2fdce1a8173e93e41ee7abbb2ba3d275763873627a322f61a440abc4f2e9868d3
SSDEEP 192:lON7Zh6vMtPQmiUynUThTq4+FdLkxw847S64U/u:lON7D6UtRzTSd4xKUU/u
TLSH
T1C402F935AC786C7BAAA3AE46F48A37171FE4117FA5D05B54EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4c1912b3544e9460e65adeed6900dd73bcc8ef2922c5956fd8b078a5b976f532
MD5 d3abcf356fa078179b28e0f5cc282c75
SHA1 a944c9de5833fc7afcd9de01a392b1948b0c3185
SHA512 6f64ef3c293d25ec004503494b9901da85cbf42fcc4ba7732f5e7b4699a0341e9e6e52447137ecff966919245df937999a8f3274ad5fa85a15083ae4f8f94961
SSDEEP 192:u5m+xasuheOwQxMGsNfrQF5pM7R4SQmiU1ULK4MTq4+FdLkxdtSJrN8z1BqNCB6N:VZcIhsNfrUM7GO4VJd4xGJraCCBQ
TLSH
T151627E71AC349C3B98A3F246F48A37135FF8D127A6C45B94E6EDAF1D00ED668131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 712c0b456896ed736ffaa99966a2ca1088d97b59e2e5c2fc9d451b4ebf90c489
MD5 cdb6e4907881b1ca722d5b784ac1a659
SHA1 21462bf2b942b3979af0fbb9030f5923e4a7ace7
SHA512 59b6dde4653bfb4a2a591f44d6dfe586b504f965f53f9c49172eefa2ceea82ae7368db0ec78c74f397be533a05432c3d2df46a3bb075d66116ab31e97b197d2f
SSDEEP 192:gONC6vMGPQmiUyDUnhTq4+FdLkxdtSJr080IBqNCU/u:gONC6UGRRnSd4xGJrZCCU/u
TLSH
T10C121B31B8649C2BAD53B546F08B36175FF4916BEAC46B54FADC2F1C01EE66C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ba801bd-9d2c-44a4-b0f7-748b2283a445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4ba801bd-9d2c-44a4-b0f7-748b2283a445.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3466a161d8cd0b0e703e20b86182ddb4e4346c92a7ba36a3665aaabd287df0bc
MD5 260dce3369dadbab5fc30b4eefc28091
SHA1 921f867fb41e29ae6bafdcf7cd6a8bfd5dbdf317
SHA512 aec21fcc38c82b2a2d8e7fe90bffa9ff33b77d2821fc8bc670f9457183a3ba7e5e4710f24c5b407928b437ee7cf00adcfb0f99fd74604001d7f34a35f3c7b9b5
TLSH
T1EC41D858B6EE1108B7B76E5A9BF6A86E587F7D772F06D45E00110D4E0B22A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download