hxxps://files[.]catbox[.]moe/x32d9v[.]7z

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://files.catbox.moe/x32d9v.7z
Sample260813-vcwaravapd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311134931298406"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B5045C7C-E894-4BF1-A5EF-3CB082429827}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1536	3216	msedge.exe	87
PID 3216 wrote to memory of 2792	3216	msedge.exe	89
PID 3216 wrote to memory of 4772	3216	msedge.exe	88
PID 3216 wrote to memory of 2792	3216	msedge.exe	89
PID 3216 wrote to memory of 2792	3216	msedge.exe	89
PID 3216 wrote to memory of 2356	3216	msedge.exe	90
PID 3216 wrote to memory of 2356	3216	msedge.exe	90
PID 3216 wrote to memory of 4008	3216	msedge.exe	92
PID 3216 wrote to memory of 4816	3216	msedge.exe	93
PID 3216 wrote to memory of 4008	3216	msedge.exe	92
PID 3216 wrote to memory of 4008	3216	msedge.exe	92
PID 3216 wrote to memory of 4816	3216	msedge.exe	93
PID 3216 wrote to memory of 4816	3216	msedge.exe	93
PID 3216 wrote to memory of 2480	3216	msedge.exe	94
PID 3216 wrote to memory of 2480	3216	msedge.exe	94
PID 3216 wrote to memory of 2480	3216	msedge.exe	94
PID 3216 wrote to memory of 1044	3216	msedge.exe	95
PID 3216 wrote to memory of 1044	3216	msedge.exe	95
PID 3216 wrote to memory of 1044	3216	msedge.exe	95
PID 3216 wrote to memory of 2388	3216	msedge.exe	99
PID 3216 wrote to memory of 2840	3216	msedge.exe	100
PID 3216 wrote to memory of 2388	3216	msedge.exe	99
PID 3216 wrote to memory of 2840	3216	msedge.exe	100
PID 3216 wrote to memory of 3200	3216	msedge.exe	102
PID 3216 wrote to memory of 640	3216	msedge.exe	105
PID 3216 wrote to memory of 640	3216	msedge.exe	105
PID 3216 wrote to memory of 640	3216	msedge.exe	105
PID 3216 wrote to memory of 4600	3216	msedge.exe	106
PID 3216 wrote to memory of 4600	3216	msedge.exe	106
PID 3216 wrote to memory of 4600	3216	msedge.exe	106
PID 3216 wrote to memory of 692	3216	msedge.exe	110
PID 3216 wrote to memory of 4012	3216	msedge.exe	111
PID 3216 wrote to memory of 3956	3216	msedge.exe	112
PID 3216 wrote to memory of 3680	3216	msedge.exe	113
PID 3216 wrote to memory of 3680	3216	msedge.exe	113
PID 3216 wrote to memory of 3680	3216	msedge.exe	113
PID 3216 wrote to memory of 2116	3216	msedge.exe	115
PID 3216 wrote to memory of 2116	3216	msedge.exe	115
PID 3216 wrote to memory of 2116	3216	msedge.exe	115
PID 3216 wrote to memory of 5032	3216	msedge.exe	116
PID 3216 wrote to memory of 5032	3216	msedge.exe	116
PID 3216 wrote to memory of 2280	3216	msedge.exe	117
PID 3216 wrote to memory of 2280	3216	msedge.exe	117
PID 3216 wrote to memory of 2280	3216	msedge.exe	117
PID 3216 wrote to memory of 1244	3216	msedge.exe	118
PID 3216 wrote to memory of 1244	3216	msedge.exe	118
PID 3216 wrote to memory of 1244	3216	msedge.exe	118
PID 3216 wrote to memory of 2352	3216	msedge.exe	122
PID 3216 wrote to memory of 3412	3216	msedge.exe	126
PID 3216 wrote to memory of 3412	3216	msedge.exe	126
PID 3216 wrote to memory of 3412	3216	msedge.exe	126
PID 3216 wrote to memory of 3536	3216	msedge.exe	130
PID 3216 wrote to memory of 3536	3216	msedge.exe	130
PID 3216 wrote to memory of 3536	3216	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://files.catbox.moe/x32d9v.7z
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13646316715414305188,18126981878313987397,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,12913520818080536992,18057984728455187383,262144 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,3798538125110011987,1180312635089376220,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1503740641266439046,17622060267899163498,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,13670884747960843668,16578406840066347770,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,18313592711857547039,4505098716258312690,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,11107241401614221692,12254573188984351954,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,10413624116074966505,17157770503811945101,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8798000425807363534,16043976543893997789,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,12788689855049251750,6657949080809746415,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,12788689855049251750,6657949080809746415,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6276,i,14690009668463884865,724362231332080520,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5832,i,3537071784474961826,7541342762592225054,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11398003914879103692,9916274738316430697,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,1186638661030240633,4891059732490846017,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,7450406081533561292,3322140223095000186,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6384,i,4352057669666855597,14022514980811024882,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3500,i,8909395003491848028,1410829400873370047,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8495846977788189192,11651812698074892902,524288 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6416,i,3916160420859258643,2869663054762998670,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6196,i,12766232661055785263,7484020922277339123,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6672,i,15375055570843671927,13962990804669799311,262144 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5208,i,17827037331293332978,6184656762245509298,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5904,i,10373815854001245563,595940099671618570,2097152 --field-trial-handle=2196,i,1127676605534827908,11358357998645439601,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bff62ae92d43d9eb4ac9aba9df07aa1a221068cd15c27bd5af15978830355b0b
MD5 b8d98c6136be695d0bee60487da99b8d
SHA1 a2883e402eeaabe0c4e72d7390a890790d35974e
SHA512 64939c3f4bed8b3458f413dd480a22fc51420166251aab28d00c6b113a1ec961314f69498b949ffbf8a7e0d41e19c859e43cadf542c651fdec15004f50f055f2
TLSH
T131811A38715612D8EB6686BD73D1D24032F0A5E8F8931E46924B59BC3A0A7D143FB4E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cf90.TMP
Size 3KB
SHA256 5829844153af7d920aaf5f244a4db40e7092274cbca3dd8f2ebab3d7d4a72efb
MD5 fdc38a81e82102724628f220ac71384e
SHA1 8b56795fe76c12a3ea3cf3471f914bfde616ad03
SHA512 81e875411c8d9bd0a3468af0400bd75ffc1d41318ae09af3478ac8f1c054160d9512600b3c38992880982a73ec2b5c7f9019d9ec846a6d66c0dce0253bb59306
TLSH
T184811A38719612D8EB6686BD73D1D24032F0E5E8F8931E06914A59BC3A0A7D143FB4E9
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1a93b257c4af891ac0581eb957c9ca33597b0011c00e1d20fb44fe9483001f29
MD5 1cfd4819b243d22b433cd8b038e672ba
SHA1 7444408b1555279b8f28d06a41936a3c70a5a95c
SHA512 beced306cc8d3d0d818d87fe83bbd87f271f6fc53c110e64d5cf336a2e55a673fbe06d9009dd1e2ff00c99813a512c2d3120cc0ef0d1b2d2410dfb97ed779ade
TLSH
T170113DB3C3D595AEC90156F05A24EE1BCE2D0606422C7C29C9D4EF6BD7E3475E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 82e7def09d9dc3c60da163d1ff51f441b2f89bded9b49e35a00f5be792373681
MD5 8a3b000c2674a82b85142ae8434eaf71
SHA1 7e3e766661e133f2d533875ac07c054d475e8c59
SHA512 2ff4ad00d87fb16751bcae54b892852629e312fc1785ce6f964fc8867c8852926188f43f22106824db43bcac01bbce786a7d17d8dc74c74bd2c3a6251e4c69e5
SSDEEP 192:sxZER/yM/jK1Ml8MkV/fNs8UDUIdpJHW6+WNGYzcwRyIgrJ:sxZEvMV/fNs8UBJHbGX9
TLSH
T17142E8156B34A97BCCCBD209FA55BF53D6F50472A2900D48A9FCCA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cf840dfb611eac89fe804630e99d8c14eefa7bdd473827a65b277eb71d752346
MD5 f0d760eec6587838f630949c04313723
SHA1 f276ae5a6ba645507a25eee48f8053013c0a0baf
SHA512 a1286bce8a39d5908c73b8431f35400c417d85a2e4951879966d4ab83a16053d213fcca372a7210b87c8f645498651ff048a201e807f456d37ad4965ad517fab
SSDEEP 192:sxZER/yM/jK1Ml8UQ7kV/fNst/dIUIdpVYHW6+WNGYzGim7RyIg5jJ:sxZEvqQV/fNshdm+HbGOf
TLSH
T12552D8166B349977CCDBE209FA45BF53E6F50472A1900E44A9FCCA1C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8e2c82389279e646b910fb076095951473e29aaad511b918c8c39428756f8ad0
MD5 8ecb3a28e4768172699cdcab65ece938
SHA1 7c56721ea6346af0187b6119a250e0efc905f5fa
SHA512 9dd282558e0d966a01c9b4313da75a550c320906d1e10c96cda082c11b0b06f1869725f16561feb0fcfa560c5cffdfe07fa43ae2f1f7ec3fb37052f70e7120cf
SSDEEP 768:dUW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjwroI4iOY5:dUW7kf0Wvqidau1jaa5LA3jbk5
TLSH
T192D2FA3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0524cff1cdb336307859b5da2c0ac4037c5ba8649bed8d241bb557f4e88589dd
MD5 b7a5c5c226812f6c11f63822c129e835
SHA1 06b0f0b5b571183ec3e40a013ddc4b4bcbfa0fd0
SHA512 1e3d98087e715058486a08898f71f04e7718c410b8c0ce484ccca523f4b4e2dd9b30a669992b0555c3d2aa6ee81cf863e9e560f24b49788353728a1ac47e5ab7
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTrGIvKLS0ny5UIDKVysvylhIVK8:KIbCKcrGgKLSuaUgKVymGhWK8
TLSH
T1CE915611347B56013DBE2D4CA2DA85274F4231A33419F66F3FA500A30EAAE525DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 66e90f5c1d674ecebc8dcac30ed43acebfc74037583e6a67a4513d4f2ed25c38
MD5 4820fa567246d60d4bda1b492f8490bb
SHA1 1c6c3a91887122a208e4c25b28e573f6a4c15262
SHA512 4fed5ca2f14bb195046e10f397534d3bad9fca9658c19f77a565db50144e57e4d5b4955a35ad138f5479e6a11c9a5bc11263aadd19687f47ea1d380ace82b838
SSDEEP 384:vZcIhsNwudNhbOoNoDFDvIOOPrXLpe8C/Rz:nhF+h5mtIOi9Pcz
TLSH
T144929E71BC786D6B6CB6F681F5863707AFF84477F2C41B44A5EDAB0C05DA268030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 629ef19cc0baa52d91afe35e03259f958363c28e43c2a497401ba98219508557
MD5 2577b9d5a48ce0d9eaf9793cd853e64a
SHA1 19e9c65a23632a0589075a6b2a96ee740ae9bc12
SHA512 8b4eebd49b354205f9cb556c9b8d98569340dc404e643e7112dee01a385a2292dfbd0191293d96d6b09daf238346efbcd4ec0fcdf07cfe22108c76cdca888c79
SSDEEP 384:TFiZcIosNw+8TUNTUlIlcNhbOoNoDFDEIOOPrXLpe8C/Rz:TFQoF+wgwh5mWIOi9Pcz
TLSH
T1F3A28E725CA8997BADB6EB80F54532079FF440B7F5C4AB94B6DDAA0C01D7198030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afc949c5448a8cfd2339917407d7226563d7dfd42b6a89df688250b411aa7360
MD5 753e0290775cc18619abce69dddc52b4
SHA1 6b270f89dbfaedbea6de255728213fe24590d31e
SHA512 8524c07ec403ca057d39329dc3e577520098fa6430becdef6c0e0515b82d7de46752385675eb431c3021c932892f487a1e8911f71788045d4e55a21476a5e64c
SSDEEP 192:MONH64BAQmiUyR1KW5GBPKulCx9FUaD50U6:MONH6eAKgW7DFF2U6
TLSH
T19A02F9356CB96C7B9DB2AE44F48A37176FE4107BE6945B44EAE82B1C00D724C234352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f08f3eb652bf2840ad7e5a50167f1cf5254fb0bdd1802e8357def96ae32a2c1f
MD5 c5995c958cea58ec554847f8acc08d2c
SHA1 a33f1c8ba9d7181e0e8ee4785250b5f913ca23d3
SHA512 bc4feca64b8e0cb0f413af3680c748cf9b11987397d14ce84f95f71d1d52e214355682289b41dbf4087b9f5ef4bead8c897eba641be194de59e96b4dd3ceef9e
SSDEEP 384:TZcIhsNwucNhbOoNoDFDvIOOPrXLpe8C/Rz:LhFdh5mtIOi9Pcz
TLSH
T1AF929E71AC786D6B6CB6F681F5863707AFF84077F2C41B44A5EDAB0C05DA6680307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 202dd2af328a1d7bc5c6f5f979622a9c66840793a93567d4713333e8d57dfa21
MD5 63863c79fa0f4e9c6d66acdca3e09e3a
SHA1 1c341a582504d87f99824252f801ad6e551652ea
SHA512 cbeae4258c9eeb5f81c205881c57cae6087286df0fc6c8c5a689662fc8417351c402b826f95ad8b20567599c25c08a80a4e055a5a2f0d501e6a9e90f2f204902
SSDEEP 192:QONk764BLQmiUyJPKy25GBPKulCx9FLvGLzWwxqFU6:QONk76e9nP7DFDWIU6
TLSH
T19A121B76BCB96C7B5DA2B450F48632076FA5416BFA846B40BAED3A1C01EB25C230B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f188894e-52ad-4769-87d1-27e5bb80e581.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f188894e-52ad-4769-87d1-27e5bb80e581.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15df50ca3943e45fe7e5860e393b7b364fcb6bdf49297a56f3d506f0fc6d453f
MD5 886d56b8af6a22216ed8582046b039f9
SHA1 0345da45813b4c9bb087dd687e420bbef4d38bff
SHA512 1c23d9a9eec19094aecb6c9eb3f6cd9369812020a13dcb870baa0312fd18e8322082c2a6bc99390b8601d1b2c7c26263e697eb1c498432e65031c1d303201a36
TLSH
T113411799B6EA1108B3B37F5AABF6A86D487BBC772F0BD45E00110D4E4662B01C871733
MD5 SHA1 SHA512 TLSH

Submit Download