hxxp://127[.]0[.]0[.]1[:]5050/

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://127.0.0.1:5050/
Sample260814-ds91eatdpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311510578859825"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F11F16A7-B64E-4ACB-AA84-C0D31B996898}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2960	3212	msedge.exe	85
PID 3212 wrote to memory of 3548	3212	msedge.exe	86
PID 3212 wrote to memory of 3440	3212	msedge.exe	87
PID 3212 wrote to memory of 3440	3212	msedge.exe	87
PID 3212 wrote to memory of 3440	3212	msedge.exe	87
PID 3212 wrote to memory of 3188	3212	msedge.exe	89
PID 3212 wrote to memory of 3188	3212	msedge.exe	89
PID 3212 wrote to memory of 4820	3212	msedge.exe	90
PID 3212 wrote to memory of 1576	3212	msedge.exe	91
PID 3212 wrote to memory of 4820	3212	msedge.exe	90
PID 3212 wrote to memory of 4820	3212	msedge.exe	90
PID 3212 wrote to memory of 1576	3212	msedge.exe	91
PID 3212 wrote to memory of 1576	3212	msedge.exe	91
PID 3212 wrote to memory of 3504	3212	msedge.exe	92
PID 3212 wrote to memory of 3504	3212	msedge.exe	92
PID 3212 wrote to memory of 3504	3212	msedge.exe	92
PID 3212 wrote to memory of 4688	3212	msedge.exe	93
PID 3212 wrote to memory of 4688	3212	msedge.exe	93
PID 3212 wrote to memory of 4688	3212	msedge.exe	93
PID 3212 wrote to memory of 1564	3212	msedge.exe	96
PID 3212 wrote to memory of 2500	3212	msedge.exe	97
PID 3212 wrote to memory of 1564	3212	msedge.exe	96
PID 3212 wrote to memory of 2500	3212	msedge.exe	97
PID 3212 wrote to memory of 1828	3212	msedge.exe	99
PID 3212 wrote to memory of 5044	3212	msedge.exe	100
PID 3212 wrote to memory of 5044	3212	msedge.exe	100
PID 3212 wrote to memory of 5044	3212	msedge.exe	100
PID 3212 wrote to memory of 2688	3212	msedge.exe	101
PID 3212 wrote to memory of 2688	3212	msedge.exe	101
PID 3212 wrote to memory of 2688	3212	msedge.exe	101
PID 3212 wrote to memory of 2420	3212	msedge.exe	104
PID 3212 wrote to memory of 2420	3212	msedge.exe	104
PID 3212 wrote to memory of 2420	3212	msedge.exe	104
PID 3212 wrote to memory of 2528	3212	msedge.exe	107
PID 3212 wrote to memory of 4280	3212	msedge.exe	108
PID 3212 wrote to memory of 2468	3212	msedge.exe	109
PID 3212 wrote to memory of 4752	3212	msedge.exe	110
PID 3212 wrote to memory of 4752	3212	msedge.exe	110
PID 3212 wrote to memory of 4752	3212	msedge.exe	110
PID 3212 wrote to memory of 4804	3212	msedge.exe	111
PID 3212 wrote to memory of 4804	3212	msedge.exe	111
PID 3212 wrote to memory of 3404	3212	msedge.exe	113
PID 3212 wrote to memory of 3404	3212	msedge.exe	113
PID 3212 wrote to memory of 4712	3212	msedge.exe	120
PID 3212 wrote to memory of 4712	3212	msedge.exe	120
PID 3212 wrote to memory of 4712	3212	msedge.exe	120
PID 3212 wrote to memory of 4608	3212	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://127.0.0.1:5050/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffa6ec8c188,0x7ffa6ec8c194,0x7ffa6ec8c1a0
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14945164831647286835,10460440056843540599,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,7720783582667254077,13509297841917385294,262144 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,13023503543257006642,687484983974046059,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7821507774439220316,16161475193672839482,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,10937232224817467867,9077625949403726480,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17345566913312236519,9531873522707302047,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,12559619925028333214,5300925581790573744,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,15442240358770534836,16088533877765971911,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,11604288080886575053,7624154712575773785,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1247845909583415343,7357413799563578149,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1247845909583415343,7357413799563578149,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,18246116808902383582,2089756527644702047,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4516,i,750137309020796571,2760162034626505233,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6180,i,6796364927638290461,7801800394672571866,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,4447832363782809934,1007661690026147718,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5840411888009033816,16050707187746964982,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6615563066673432168,7994145452693746443,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4972,i,2468788817790575142,15479332787591882182,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,538713803476629955,14234940930710506863,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,3498077419445988365,8066696668306892333,524288 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=764,i,6127612787264249364,182107572417994230,2097152 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,5511880987295232841,9216262001343643963,262144 --field-trial-handle=2280,i,16425524615024471248,8801276916718744997,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 823678f6e4419e1a3d3c56e189427abb26e138bbd117c783152d20e19880f9b8
MD5 53d1ab674b964b5b8655855ccdaf2987
SHA1 9858e41c8295792fc8a13a9b0d4b5868b1e13153
SHA512 b30fb8007383edb3dd7b90fba01a82a6cf397bfee5a4d056c11f325517bbcd46c50686abbeb9939cba0fa254c18e885bc42a987e6c8827c8ecd8dbad0421ee43
TLSH
T168612A28F5320C81E3B16370DA915A1D38F0CF88DA5B9E5143D864BCC5DA37F8576C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5db4b21c4ecb1823ad6c974f931fe8b59744ca1cbba7b8e4109975d6f0bc0906
MD5 e46a797d101d1488a5a5fd1c7e5b0892
SHA1 09b5a641d67d03ea407094951e4df38f44f6becf
SHA512 14af79e134292bbad19b7778623b2620d37b2948e9b519a946823a2f66b00f739527e9cfb53206ad4a00fa3bc057b550e2aff5c1ef66dafd6e50023c499f0c97
TLSH
T12E117DB3C3D9956E8D0156F06A24AE1BCE1D0506422C7C26C9E4EF2B93E3075E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1c3e7bfbeacd4e6fe3c5992e848308e1139e719080c5b636428ca4069c4a26a8
MD5 dd9eca59e1e1171d9960e73f44c2c254
SHA1 6ca0fa9e957a4c167d061d1a2ca1621b219be726
SHA512 d6d91a9b42d9d9256fd370c477bdf96d79054d8f7947e7198d72f1207a54ee5062ca1aeee90a2af1cba5529922c5ec86f117b6b1529ccb76970b2403c528bb99
SSDEEP 192:sxZBRVyM/jK1Ml8Mk8/fxsS9dZIdpdWHW6+WNGYLzp57mIgrJ:sxZBlM8/fxsS9dyYHbGsy9
TLSH
T1A442F7116A346977CCCBD209B955BF53D6F90473A2901E84AEFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 082d661e8605a85f57a4456626e7cbdef1119b592e84f5a036b04221d5d65f84
MD5 0c91ac16b5d227961ce324cba882c538
SHA1 059eb37ebce9f76928df9697ed3eeef685544320
SHA512 c4629da4871cb2365b35543b41da47f455601c1d8c4d6f03378708b480a4011c5bffffcf3169832c5b09306e41ef80b935e669debf4d22736cd49e889aa62ffd
SSDEEP 192:sxZBRVyM/jK1Ml8UQDk8/fxsL2dZIdpTWHW6+WNGYLEWYH7mIg5oJ:sxZBlqo8/fxsL2dyKHbGnyy
TLSH
T14B52E8116A345977CCDBD209B955BF53E6F9447392900E84AEFCDA1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c38cb6d8e00d6915edfd3c1cdfb401eb7c90c59a8589abb8859065b95d4d5617
MD5 08535972dc1788759de4ff28b109ecb7
SHA1 5f84768bb2b8201fa1c851d95c071b7f66d5ebc6
SHA512 dd9d49ab11cc9a738748668f3df584658dd76d1bbd53b1a01dbaf6752b7147bb13f231b5bd2256c4d5bea48e57400135d792004d46ff46408d8ae4f9962b04e6
SSDEEP 768:/Ds6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNcroEv:/Ds6pD1WvxzWju1jahILIsNHEv
TLSH
T15FD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c5e715fbc2fdc076e348e11b46136e688eee354bef3dde57d8bb1168ecedf688
MD5 93280cb8448693a3fcce02ce9920e9b0
SHA1 42d950d03df797a62757620ab7fc4ea99c5fcac1
SHA512 e85a5daa226c53ffd12f3a99292b655bcfe10c330242b81c0c74330d1d123d5f9fb75b78bc5e6a3eb7adb462bcc3c0706d3117ea37412149536d8ae02a2d9483
SSDEEP 96:KUAAKtePtYhM46SS+4iDlqY+KyLqO+2QYr+ofuVKKOAJ+IKHKS6eUKryj:iitYhM46SSPiDIYYLqOzQYr+ofdxXvk
TLSH
T15BE1C45771B742023C7E2A4C8794C7368E42B6633024A42B7FAC01765E67E209EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58c53f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58c53f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 21f54cd3ef9eab2a370c12a746cecd50b676b46c2c51f11411d617632989924d
MD5 f2ba5f49a8a929d6c129c452cf7b5afa
SHA1 461d64ab8a8f81cad798baddd0248f6bdd031386
SHA512 b2bf7ffae380588c740fced4c272b7f57b24bd6ff60bdc9e4cdd15980eab35f39eebc5cf319f6fce12f27b971800fa4af0643650fcba9a3eaa254c2f7aac0d33
SSDEEP 384:hZcIhsNnewiAb8sa9lOaaR3QgOOPrXLpe8C/eBT:phUgB1vOaaR3QgOi9PRT
TLSH
T1A2928D71B878AC665DF3A585F9C626079FFC4077E6C62B80E5ECAB0C05DA5A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ba078b107b23678542ac76d6ea9447e9fd7ba44dd63dd9140410410fc0fec4bc
MD5 c533d841530adcb87bdfff7c6491acee
SHA1 7e250d99a9268d2cd7d43e69e3175f6f94444798
SHA512 ed7c3dd533159bfca808517eb591197436db81f20d17db8105a1b5cf8dbb1b730fb9e734043ad2b3efa9c96db43edbcb57a149c609cc6190b273533cdc9d3e53
SSDEEP 384:bZcIhsNnexiAb8sa9lOaaR3QgOOPrXLpe8C/eBT:DhUlB1vOaaR3QgOi9PRT
TLSH
T184928D71B878AC675DF3A585F98626079FFC4077E6C52B80E5ECAB0C05DA5A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 25c393bcea0bb35458a93a244c0e8260d4d0baeacc2b3b3b15d390e66d84682a
MD5 f345deec847fdcb114d0fa03f159a13b
SHA1 1b9676a786f0a7210c804e8ff2ccb3eeda95c201
SHA512 0cca62208d7c5603bcf6c45e4ad6cbd2b77685bf3f85bd0d019aaa917a18f34d08908cb0bc936b877d4c9926e96c2a82f9ae2e0dee81f7a83153f04d50daeff8
SSDEEP 384:QiFiZcImsNnu8TUNTUlIlxiAb8sa9lOaaR3fgOOPrXLpe8C/eBT:rFQmUuwg2B1vOaaR3fgOi9PRT
TLSH
T12FA28E726C68DC7B6DF7AA85F98A2607CFF800B7D5C56A80E6DC9A0C01DB1AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbe5c2b1ad8ee253a95ec2f8fc642b67e14074dfd0f2dc136a05ad9883deefeb
MD5 57bb6f3578c78cd3c341e5f0676f8141
SHA1 c2ad9f641fb30de186a5d9489882f389aca8f02b
SHA512 a9d0f6404263a13edd01c1edb19b0cde0a9dcad6b9ccdc1635758ed8478342b567ef5768dbfa60226cd07315d18e5c84ae8974266d7889e9ec658fab6ea4c8ce
SSDEEP 192:qONy6O7+3hQmiUyuWGttb0cO2coGgGa26U6:qONy618Gt9lOa4D6U6
TLSH
T13002E7357C686CB78EF2AE45F98727179FA8107BE9962F40D6E85E0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0cdf0331e25a2405adcadc63cad6eee51b63adbce3159ef8f208ec03db42a84f
MD5 76f91e1699ca61d22369acea2d528d3a
SHA1 15603e32c6723b25823abf7d5f1c9ed2afff9b7a
SHA512 17c2e65a46e870df9257e8fee8076447cf15d3e5a40623838ee0a685c961a02ac2dc9f4f3ef15dcbbbbe6654783d70f4d85b8456683d224b2bda0d80780d99d3
SSDEEP 192:EONDr6O7+3EQmiUyoW8ttb0cO2coaR0E+cNQqb+U6:EONDr6e88t9lOaaR3PgU6
TLSH
T15712FA327868AC771DE2A585F9C735178FA9016BDA867F80D5EC2E0C01DF6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7805c9a5716a20ddbd7ed5804363e2836e6cbbe5fba391cd9d68bee9951cc815
MD5 81ceee828ef3dfa8b9626fb633efd702
SHA1 e421f8265708df3ea417afb5d73511a91d1dd4cd
SHA512 3ccfc41d5d0cc746d4df80a6e6e73aff67112bf84f3c999c3c2fb6458d68b3503c5770e8c16508c000054ebc674a40fc049cfc667263f5cc178619e3b4dae87c
SSDEEP 384:PZcIhsNnexiAb8sa9lOaaR3QgOOPrXLpe8C/eBT:HhUlB1vOaaR3QgOi9PRT
TLSH
T1FD928D71B838AC675DF3A585F9C626079FFC4077E6C62B80E5ECAB0C05DA5A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d42d30f-14e4-40c9-b25b-ec2707b557a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d42d30f-14e4-40c9-b25b-ec2707b557a1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3755f4ea2851720926f908a6094d680f3382bc53eea6b8c8e02d94952a87846d
MD5 a8317432c62c0694c0128cbf7d70f277
SHA1 c5580621d96320907641d613433531c248b66e93
SHA512 eec6274a4ea046fceaf87b17d5f567b74d7d05f2e5191914a674ff4a3c4c3f94aed452e12930cc17f1edf2a3aff7bd031d31d22914a1e42f325f386a6eac5af1
TLSH
T1AA41C458B6FA1148B7776F56ABF6A9AD447FBC773E0AD45D10010E4F0A22A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download