hxxp://cb3u[.]com | Triage™

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cb3u.com
Sample260817-e3vtxahd89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3316	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314145467133236"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9C61FAF0-FDA7-46CA-B540-4910020FA1C5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 416	1936	msedge.exe	85
PID 1936 wrote to memory of 4444	1936	msedge.exe	86
PID 1936 wrote to memory of 3316	1936	msedge.exe	87
PID 1936 wrote to memory of 4444	1936	msedge.exe	86
PID 1936 wrote to memory of 4444	1936	msedge.exe	86
PID 1936 wrote to memory of 2468	1936	msedge.exe	89
PID 1936 wrote to memory of 2468	1936	msedge.exe	89
PID 1936 wrote to memory of 4876	1936	msedge.exe	90
PID 1936 wrote to memory of 4876	1936	msedge.exe	90
PID 1936 wrote to memory of 4876	1936	msedge.exe	90
PID 1936 wrote to memory of 4792	1936	msedge.exe	91
PID 1936 wrote to memory of 4792	1936	msedge.exe	91
PID 1936 wrote to memory of 4792	1936	msedge.exe	91
PID 1936 wrote to memory of 3704	1936	msedge.exe	92
PID 1936 wrote to memory of 4888	1936	msedge.exe	93
PID 1936 wrote to memory of 3704	1936	msedge.exe	92
PID 1936 wrote to memory of 3704	1936	msedge.exe	92
PID 1936 wrote to memory of 4888	1936	msedge.exe	93
PID 1936 wrote to memory of 4888	1936	msedge.exe	93
PID 1936 wrote to memory of 4644	1936	msedge.exe	97
PID 1936 wrote to memory of 5012	1936	msedge.exe	98
PID 1936 wrote to memory of 4644	1936	msedge.exe	97
PID 1936 wrote to memory of 5012	1936	msedge.exe	98
PID 1936 wrote to memory of 1332	1936	msedge.exe	100
PID 1936 wrote to memory of 4216	1936	msedge.exe	102
PID 1936 wrote to memory of 4216	1936	msedge.exe	102
PID 1936 wrote to memory of 4216	1936	msedge.exe	102
PID 1936 wrote to memory of 1924	1936	msedge.exe	103
PID 1936 wrote to memory of 1924	1936	msedge.exe	103
PID 1936 wrote to memory of 1924	1936	msedge.exe	103
PID 1936 wrote to memory of 2612	1936	msedge.exe	106
PID 1936 wrote to memory of 1940	1936	msedge.exe	107
PID 1936 wrote to memory of 2092	1936	msedge.exe	108
PID 1936 wrote to memory of 4288	1936	msedge.exe	109
PID 1936 wrote to memory of 4288	1936	msedge.exe	109
PID 1936 wrote to memory of 4288	1936	msedge.exe	109
PID 1936 wrote to memory of 3816	1936	msedge.exe	110
PID 1936 wrote to memory of 3816	1936	msedge.exe	110
PID 1936 wrote to memory of 3816	1936	msedge.exe	110
PID 1936 wrote to memory of 4608	1936	msedge.exe	117
PID 1936 wrote to memory of 4608	1936	msedge.exe	117
PID 1936 wrote to memory of 5004	1936	msedge.exe	119
PID 1936 wrote to memory of 5004	1936	msedge.exe	119
PID 1936 wrote to memory of 5004	1936	msedge.exe	119
PID 1936 wrote to memory of 4212	1936	msedge.exe	120
PID 1936 wrote to memory of 3760	1936	msedge.exe	121
PID 1936 wrote to memory of 3760	1936	msedge.exe	121
PID 1936 wrote to memory of 3760	1936	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cb3u.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb1433c188,0x7ffb1433c194,0x7ffb1433c1a0
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2229041350657965997,10736659637573206702,262144 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,102026117316060896,14849305229383010224,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,4093777110305395374,11120343832694101400,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,4123807425863323609,2960338200068599536,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,17575688558723399210,16420047881838210918,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,2919275467277911492,587761374494511650,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,15909263299046866322,9589416703988038565,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11329420649565238225,7086560952258749147,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,17357125763435426111,11935146175154456592,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,270158343740334724,2393105000658995491,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,270158343740334724,2393105000658995491,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4408,i,18177386494139159797,16722048520433584909,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3524,i,16379932175152879518,16401869892039029088,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11042398206449049215,920794448268357553,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6697554683102550583,14249554112320083763,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,1127928337202659147,547310648175769241,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4224,i,10382077277720548336,7817349932337118884,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3596,i,7100818213291835836,14422811570080489558,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,14540234534912812826,8453182325889455622,524288 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4260,i,5969097180392919571,15889130532368164459,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,9885458562671039250,8300962303082599806,262144 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6112,i,2717084345253068368,1033847363457148528,2097152 --field-trial-handle=2264,i,10849133848717086613,2271730241770467352,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 c49caaa6105f1f4ebe38e0e53c0330fc215dbd571c3457bfbbda3c72b3c53493
MD5 9cae2df7cfe3c96e9afaea3efff423b6
SHA1 43c01b2c4edbe548db4a9710a524b8be97e38723
SHA512 fd862c8bbb7ba48f684357c5500efad7c68cb414e5d0ca77dd46cb130573487033dd34929fcc6dff1fc4f6880da04d9c365e1a145d3ee329448452e4c14ab746
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d3b7466eb87031615e3b331b7725c2e6c9661a3b0b81835ae4a4377497bd950c
MD5 afa2e38c7c0d4552a671b5e9a036e357
SHA1 d50204aa1144b843f376db9c6153f0bf9ead4810
SHA512 ca822d14e37c54ba51eb3e3fc4f66ee97a2429f614953bfb3835133c001b9fd07710c48feadfdeb47bf97c74dfee47bcf6a4734d95cc2f665fb3852e187293a1
TLSH
T1C261F9380262C89CD3AC153CF1D15234743F858A9A1BAE652E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58682b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58682b.TMP
Size 3KB
SHA256 5a4fb168ec553a40a14de4e6a445f69e13e07c81180d7dcca792f8b1924452b1
MD5 a4d0f6829091f510feb4b77941bb6278
SHA1 762509d34db9e26f99ed9e43e009a2f6921fd10b
SHA512 021bb4e6fc682ab325373840db0c372ca2601a34f9a436aa04acdeb08d02d2acd4d34ec3d516759445ed50a7745e07a1c09c3c3b15817f1752001a4a9dc2db13
TLSH
T182610B380262C84CD36C193DF1D11234743F868A9A1B6E662E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 9529f95646f6205e1ddd665ac3633c4ae1109c581bf1cae5e5828be13a8ce2dd
MD5 f004d3bb1edbdd10c28f15e238ae8f89
SHA1 028d9f0bbe1c3d860b566a92927e3977aaae32da
SHA512 b89ad36ac575baaa7c8706c0225141723ecc99aab4fd5af0d4c0e50c7380efe816248ddafc79e03fac690bdbfc0ec8ee04ac9c4026e28b69599c6c11a210c424
TLSH
T103117AF3C3E5956E890116F06A24AE2BDE2D0616822C7C1AC9D4EF2BD3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ffb8bdc3b51abdee8acca723408f5054d9bc6051690ed2aecc933d98c18d8a5a
MD5 f6081d21cd7690fdbc6e644df0903c2e
SHA1 51b13f073b7297950318f6d13f408a4ff96b62b9
SHA512 624b3481d14ffd4598d633759ae90b56e44dac652a532fe1b393335b35209dcdf0ae5ee9ec854335ff537f56c95aef0aa6989a85126f29cb95ad805450dbf27e
SSDEEP 192:sxZARsyM/jK1Ml8Mky/fdsTyHIdpJHGIS6+WNGYHl1w/0DIgrJ:sxZAWMy/fdsTyIJHPfG7A9
TLSH
T14E42E7166A34A977CCCBD209FA55BF53D6F90572A2904E44ADFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3c01c6c5becd02df380d11376199cbc23db9f3ec5a55f1fb5121b7f4ad44d265
MD5 57d2dc65b827c0b27c1c136cbca145d0
SHA1 6c9b5b3f5bfec5630fbfa41cdbb7e5e90dc72c95
SHA512 f273f1db830ca6772dab3f342ab6fac4f312ae59bb7229a1ea1f86d9d20de0b4dba2fce17c89af2a8c2f552757da505233a85902b09a7994b00a94393525ffb6
SSDEEP 192:sxZARsyM/jK1Ml8UQ2ky/fdsSOSIdp60HGN6+WNGYHBIwx0DIg5vyJ:sxZAWqdy/fdsSObXH3GOuNO
TLSH
T1F852F8166A346977CCDBE209FA41BF53D6F54572A2904E44AEFCCA1C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1702b90c64377fc8ed31b3c02d2d3a83f3b92645c985b0cb4f271c4535ccca44
MD5 2ed248d3337f2ece80875f5b76152b39
SHA1 1c9ba19caf2a2e9a1254094aed320c2b54e9168a
SHA512 c96eb795057eb14af3ebcd0515056092d3ccb13743a6ad9f5852a0b8be37e0f1107fefdc90a38aa63efde5a9fc9dd81a422b2bc7a70ed83b37737ec8bf118439
SSDEEP 768:g3UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RProVw0N:g3UZYTMWvg0Pou1ja7eLZmRcNN
TLSH
T1F5D20B2B280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA884C03CB7EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 139088e21fd28f4dd865f12c9dd34d12362a7bc0af1ad11763b3de0c14c62841
MD5 7a9d5b25c88824cf146c3f93b51b3b61
SHA1 d43fa63ae5047cea5bff0430d502a5ac215526dc
SHA512 d35ab7b4df5061b34b158f9e034ccbc4946355806d631b5a41c737e82eacd3d184d434bf2cdacd7e1b36997cf2c279db247e9affa984eb4f72598e1493cbb877
SSDEEP 192:EU1HQHeGbg0GwQHU1gsK4Dm9+2NsAPQ7/pP:EUFQFKPQ7/pP
TLSH
T1C2D1146271BA02462D3E6B1893D5875FCE4272633018E52F3BAC01B18D67E629CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590526.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590526.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f533096109b8889a0b24776c36e580d7a0bc6541a8e7c03c94368330364b0f91
MD5 92cbd0e277d1c5dc50bbd77278d7cad8
SHA1 ceb918b7294f2649dcdaf1af491620b38ca55e78
SHA512 8c66e3ab984f0d0e93f4e0ff3f008712ddcb01f74f2dc926db57af02e052607698721e173aaa85d895bca69eeb3e2baad62af2058896b5fb41e961611ef095bc
SSDEEP 384:TZcIhsNtZPsstq5o8zX5od+hO/VuXd+2rhOOPrXLpe8C/j:LhOssh0OgO9utlrhOi9Pc
TLSH
T1CA927D3269787C639DF6F695F58636039FF85163E2C46FC492EC9B0C05DA5A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d5f8e72b67b64cabe8ac9c1b9272058a9269064d4d97b8855410389a829cf50a
MD5 0224cabb1cead55fdd9d2c75fb6459b0
SHA1 61d1a8a3d9a17cc78679699daad6b70bac47539a
SHA512 28d895ae6190bd05f0756c6afb8fff47ee57beebb56e814e26c973ae09a2555ab5c4b0cb6fa44bb824683de62f53ca5d390504690a244ad8b0bd61c6e7884fc8
SSDEEP 384:XZcIhsNtkPsstq5o8zX5od+hO/VuXd+2rhOOPrXLpe8C/j:fhHssh0OgO9utlrhOi9Pc
TLSH
T176927D3169787C639DF6F695F58636039FF85167E2C46F84A2EC9B0C05DA5A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20ffc2dd84672ceee47e73f0d4167ecadf2c89373fd8d1a2624f926dd58d8639
MD5 503c5d0f72d40c32bf544e1dde21271e
SHA1 dbe8adedfb4eefc60cf9fbf9e19b1bce2d28b492
SHA512 302a412bf4918cbb80766db5e7e735411af0f1aae128e519c6a1a5b8306324e137a26054e0d7f603b1ddd9b68429755f0c3eb7c8aebd1b2e10ea0d86a2d73977
SSDEEP 192:yONw61VWQmiUyXCgGX5Obd+jFO/aob/aq36iU6:yONw6WHgGX5od+hO/V+XiU6
TLSH
T13502D83569287C778FF2BE49F48737139F99216BE9946F84D6E81B1C00D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35ed9a7d0e4471236bcae9cd86cfebbddb43e2b017c378121b62581ddd23beba
MD5 9a8761339874507ea5b7b66ae7b890f8
SHA1 3fb296a4f7ace842985154c81372530ef47086c7
SHA512 6e8dcc0540150a146559fd38515b87ab82b5bd6d7d5083740fa231b7be55d120a2620d83989608ff64d071ebe0809e2942f2537ce9ac577d79e613254c204808
SSDEEP 192:iONo61jWQmiUypqCsGX5Obd+jFO/aouJFd+2UjJAqrU6:iONo6AU7sGX5od+hO/VuXd+2MhU6
TLSH
T12D120A366428BC379EE2B695F48731539FA95167DA887FC0D2EC2B1C01EB5AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 581adb55b63ec75e65c2215c1f7adfc6025857a6788e010ac07b76a1e80df889
MD5 4e5cb105b5df60b18809179304640aa4
SHA1 1fed203ad4fa83cff68741b557c15a402f3d4b1a
SHA512 44e919624069572071dd639bbde4b192e9c968837b42a52e6c4772e5f9965dbd2df9592d3926077a0527630e573cdc3b80da3e547d7c9c02e42cda6e5c8652c3
SSDEEP 384:EiFiZcIHsN38TUNTUlIlkPsstq5o8zX5od+hO/VuXd+21hOOPrXLpe8C/j:fFQHCwgYssh0OgO9utl1hOi9Pc
TLSH
T112A26D335868A877AEF6AB85F58632138FF94167D5C4AA85E3EC9A1C01DB5EC030BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6358c88585fcb68e75dfc0bdd0a76e075650d7b42a1f48c62807496582293204
MD5 8ab35318a50ebcfb34038957f314b248
SHA1 4d9c6b8e29822d9cdd8e1adfd1e764c21a75b730
SHA512 bcf5980919c86ca95971e36cc49bcc6e53b07c9790022fbecca23c44b91e11a56c5770226e2ee04e409e56bad77374746486e4cbaf8b858be9ad32c3da2ebee5
TLSH
T188412B58EAEA1108B3B37E56ABF3A86D487B7D772F06D55E10110D4E0626F41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download