hxxps://3za3y3r55s1kf89[.]icu/

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://3za3y3r55s1kf89.icu/
Sample260825-qr76msshld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321382591578861"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{86D4EC35-71BA-4F8A-A114-2BA896D0AF57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 3008	820	msedge.exe	85
PID 820 wrote to memory of 4960	820	msedge.exe	86
PID 820 wrote to memory of 4368	820	msedge.exe	87
PID 820 wrote to memory of 4368	820	msedge.exe	87
PID 820 wrote to memory of 4368	820	msedge.exe	87
PID 820 wrote to memory of 4204	820	msedge.exe	88
PID 820 wrote to memory of 4204	820	msedge.exe	88
PID 820 wrote to memory of 2760	820	msedge.exe	89
PID 820 wrote to memory of 2760	820	msedge.exe	89
PID 820 wrote to memory of 2760	820	msedge.exe	89
PID 820 wrote to memory of 2348	820	msedge.exe	90
PID 820 wrote to memory of 2348	820	msedge.exe	90
PID 820 wrote to memory of 2348	820	msedge.exe	90
PID 820 wrote to memory of 3768	820	msedge.exe	92
PID 820 wrote to memory of 3768	820	msedge.exe	92
PID 820 wrote to memory of 3768	820	msedge.exe	92
PID 820 wrote to memory of 652	820	msedge.exe	93
PID 820 wrote to memory of 652	820	msedge.exe	93
PID 820 wrote to memory of 652	820	msedge.exe	93
PID 820 wrote to memory of 1148	820	msedge.exe	96
PID 820 wrote to memory of 1148	820	msedge.exe	96
PID 820 wrote to memory of 1148	820	msedge.exe	96
PID 820 wrote to memory of 4132	820	msedge.exe	98
PID 820 wrote to memory of 4132	820	msedge.exe	98
PID 820 wrote to memory of 4132	820	msedge.exe	98
PID 820 wrote to memory of 3452	820	msedge.exe	99
PID 820 wrote to memory of 692	820	msedge.exe	100
PID 820 wrote to memory of 3452	820	msedge.exe	99
PID 820 wrote to memory of 692	820	msedge.exe	100
PID 820 wrote to memory of 532	820	msedge.exe	104
PID 820 wrote to memory of 3912	820	msedge.exe	111
PID 820 wrote to memory of 3912	820	msedge.exe	111
PID 820 wrote to memory of 3912	820	msedge.exe	111
PID 820 wrote to memory of 1076	820	msedge.exe	120
PID 820 wrote to memory of 4164	820	msedge.exe	121
PID 820 wrote to memory of 1892	820	msedge.exe	122
PID 820 wrote to memory of 3508	820	msedge.exe	124
PID 820 wrote to memory of 3508	820	msedge.exe	124
PID 820 wrote to memory of 3508	820	msedge.exe	124
PID 820 wrote to memory of 3012	820	msedge.exe	126
PID 820 wrote to memory of 3012	820	msedge.exe	126
PID 820 wrote to memory of 4648	820	msedge.exe	131
PID 820 wrote to memory of 4648	820	msedge.exe	131
PID 820 wrote to memory of 4648	820	msedge.exe	131
PID 820 wrote to memory of 2204	820	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://3za3y3r55s1kf89.icu/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc12efc188,0x7ffc12efc194,0x7ffc12efc1a0
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,6888113549814505942,10599367242542068363,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,12018302485163872972,16371223246299082285,262144 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,5673563765863795336,7272663235302420574,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6155659906423140409,3308242508168379761,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,8238367178739207763,12838513507901705322,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,17682023851484019084,17477930983590680513,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,3271214022160484176,8231773315354349528,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4984,i,9735876124480759909,14028001228728688971,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3596,i,9207487787400457419,15778730205808714613,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,5402158743038973497,2989924910704225608,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14418625452715081892,6883412787294259658,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12507261825444724307,10340084303637298248,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12507261825444724307,10340084303637298248,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6280,i,6120254541276277303,15070154241683371184,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,7709034296904350981,11116688777741290415,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,5239732770176977126,2245289638023210163,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16567976770203429707,8555312697459066258,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2988,i,4760968559413234121,4212708086573260145,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,1014535951977676271,8878026724538634843,524288 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6356,i,8664897190761630174,3748337854870767932,2097152 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,7148717459103786687,14275258608935729420,262144 --field-trial-handle=2240,i,16037626546701095328,3231770932759705423,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b45ae5fcf4471f3db68eecd42cd15987c5c3ca52ebf04b222ab65518677f97ff
MD5 fd60c68e41fa0daf9d7e93f57c9ee06c
SHA1 b7ab960bbdb13d32eefad69bf84b4de96199866a
SHA512 f3f8a6711fb08b4fd521032213e60ec6696c725d4e7a63443ad0f8cb15c89de4685cc5341aed35267ce324c9a4ab38255d0f5287a4217ed9a09a1f4dc5ff9975
TLSH
T110717E2842B23461EBF41AF0E4C21206B47E47DF0B0F0D4518AC9FBDAE89364B27178B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d7cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d7cd.TMP
Size 3KB
SHA256 f4e7d13faf47e3033e16fe1e2b14dad5284522190eee99b008ad29806edd8b6c
MD5 2e0e7c85ea09193dfc4a8244dac3bb89
SHA1 8f014ed060c06a80fef87a4936c7ca21af8dd66d
SHA512 47d677546b0e10a00f7136e4eda7645775cb38df10bcfff4f93d02ad478c5a23faab79aca3d876da867e576f47e79c59c2139d4d83199fa065407601b7f8e04b
TLSH
T13771812842A27461EBF41AF0E4C31206B57E47DF0B0F0D45189C9FBD6E89364B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

713c6c4f-2f28-4e46-ba0b-b3c391576cee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\713c6c4f-2f28-4e46-ba0b-b3c391576cee.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a3971f0372e69eba9f2430f5ea3ead00e0ae397f73199b883c7ff2a3e670108d
MD5 b58cf6a0c65fcf8d1d583f215033f78f
SHA1 d20672f46a38947f02b3ace736edcc7e60b2135f
SHA512 e1aaaba9df59cb3c131793b2f282426dbfe506d8ab012ef6fda75329ec5a22fab231b3e6279400e0b1dbb82ee17e9395262f54029d80edf42b61e3d6c10e67de
TLSH
T19D117DB3C3D5856E891116F09A28AE2BCE2D0506421C7C1585D4EF2793F3475E10555F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc58c6724e769b4cc2753215703ded5c3abf3b040eab528a62c221692cd29fd8
MD5 478574152a3bbf64624f118fc1e51f6b
SHA1 0f7ab4e2b93c3f85e35be5a5ef13b4c9af098f6e
SHA512 261118b707c12756a24d93954e836af0f68ed5508fe851528ffff606c6a7d4541a8dda86dbdbd9b510dc72717cd005585e9163ead11c760f8535b6a4e6057897
SSDEEP 192:sxZZRQyM/jK1Ml8Mkf/fLslqLIdp/RqHW6+WNGY4wk/TIgrJ:sxZZKMf/fLslqUJqHbGX9
TLSH
T17142E811AA3469B7CCDBD309FA557F53D6F90473A2901E44A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1f4807f6e231a131b168d7ea0c292e125c5f486d0cc9e622c60baba2bf92afef
MD5 b77f5071202dcb1af79443714c6aa75c
SHA1 9aa871fd82cd536d1d908535da862aca966c46dc
SHA512 7dea62079c4c9c6621e139f73453f240b458c9b41243b46810bdbc42e0bf5dc7004d8213e52e78e6a3fcf7e3e27ded19e91f1f511d1d41262b8fd0f2dc3968e5
SSDEEP 192:sxZZRQyM/jK1Ml8UQvkf/fLsK0LIdp1RqHW6+WNGY4whjTIg5aJ:sxZZKqcf/fLsK0UbqHbGmU
TLSH
T19452F951AA3469B7CCD7D309FA557F93D6F50473A2901E44A9FCDA1C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bdfa6466ff6302bc6789bc931b35c180f69e732ba5a0ba170b7e718b9a53e23a
MD5 ded12498962d9eed186b33f8664a534a
SHA1 d30f537e711df81de7a2ae8d491c247b365be768
SHA512 ccce50e1b167d14c8758115cf34152ec7e2c32a84a59829670590b770d2e2f0771360df8b59a448e8986029d422900c2a8966d6f34e15f47546b78d541a057c5
SSDEEP 768:Nd8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdOro0k2Unm:Nd8iJPNWvx76ru1jahALocdF2Um
TLSH
T136D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d200e1c35dc1cd99e35935b71fc3f512e3947a0e69074bff95df14588a7a1486
MD5 1e5c01dadc4262576bfab3db4e5276b0
SHA1 5abbe0e61b6dedbfa4a71efabcfd68cc9959ad4e
SHA512 018e2ad698fcb012eda87d5559c025b724f096a7b162cfdb5cfacdb29fa15489bbc500fe8c037c24b59d452a435dc508a43ebeddf00744b7b8e83297fd67ef20
SSDEEP 48:KgpIVKKwovyhiIvKLC87yNRIRKCsE+vErf9R1kFR6PI6V:KgpiKKwySioKLCCWRyKCsZ8h
TLSH
T163A1170631BF02022D7E790AA2B48757178171B37168E82B7B6954B14E6BE344EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbe1e07f-e12e-49ce-b9fd-b7f09803ce39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fbe1e07f-e12e-49ce-b9fd-b7f09803ce39.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e59ecba08acb277ebc48686945c33fe7ffa239141b613b609b5a00759cc9ccd3
MD5 709b030cc1e297ab87685f8e24af0062
SHA1 9573ee054b48bcfc6289bc9a080a209abab20eec
SHA512 4c1dd3e1744caa5ed76fbc777f6425121e3c188929c642b345e14f0f14c7ca645d9032ea1d84c6d0f7c04bdb19747d525a2bd440073b2a85c7f7e91f3ca474e7
SSDEEP 384:oiFiZcI0sN38TUNTUlIlGSmWxylk/rqhuiv8+ayoQ:zFQ0KwgQ3phuiElyT
TLSH
T196A27E735CA4987BADB69B45F64632179FB48067CAC8BF90D6DC9B2C01DA5DC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef3ecfa3be755748002ee7761fb0f3e57e23c3199f8f930f9e431aa1c1acce3c
MD5 224d817a3c390fa721cb146c32476c84
SHA1 d41784c4971c72d6514dca81895985b9619190c4
SHA512 a438067ebf58cf94d8f0b09afd112e89e9dab866c960acdd5f490253c495758feec05d0c8ef7389c6091c445ff463e5a3776513ac4ed9f384cfae3187205aeca
SSDEEP 192:uUm+xasuheOwQxMGsNtBQTmiemYGQmiU1daf64k036r1EY4LI7qZt4/tyA8+ayCg:KZcIhsNtBSmWxylk/rqguiv8+ayoQ
TLSH
T12E828D715CB86C7A6CE3D241F646361B5FB8D0279BCC2F8495ECAB2C05DE598130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b158a645faaf5e93f2c21faa05a1c4863e9ac3a299eda3ff3698e1cfbbffe9dc
MD5 18e326a40f88fa564857756a4ab5cbf9
SHA1 c20f75e3ee9af35904ddc410ebff64192106ac8b
SHA512 c34469ebdb6e2f7d2656801cca0d07723b7dcf721d6b0859a58aa166899167e81a411b50631dfddd4008242795d0b9dceab837865dd2d50b8d7a50b459befb17
SSDEEP 192:uzm+xasuheOwQxMGsNtGQTmiemYGQmiU1daf64k036r1EY4LI7qZt4/tyA8+ayCg:ZZcIhsNtGSmWxylk/rqguiv8+ayoQ
TLSH
T1E9828DB15C786C7A6CE3D241F64636175FB8D0279BCC2F8495ECAB2C05DE598130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d6689ca6c6b2288ca01923499fded9c2f9e763e9c5d2ee820ab3354f92550766
MD5 44eb8334b3d94a4bc29db3123924c78a
SHA1 c44713d6297b14bbbaed4c0b7fda553adafd3c07
SHA512 4f7d9b1b3e8b4a5bed03af9fe6c831cde375b6d3aa3656ed563c15d07405659337450eca0275911769f3638481edaa7972c866ff8c9a9cf7cee3ed5927229fbb
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop5p5DaUBhPwivh50xy0SFYKQAxsYs4:gONz6kDfQmiUy7aYZ9036TQi75U6
TLSH
T14502E9356C787CBB8EA3AE46F54737275FA5112BEA852F84D9E81B1C04D724C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57a19932bcb502a20be098d93e3b826769dfde4c7d5eb4e14f9f772d9eccfda3
MD5 4150c3aa8733325f8c3a2b5a8d629b61
SHA1 3edb6c732ab7ec1743c285439b85a7c81a651a23
SHA512 d5649acb7040d15e8b3b67fa9b66a3829a683eb88818a98132fc58f407e9595758fc7f03f81fdd84541db743f7d42fa0bc24385f9c7407a2134b4aedeed4b2a7
SSDEEP 96:MqONkQQsjpfmUTaK5ih/cIPURHl8h4otop5pODaUBPPwivh50xy0SFYKQAxsYsso:XON46kXQmiUy6aYX9036r1EYicR7qZU6
TLSH
T1B612383168A8BC7B5DD3A941F08736235EA58127DB886F81D5EC2A1C05DF58C130E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeacecfb-508a-41f9-b67e-c6bff0488550.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eeacecfb-508a-41f9-b67e-c6bff0488550.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e5dd630e9799605f8705f7380e47d405199a125ae287c6205383bd61eda05a1
MD5 64651baa82fe7d3cb16e92b8a2088c9c
SHA1 4033e3817629ac24f1a9c8354a41f20626cb4c6d
SHA512 7b1bd344c856ec73b15b8db3664148183fd1d0fd49ee4e2cd1e4a36509660af103d218c2972e00be0dfb471cab6963d6e6579564d8fa2225b74c614604c402f5
TLSH
T1D3411A68AAE9110DB3B76E5AAFF7686E487FB9372E06D46D00110D4E0B23B40D961737
MD5 SHA1 SHA512 TLSH

Submit Download