hxxps://b-poaiimchat[.]live/

Resubmissions

26/08/2026, 12:44

260826-pyzbmsde563

26/08/2026, 12:44

26/08/2026, 12:43

26/08/2026, 12:39

26/08/2026, 11:18

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://b-poaiimchat.live/
Sample260826-pyzbmsde56

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322219046325948"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E9AFA7BC-F493-4242-842B-619D20BF5277}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2336	2228	msedge.exe	85
PID 2228 wrote to memory of 3528	2228	msedge.exe	86
PID 2228 wrote to memory of 516	2228	msedge.exe	87
PID 2228 wrote to memory of 4120	2228	msedge.exe	88
PID 2228 wrote to memory of 516	2228	msedge.exe	87
PID 2228 wrote to memory of 516	2228	msedge.exe	87
PID 2228 wrote to memory of 4120	2228	msedge.exe	88
PID 2228 wrote to memory of 540	2228	msedge.exe	89
PID 2228 wrote to memory of 540	2228	msedge.exe	89
PID 2228 wrote to memory of 540	2228	msedge.exe	89
PID 2228 wrote to memory of 724	2228	msedge.exe	90
PID 2228 wrote to memory of 724	2228	msedge.exe	90
PID 2228 wrote to memory of 724	2228	msedge.exe	90
PID 2228 wrote to memory of 4464	2228	msedge.exe	91
PID 2228 wrote to memory of 1380	2228	msedge.exe	92
PID 2228 wrote to memory of 4464	2228	msedge.exe	91
PID 2228 wrote to memory of 4464	2228	msedge.exe	91
PID 2228 wrote to memory of 1380	2228	msedge.exe	92
PID 2228 wrote to memory of 1380	2228	msedge.exe	92
PID 2228 wrote to memory of 216	2228	msedge.exe	95
PID 2228 wrote to memory of 216	2228	msedge.exe	95
PID 2228 wrote to memory of 216	2228	msedge.exe	95
PID 2228 wrote to memory of 4100	2228	msedge.exe	98
PID 2228 wrote to memory of 4100	2228	msedge.exe	98
PID 2228 wrote to memory of 4100	2228	msedge.exe	98
PID 2228 wrote to memory of 2312	2228	msedge.exe	99
PID 2228 wrote to memory of 2312	2228	msedge.exe	99
PID 2228 wrote to memory of 776	2228	msedge.exe	100
PID 2228 wrote to memory of 776	2228	msedge.exe	100
PID 2228 wrote to memory of 3172	2228	msedge.exe	102
PID 2228 wrote to memory of 2028	2228	msedge.exe	107
PID 2228 wrote to memory of 2028	2228	msedge.exe	107
PID 2228 wrote to memory of 2028	2228	msedge.exe	107
PID 2228 wrote to memory of 1996	2228	msedge.exe	113
PID 2228 wrote to memory of 1712	2228	msedge.exe	114
PID 2228 wrote to memory of 3304	2228	msedge.exe	115
PID 2228 wrote to memory of 3948	2228	msedge.exe	116
PID 2228 wrote to memory of 3948	2228	msedge.exe	116
PID 2228 wrote to memory of 3948	2228	msedge.exe	116
PID 2228 wrote to memory of 2996	2228	msedge.exe	118
PID 2228 wrote to memory of 2996	2228	msedge.exe	118
PID 2228 wrote to memory of 2028	2228	msedge.exe	119
PID 2228 wrote to memory of 2028	2228	msedge.exe	119
PID 2228 wrote to memory of 2464	2228	msedge.exe	120
PID 2228 wrote to memory of 2464	2228	msedge.exe	120
PID 2228 wrote to memory of 2464	2228	msedge.exe	120
PID 2228 wrote to memory of 2572	2228	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://b-poaiimchat.live/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1300867547368797010,14236859911401935329,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2617289547058684155,9313135405341647132,262144 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,9545154012677163160,6782030761557806374,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,15623024316755314884,756657482543442296,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,10068653444354627616,17324035825015122611,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,698680863288457736,18446340442586972543,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3570783064074439498,17908904174798739363,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,10236179975922885400,15051162846252626005,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3476,i,8453956342622330408,10791032353591409675,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,1873449032082072747,18195648265461546451,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,14438142170103783390,12755744734001923510,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3001617732150802968,3924878934869855933,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3001617732150802968,3924878934869855933,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6352,i,18012146370841344628,6373500514253515493,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,3810596877887310369,6213878220734015539,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,522249998633549346,14519844111930603469,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,11541750023550252318,7377501964026743640,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5416,i,908051875113512804,2135544414435244493,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6375098333125501065,17130653044473173261,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1004,i,6530746434253178721,15731801362476622591,524288 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5412,i,7473218219229384919,3936401590853233851,2097152 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6596,i,18156336073959495089,8613819385001127501,262144 --field-trial-handle=2288,i,7507278871812466555,1764766601343328538,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 679a994132527fb236d3369479ed31104b3260e7066a87a61189a4d8d6c34e7b
MD5 d70af3f0ee0175a76c1ab2e4516103f6
SHA1 af744279e8fb1f1bf95a2b5e40fb26d72d417329
SHA512 27d5a9ccc5d63d611123e8117a7fa5f7ce8afe7ffe8562dc26f958ce507873290fe123b61b85565638378749ecd6e2d9064ef5a6c48792da565ae5356a13719b
TLSH
T1C471C40401AE05B2F3A20F72E9D00650B47183792E371DE732F6E87CF91EF12412948B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58940d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58940d.TMP
Size 3KB
SHA256 bf1b3cb870c9e6c08c8479243ba3f97a91ad51f7b18890eaae393f9bb472b1cc
MD5 ee8acb94448cf8fd26c4675d2bdd4895
SHA1 ffd8c630d79f9093131d5f8a69f8d82a6d826b83
SHA512 9145f318b1b91514c3e59ca8321de46369b49a3820e079ff939cd48dcc1479c74697e897c5d5efe5992976ee2b6df5be5936f76537f5aea539deba35de9c49bc
TLSH
T1F071C40402AE05B2F3A20F72E9D00650B47183792E771DE732F6E87CF91EF13812908A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fa74d9eb8ac36a948f5c6b062e3b3742f9553a78a645fd7f8cd76688372355e2
MD5 9c50282b5776a48f5e978c945d4384b6
SHA1 e0ea9fa09d0f19f4eca2df26bb9c11d184790ddc
SHA512 4206157d878e6d6c0dd1d26ce4f34443581313f46a71853ca3c6a2a14c353d202fc348e16477abcb7271433d48cedb3b00c14ed923755c210e74c7b71cd586e4
TLSH
T128117DB7C3D585AEC90116F05A24AE2BCE1D0905421C7C19C5D4FF2793E3475D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b34db758ca758d6e689b7c3d6e39d139aad0b49be84bd9484a208301be7703a2
MD5 5267a3f9c005cad140359ca23386754b
SHA1 d1ce29feaa0d877beaa4456169316f6f100a77fb
SHA512 a1b41597bb1976b9ef3f95ac07cf5fdffa161fb04f31803a312e4f35a035cd86a0a9e380f3cf53def86f5df6307fa869e6b5549ef0ed8dd1add549e99daa84e2
SSDEEP 192:sxZvRUpyM/jK1Ml8Mke/f5soMeg6lIdptdHW6+WNGYLzddlUIgrJ:sxZvOrMe/f5so1gZHHbG/9
TLSH
T10D420A116B346977CCDBD209F955BF53D6F80472A2900E88A9FCCA1C01E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d9faa1df06c305730d411bcec8dafbcb7b0a7b4f55ea35f28a1633ed57031c5c
MD5 efcda30757cae7533d834dda0d97d45f
SHA1 cc6b516e5dd3a7f5554d9bf2bc14fa6e1019c64b
SHA512 936fed40272389b219aceadb58b6b66acaee636b855a296d38cabe6a42c3f61745d5ff72a384ed65d3459fcb65778f13e31f961cb2ca9d227b2d91e7d94f0433
SSDEEP 192:sxZvRUpyM/jK1Ml8UQEke/f5sUMe16lIdpPdHW6+WNGYLsEklUIg5WJ:sxZvOrqfe/f5sU11ZFHbGYQ
TLSH
T18652F8126A345D77CCDBD209F955BF53D6F80472A2940E88A9FCCA1C01E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9cb1b4ed59a9b69eaa7f8f26b9f4346156b7cb754d2aa7c6a6f234c9d52e1975
MD5 9e78b9f69d83c5a15d97d581c9c239eb
SHA1 16e7742e977934f48e99dbeaca2e0c1665cf7177
SHA512 89fbe164b531031a70cff39e5b19b3d73ebe16a69de3d96e17518d67633613c2a242fba32524bbf6e2d29202cf9e0362e04b9eccf05814fc0356f9eb34e0933a
SSDEEP 768:w6s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNVro/X:w6s6pD1WvxzWju1jahILIsNu/X
TLSH
T180D2FA3B680CCB7E4F844E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 49b06d0d1f6a04f13a5b1209ecebca6bd501ea645ec71af9d846eab9b987d592
MD5 47800bb1f75371e573450029aafe014a
SHA1 2320034dbe6fcd25afc7fd03932a8f0240d2e1fd
SHA512 eb670a1a71328b62082b6cd43ca220a5105fed510a5da1e69eb7cb2476dff82dfa0b0a05349a0a3fdbea3f4d8b5961358bd3183e4b81af441e8c498d71e7720b
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabg+:iitMlh91
TLSH
T101C1151371BB02223D3E291CA29997664F4276633819F42B37A904B55EA7F340DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6553888-15c4-450c-a184-be1353f5bd59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f6553888-15c4-450c-a184-be1353f5bd59.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f086c058732a32c92e51907cdfb12d067415f02779419b8bd75dfd1daf35868b
MD5 2291ec455e33b30cc8dc6bcfcba7f046
SHA1 62cfed6cd808a841177042e79cc6707191cb2e10
SHA512 56fcd87a3a974f7c2618943d1fc2e1c45017fb42c33c95afe4b52d9228c4b490ff7a79456580baf2d9d3729a28f551d01c1c4181397b79d143d2060b1a5da8a2
SSDEEP 384:FZcIhsNDIhTxDJHa9yO+TQ+2rf+HBbs94+ol:9ht6IOuQlrfgJ+q
TLSH
T1E0826D765C789CB769F2A141F98736175FB8406BE6C92F80D4DCAF1C05EB6AC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 53862847e727cc5f454860169c299ca24f7bf4ff4c0445f2342694fb657c2142
MD5 0e772303eda8a512dedd0b942ae62a7f
SHA1 6d90305f19b0c104cdbfcb5fce43b3c9733d090c
SHA512 49fdfcb8969edf94a4adefb7dbf00f03348714862f89bcea2572472c17971bde7f11ff75d030b9b3ad3f801eac0a29aabf4ed8edecdaab99b48667969071dcd9
SSDEEP 384:piFiZcILsNd8TUNTUlIllhTxDJHa9yO+TQ+2Sf+HBbs94+ol:AFQLYwgl6IOuQlSfgJ+q
TLSH
T148A25C734CA8CCB76DF69641FA8B36178EB4406BD9C5AE90E2D89F1C019B5EC134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a8c70a0cea54e6dd65a3573975271f1f828124ef3a406e08098cee295412df8
MD5 64620f670244f1bbd40abf2788c07151
SHA1 8b4b341064abc19e61450dbcbea08e657b3f787e
SHA512 c45d1abbf842a3630f9080dc87a33faf025ca85bb66ab29b1119b937fa919d26cc4e532e3a0b50a8c6a21188e109137b57fa69d624b4de4bcee05adc68434252
SSDEEP 192:qONT6O7+3hQmiUyqCqmGttb0zO2bH3gGExU6:qONT61uGt9yO+LUU6
TLSH
T1AC02E7356C686CB75BF2AE45FA8727275FA5103BE9962F80D6E81E0C00D766C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4636faf12238fb85321f9925567add84557fd26a1aeb0adf3a941f2c34f2c49a
MD5 6e6b010e6beadd48001bc05e96c8be5e
SHA1 ae53ffaccacf1abb65523c9cda5f4203a1e22c44
SHA512 6b61f4ce870378736773a101dc8fef00ac0bff7fc4e5b661dcde13dbd034b5bdfbfe95b6f50f44580579b628248e1279fa59385f9b073272b1c9b2d14fe82b6d
SSDEEP 384:3ZcIhsNDlhTxDJHa9yO+TQ+2rf+HBbs94+ol:/hM6IOuQlrfgJ+q
TLSH
T176826C765C789CB359F2A141F98736175FB8406BA6C92F80D4DCAF1D05EB6AC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf98b8552d153c47788be97aefd8edb6503c64d4f7f46da1729fe6e2b17b5cc0
MD5 341cf824a12005a511a4d443205192ab
SHA1 76a87e8ba1feb0321af088408ec998e30bb0aecb
SHA512 b4d5533fada237f468c79684785b9f70c6fa7f79509d63fde89f83c13ac6d179e27d43c9297ea572402a13ca99414647dd1ba6ceb9f2cd21e601d9f8fcbcfd65
SSDEEP 192:mONYB6O7+3FQmiUyqoqm1ttb0zO2bHTQ+2jcN4qqCU6:mONO6BI1t9yO+TQ+24fU6
TLSH
T1EF120A35A8689C775EF3A540F98736139EA5012BEAC66FC0D1DC6E1C01DFA6C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3fdd17c-08e0-468f-8513-49130119e93a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b3fdd17c-08e0-468f-8513-49130119e93a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 639986cbfe4de91367fe771fa2534ae69105105d720192aa9052351a2334662c
MD5 1836facd97d1462fd9ecf30559a99ad3
SHA1 89281be0dc133cd27cb1c9a5b9a2fcf03ea63b55
SHA512 f22dde1c566ac464a3b9126692efaf3e56281bcf609565653b44a58bc9d12ec042a8b4ae6abfe944a4c36414e7c571b7849a52c28386fb0268ed9ed5bb66a391
TLSH
T16241185CAAEA1104B3B77E4AABF6A4AD487AB9372E46D49D10110D4E0A67B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download