hxxps://qr[.]ypedzd[.]com/h/#test@sk[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://qr.ypedzd.com/h/#[email protected]
Sample260910-cd33wacm9x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334791227772351"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{A991C1E3-7C4D-4D9D-9F05-342DFF6EEE1D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2968	4392	msedge.exe	84
PID 4392 wrote to memory of 3360	4392	msedge.exe	85
PID 4392 wrote to memory of 2756	4392	msedge.exe	86
PID 4392 wrote to memory of 2756	4392	msedge.exe	86
PID 4392 wrote to memory of 2756	4392	msedge.exe	86
PID 4392 wrote to memory of 4384	4392	msedge.exe	87
PID 4392 wrote to memory of 4384	4392	msedge.exe	87
PID 4392 wrote to memory of 4140	4392	msedge.exe	88
PID 4392 wrote to memory of 4140	4392	msedge.exe	88
PID 4392 wrote to memory of 4140	4392	msedge.exe	88
PID 4392 wrote to memory of 4028	4392	msedge.exe	89
PID 4392 wrote to memory of 4028	4392	msedge.exe	89
PID 4392 wrote to memory of 4028	4392	msedge.exe	89
PID 4392 wrote to memory of 1756	4392	msedge.exe	91
PID 4392 wrote to memory of 1756	4392	msedge.exe	91
PID 4392 wrote to memory of 1756	4392	msedge.exe	91
PID 4392 wrote to memory of 2300	4392	msedge.exe	92
PID 4392 wrote to memory of 2300	4392	msedge.exe	92
PID 4392 wrote to memory of 2300	4392	msedge.exe	92
PID 4392 wrote to memory of 4744	4392	msedge.exe	96
PID 4392 wrote to memory of 5032	4392	msedge.exe	97
PID 4392 wrote to memory of 4744	4392	msedge.exe	96
PID 4392 wrote to memory of 5032	4392	msedge.exe	97
PID 4392 wrote to memory of 4184	4392	msedge.exe	99
PID 4392 wrote to memory of 3252	4392	msedge.exe	105
PID 4392 wrote to memory of 3252	4392	msedge.exe	105
PID 4392 wrote to memory of 3252	4392	msedge.exe	105
PID 4392 wrote to memory of 1344	4392	msedge.exe	106
PID 4392 wrote to memory of 1344	4392	msedge.exe	106
PID 4392 wrote to memory of 1344	4392	msedge.exe	106
PID 4392 wrote to memory of 2264	4392	msedge.exe	111
PID 4392 wrote to memory of 2264	4392	msedge.exe	111
PID 4392 wrote to memory of 2264	4392	msedge.exe	111
PID 4392 wrote to memory of 3452	4392	msedge.exe	112
PID 4392 wrote to memory of 1000	4392	msedge.exe	113
PID 4392 wrote to memory of 1984	4392	msedge.exe	114
PID 4392 wrote to memory of 4772	4392	msedge.exe	116
PID 4392 wrote to memory of 4772	4392	msedge.exe	116
PID 4392 wrote to memory of 1000	4392	msedge.exe	118
PID 4392 wrote to memory of 1000	4392	msedge.exe	118
PID 4392 wrote to memory of 1000	4392	msedge.exe	118
PID 4392 wrote to memory of 2812	4392	msedge.exe	119
PID 4392 wrote to memory of 4360	4392	msedge.exe	120
PID 4392 wrote to memory of 4360	4392	msedge.exe	120
PID 4392 wrote to memory of 4360	4392	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qr.ypedzd.com/h/#[email protected]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffb8057c188,0x7ffb8057c194,0x7ffb8057c1a0
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1932,i,14489777851056019552,8130141609004586253,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,12911487283713162849,2634020682033474175,262144 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2624,i,11011816123629777267,5811842556208447499,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15687962140507820275,11317962249272693018,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3732972291642682414,12777579571153789505,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,832009200925925430,4044359815939372310,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,9775406297650882389,14590036200660768418,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5108,i,16410693552163442170,4608283070375782369,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5112,i,18240514682330130326,2527826443181427208,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5848,i,10178601585975127614,17471957720699086676,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5848,i,10178601585975127614,17471957720699086676,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6264,i,14408541108685906291,6720377716565466123,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5732,i,3835361826146876147,4556869853764654335,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3784,i,9866394972818484509,15243632535861740554,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3608,i,18098278990919896950,15166964204323955207,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6188,i,4442300103045815723,11246562679444438909,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6224,i,12835753331072019279,14786633206677531653,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1248,i,8743924452707984118,13768621730892060567,524288 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6012,i,3223413910882125081,2125994410811038197,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,15846918291478414679,17392049028301193157,262144 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5364,i,15906485720537726163,10929435295990053794,2097152 --field-trial-handle=2372,i,925813849681219946,7300367981285790710,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

00dc8ac9-f8f7-4ba7-9c4a-90389c8d4bbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00dc8ac9-f8f7-4ba7-9c4a-90389c8d4bbe.tmp
Size 12KB
SHA256 a2da8c4168cc0fd6d58646ae3a670420d33989e0098cd8a1f4d06ad26c43c583
MD5 2d970e6fff0a7deeccd4291a337ebac2
SHA1 716eea619e3b5a1b2c30e4c98dd6690ebd88bd17
SHA512 78df7335014e88b3314533fd91f7716b7ed25eedaf97311433e75a0c83ec453d2541005fb44533c0e1646f440f27f3b56b90bdbd27d0c180936cfb9b0ce27270
SSDEEP 192:sxZFRpyM/jK1Ml8MWK/fFsNsIdpJHW6+WNGYLlStlIgrJ:sxZFFuK/fFsN1JHbGX9
TLSH
T1F742E8116A346977CCDBD209FA55BF53D6F90573A2900E44A9FCCA1C04F6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1bd074e4eb21c99d085ce054ddbb4dc50c6a49e996f39405965ecd4615e51431
MD5 b7110f16fea212ea9c0ee7d6c2a12029
SHA1 122c4ff0232009cc91ad995ba6ce991b4d257cdf
SHA512 b2d50df5171984d33d8cf40a4070d1d7683e7adebab055eed7537d7dbe0cdff42efc0373aa907c2cc2ce7a58dd2e104450c3c7892e50cdf9e597e3c945acc48c
TLSH
T1E9615D8545E23558F3703371E3D2220434B0C6DA4C038C7295846BBED6E9BB6BE5EE48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 47a28fea30163e59778ef1131fd61cfa510cc35ec3b4d874f43d08c86273866e
MD5 8ade79650c424cd4dc76a462c2faa677
SHA1 d6deac28d9440969b6afe2204a8a894218f91f51
SHA512 bf112742f31654459991e385357233b13d070a8300abd086cec3ffef602cc1edb272ab1babbdd68c88f0fc1e32155a6d80ff441663c09ea0421840bc2a84106f
TLSH
T11A117DB3C7D5856EC91556F05A28AE1BCE2D0605421C7C1A89D4EF2793E3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b9fa56a669f11de94f98d565e280e4a1c0d5f2aa6e73c14396ff11ec8ea69a22
MD5 68137c5e26f1c1076e020882601eddf5
SHA1 691a34af3f067638ff6a12c28ad61b7a42a78749
SHA512 0a793998af915a134b2bcdbe72b7288de7d89a0747ccec754f96cd0b2ad336b087a657823791528b5a1fd34b194038c301f326694a27f6e81d606795e5f1a7be
SSDEEP 192:sxZFRpyM/jK1Ml8UQ5WK/fFsE5IdpEHHW6+WNiK+/YLFh+lIg5FJ:sxZFXqwK/fFsESOHbK/Dd
TLSH
T1B852E8126A345A77CCDBD209B955BB53E6F9057392500E44A9FCCA1C04F6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6453cba548a578de76a8554d8d8e075f886c6d6ec2e0c28f0341fcea82685cd5
MD5 93de94487a0f798aa5e2457d77c0209e
SHA1 8c1fa8099de06aa5067e0f849b99cac05fb65fa2
SHA512 7ad7093b1737e86da4d3b6fd338fea95965b00afc24c8ec09e57612996e7dbb0329905cc8d161035f8b4c3dc69fc529c37be72271c274fc78485d4e69d032a38
SSDEEP 192:sxZFRpyM/jK1Ml8MWK/fFsE5IdpaHHW6+WNiK+/YL8WtlIg5FJ:sxZFXuK/fFsESIHbK/Qd
TLSH
T1CC52E8116A346A77CCDBD208BA55BF53E6F9457392900E44A9FCCA1C04F6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7ac6fef782617188d4ef439d534459e46d079db9c513541cc6b0d11c2319672f
MD5 4ef55876f95a1475726c9e38acf428ba
SHA1 ca67cd24f26156a2a6307eb2b89576bfa8ed06bd
SHA512 47d410e84733a32d9ab27cb0571210950f70fe7314188d969c3425fa436da1def24627a747391858e3577a4e43724014efd85e32dcad59398ee2b7e6eb0585b3
SSDEEP 768:4+s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNvrouv:4+s6pD1WvxzWju1jahILIsN8uv
TLSH
T16AD2EA3B680CCB7E4F841E5CEC2AAF966DD801CBAB98895447FA444C03C77EE512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b39ad98da7cd9cae7fad382322ed7828d6a871ad28bd7e41432be4366d762b25
MD5 57db5ac4243512f8195a1520a219a60f
SHA1 b68f37fcc36532d8cb884e02173a6071f152a3a8
SHA512 f5a268ad7f267addc1bfe6307ce0d41ef0b5c733a79886646263ef71ba1b8336e0c9c97bf357808d2f589eb165dad0d2c108c0cc9f3f2575d15785d49b724bd8
SSDEEP 96:KUAAKtePCcAKp26OhOKiApKIKbq66aMKrKK:ii7r9tX3t
TLSH
T1A6E1141232B747122C7E790DA35487674B42B7633018E82B7BA920B11E67E784DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f4bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f4bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b1ad4563d3bf2c928372707f85f574d2ef7bc845d3215d0240a9d073c85bc0ff
MD5 d53408a885673236fa60b7b13f56ea00
SHA1 83f6e1218b56ccf27d2bc4941ddf5d2b1eb77fdc
SHA512 b31110b43496f4d4c5cc81cb430df0d6f0eb4474344607fa6ad211cab483af9dcd7ec8609113d653add47e8276d403cb49b86a3c2ca7431d96a4e9433f27ecb5
SSDEEP 384:HZcIhsNUrY9uap6a9DO5MzYzJr3rExuvzxV+MhdpVBPoA:vhk7hOs8hbE4184pVBj
TLSH
T14D826D3168285DB668F6E141FD8B36138FBC80779AD96E80D5DDAF1C01DB6A8131EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a705fecccdd4d768eb6d15369f3118a70ce734b136cddbc0bb02079c80eb449e
MD5 bd90b8d0c81f251605a5c23dc064140f
SHA1 a677d27bd48ad54f1393e691475bf94583a0b35a
SHA512 1e53a30add2b7dc20d3fe904f63facd906011930fe3e58e71ba59f486b687f09116877b9925d95393d8fec8c2d3503afc73927ccc3016ea14a017979f348437d
SSDEEP 384:uiFiZcIDsNc8TUNTUlIlQY9uap6a9DO5MzYzJr3CExuvzxV+MhdpVBPoA:FFQDFwg17hOs8hyE4184pVBj
TLSH
T192A26D3268589DBB7DFAA745FD4A32038EB84077C999AE90E6DD9E1C01DB1AC130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 121a6984cab95ee1382d73cd7a91746330aa6ce0392c6fbf905de629c6ded6a7
MD5 20daa0b6e3e80e35f9a47f20277fa5d2
SHA1 29708cb228671026dca35bd794c411a3a3977560
SHA512 7b562c404e4c33cbe02685dda6fc392b6fc9a362fafaf427b5a905692b03ea1eb9ada3430e64217afc071d922507e5ec5cb7f0fbabf804b3d1c25d503a143d01
SSDEEP 192:qONx6O7+3hQmiUy9vGttb0CO2b6h2SUgGUZU6:qONx61eGt9DO5MSawU6
TLSH
T13F02E8356C686CB75EF2AE06BA8737235FA5113BE9A52F84D6E81F0C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8244318f4658c95eb7dfd0480fdf30cda87de1c8ff3ac9e5cd01d5638e89f0cf
MD5 e8d36b8a2bb8794fc1c8832aee9616ae
SHA1 0f8094cd848ce9c04864fcc83ba4ec04684f8882
SHA512 0724599047765ccbaf41b508c696c5b8348997f1b4249daf62af00266d4a656b6b3851c4c4ce12173b787ffc48f025b2697647f6f13a5f31f52eb87c456f8ede
SSDEEP 384:LZcIhsNUQY9uap6a9DO5MzYzJr3rExuvzxV+MhdpVBPoA:ThT7hOs8hbE4184pVBj
TLSH
T10F826D3068285DB668F6E141F98B36138FBC80779AD96E80D5DDAF1D01DB6A8131EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e39b44095b0971d062047eca730f21afaf22ea125204c6b4e291e763767fa7c
MD5 d3e9bfc6999e201c9daf616007800ce7
SHA1 66bf01ab17539037de4c159287af5399c4cdf578
SHA512 fa61cf6075625ba0c5dd8947ac4e8406db9bf5459903a8d51b5808aea5707e59c2243554f1138fa252a9dbc2946480aea7869a400872f2d0e0436d328597f45a
SSDEEP 192:wONd6O7+3nQmiUycvmttb0CO2b6h2zcF0SJr3JcN9qgYU6:wONd6TNmt9DO5MzYzJr3eEU6
TLSH
T11D120A35B868AC776DF2A541F98736139FA50137DE8A2F80D5DC2E1C01EF66C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 babbf93e1475c34e6549f064d9d7bd049fc11c97617bca8a44fa43ddf97e4076
MD5 a7b737d497f1557865decdd93210df6c
SHA1 6f68ec306c1e7f61e09ba0860940ca086cbb19c8
SHA512 ce817f0c7f649905a75a7a89efd87a43be214338375a369c3f51479c10f2348053d8c5ea1a72a937c48c8dbed2ff91d2acfc94913f8703dea737511785aa1a42
TLSH
T195412A58A6FA1104B3B37E566FF2A86D887FBD772F07C45E10010D4E4626A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download