hxxps://qm[.]fido[.]com[.]vc/requests/?cps=cns

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://qm.fido.com.vc/requests/?cps=cns
Sample260925-pyc4eayt5j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348138444747442"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{FF562C03-74C1-4613-AAF2-6047BB3CE7CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1408	1692	msedge.exe	84
PID 1692 wrote to memory of 5024	1692	msedge.exe	85
PID 1692 wrote to memory of 2652	1692	msedge.exe	86
PID 1692 wrote to memory of 2652	1692	msedge.exe	86
PID 1692 wrote to memory of 2652	1692	msedge.exe	86
PID 1692 wrote to memory of 4328	1692	msedge.exe	87
PID 1692 wrote to memory of 4328	1692	msedge.exe	87
PID 1692 wrote to memory of 4576	1692	msedge.exe	89
PID 1692 wrote to memory of 4168	1692	msedge.exe	90
PID 1692 wrote to memory of 4576	1692	msedge.exe	89
PID 1692 wrote to memory of 4576	1692	msedge.exe	89
PID 1692 wrote to memory of 4168	1692	msedge.exe	90
PID 1692 wrote to memory of 4168	1692	msedge.exe	90
PID 1692 wrote to memory of 1104	1692	msedge.exe	91
PID 1692 wrote to memory of 4844	1692	msedge.exe	92
PID 1692 wrote to memory of 1104	1692	msedge.exe	91
PID 1692 wrote to memory of 1104	1692	msedge.exe	91
PID 1692 wrote to memory of 4844	1692	msedge.exe	92
PID 1692 wrote to memory of 4844	1692	msedge.exe	92
PID 1692 wrote to memory of 1680	1692	msedge.exe	100
PID 1692 wrote to memory of 1680	1692	msedge.exe	100
PID 1692 wrote to memory of 3444	1692	msedge.exe	101
PID 1692 wrote to memory of 3444	1692	msedge.exe	101
PID 1692 wrote to memory of 536	1692	msedge.exe	106
PID 1692 wrote to memory of 4248	1692	msedge.exe	112
PID 1692 wrote to memory of 4248	1692	msedge.exe	112
PID 1692 wrote to memory of 4248	1692	msedge.exe	112
PID 1692 wrote to memory of 2380	1692	msedge.exe	113
PID 1692 wrote to memory of 2380	1692	msedge.exe	113
PID 1692 wrote to memory of 2380	1692	msedge.exe	113
PID 1692 wrote to memory of 4428	1692	msedge.exe	115
PID 1692 wrote to memory of 4424	1692	msedge.exe	116
PID 1692 wrote to memory of 1488	1692	msedge.exe	117
PID 1692 wrote to memory of 2316	1692	msedge.exe	118
PID 1692 wrote to memory of 2316	1692	msedge.exe	118
PID 1692 wrote to memory of 2316	1692	msedge.exe	118
PID 1692 wrote to memory of 4644	1692	msedge.exe	126
PID 1692 wrote to memory of 4644	1692	msedge.exe	126
PID 1692 wrote to memory of 3524	1692	msedge.exe	127
PID 1692 wrote to memory of 3524	1692	msedge.exe	127
PID 1692 wrote to memory of 3524	1692	msedge.exe	127
PID 1692 wrote to memory of 2580	1692	msedge.exe	130
PID 1692 wrote to memory of 2580	1692	msedge.exe	130
PID 1692 wrote to memory of 1236	1692	msedge.exe	132
PID 1692 wrote to memory of 1840	1692	msedge.exe	133
PID 1692 wrote to memory of 1840	1692	msedge.exe	133
PID 1692 wrote to memory of 1840	1692	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qm.fido.com.vc/requests/?cps=cns
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x2a0,0x7ffbcb1dc188,0x7ffbcb1dc194,0x7ffbcb1dc1a0
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,498161336011013470,12816975947343936758,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11338548835562563604,11042568325886986681,262144 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15478175053423035260,9646975370737167188,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16083659400740259708,4033450486930475428,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3037937305391710838,11976277311919316180,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10647243209458768985,2757100876413044043,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,13036129480801281851,11697815734789061259,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6461201088841040568,6278531962673910719,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6961064791748642725,18139342902752631833,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17466025859301475777,15266109459872755567,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17466025859301475777,15266109459872755567,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,7350755077830004826,13890851752318809386,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5836,i,1375916310334812769,9061194938094410061,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,16629472065023047357,9506360353015367660,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11955502007060272272,4448144829577571474,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,8354923770298302840,17161370552862350854,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4432,i,17282048427049936355,18246594135500649470,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,10734100888671284307,5147042631794418396,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5788,i,11228779252666824464,2179950039987383350,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12462026820794136510,1183731052334446414,524288 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,6837072100437402289,7761603061251098802,262144 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3988,i,3193775790402014415,8017543323172695509,2097152 --field-trial-handle=2452,i,17087777358212825268,13161757106042975918,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 065bff8912a8bcdf17c79fa84c5c721e300f83764d49eaa636e54416e7910e01
MD5 d191b0ce21d08c1f3e00e93cf8c676b2
SHA1 79b121b6320a5fefb72e181cb7e12558c0079238
SHA512 af21d78da0b2d2189a834c58807a269762a2d755daa7adf05134b73d5a45b0786766d68c7d0f0ca62b493d9a95580980f2c7efc59306ff21b8c44f57a6f32798
TLSH
T1F96175AEFF5AD26EF7944070E9EB2B9B393C0DB338C3DD0324ACE67A64463584112064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591880.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591880.TMP
Size 3KB
SHA256 cdf81c0d6baad9b86ccb35d6b5ba3544fa7d34f47a4b5b146fde3adab8ed440d
MD5 654a8dfc5d36b957a327263f2cb243b7
SHA1 dcaa2f141dcd554a19789bb83fd6d87e90e81a8c
SHA512 802ce21cd821c1d54ccb2bb6d3275c4e564f1765fed9e0d0c26f594341d78e81b59825721ca484b4c6da1ea116fa1ce28b7c1cb232a8d1d57c760e586956a05f
TLSH
T14A6153AEFF5AD66EF7944070E9EB2B9B393C1DB338C3DD0324ACE67A64563584112064
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6f64194c8520b5ba657d8fe15c62b3259ab9b2269d4b700c9872aff77d9426c3
MD5 ce453d9808b6e909b1eab6f09bc514cc
SHA1 69b001e616bb675ad5f87d66affc6fe2dd2ec3e5
SHA512 94f95248e076a6e108b0f433f2aafa7c37225c4267865114226d91ba35f92c6588ea681a0e6cc73d7541025f018bbe347eeaa13030abfffa71a65e958152c8d3
TLSH
T110117DB3C3D585AE8A011AF06A24EE2BCE2D0505422C7C19D5D4EF2BD3E3075D10299B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f8bb97ee3e6096e523a9fc36e5222494f40ca6b68eb77c1f067ce3dbdfc711f9
MD5 74464e634c4dc50f3f56f2f3fef0e8c0
SHA1 6bdb4aa0fc995c6d1b7c0b8d96ac7fbf62d041c3
SHA512 e70f2ea08b5fd2cba50325fbd5c77528ce6b46a1e80c18718f7d3498ac472569a97a7df00e097af215634671ab708d96601c541c8edf4a192b5810667bb448a3
SSDEEP 192:sxZlRYW4/f8sOD3IdpJHW6+WNGYrVi+4IgrJ:sxZlR4/f8sODYJHbGLh9
TLSH
T1F912B6566E28A53B8CCBD30DBB29BF13D6F9503251941E58FAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b36a8d8989d78a417c07922efeaeed005ef389ee93990388e361dffdc3aa82b8
MD5 bbd53fa6622303cd3d13fbb9be6deaf6
SHA1 93b7e056e5ab9d329e8d4e21d9e21e16c08fdeec
SHA512 ab7bce437b549ee7949044691b3650d9557a49ebaee3ed4b85475e8ff6337ddd87c325a456f3e92388fed28c723ccc36659e6cbd0ab2a1bca1b74e138fd91dc1
SSDEEP 192:sxZlRYW4/f8soDaIdphLHW6+WNGYr5Ei+4Ig5oJ:sxZlR4/f8soDztHbGChu
TLSH
T1BD22B7566E28A97B8CCBE30DBB15BF53D6F9503251941E48B6FC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dc210b93c5a9c9b24fbce9c5d7949a48dc0e91697adde5a70cc0cc3e9d1d577d
MD5 3bb9157ec3388b28ff556cb8beac92a0
SHA1 c5156b3fdcbf9291871c7540cb4b4bbdc22bc784
SHA512 6ef26ce64c77ab251840145c83506a0196ab3b9a4073bc23eac320d4fb110cf203a8607e9d18d2aee97f28e8781c11b189d7c5a5f33408d1ca5c74a93480bdbb
SSDEEP 192:sxZlRYW4/f8ssDaIdpbLHW6+WNGYrbi+4Ig5CJ:sxZlR4/f8ssDzPHbGfhE
TLSH
T1AF22A6566E28A57B8CCBD30DBB15BF13D6F9503251941E58BAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5bb520178d62d9eefdd4c2686a126026d68eb5dccaee1e23517838cbe9ef4285
MD5 97c2a6d700942c87ebbfd12b0500a4a6
SHA1 a492acc0b6a82e6062d67b12b9bb4acd0e53af09
SHA512 01adeed54455f1467149cdf14a6c3bcbf102df3918d84afdbd60e3009732d88606503175d69e3a0da369ae9089d6f584af0d188cd37f81ceb948305c01e26e7b
SSDEEP 192:sxZlRYW4/f8soDaIdpbLHW6+WNGYrw3i+4Ig5oJ:sxZlR4/f8soDzPHbG0hu
TLSH
T18A22B7566E28A97B8CCBE30DBB15BF53E6F9503251941E58B6FC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f1de897fead30152c38dbefdc6fe6bf0517097bb698a011ad27b5df4ae61f7ab
MD5 84f31ca97372172d738c231acd9fe5ae
SHA1 26de971771d26732da827d835203c2561e038800
SHA512 4360e1948d37e6a512019ad88d245a60c77184c164872c1027359a1866914316fd8918252a79f82a4a7cde46d1316b84922fc45e327941f5e1f1b78e87fff7db
SSDEEP 768:V+y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb6roRog:V+y4J/DWvbtBhu1jajiLm0bxig
TLSH
T128C2FA3B684CCA7E4FC01A9DED5E6F973E9802C7A6948D4047FA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

941009ce-a474-448b-bb88-70cab335ef8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\941009ce-a474-448b-bb88-70cab335ef8c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9e5016dda3f39dd2adc4e4113a7f7ea37d9ed46597e2d26eec05212c7ab7b7fb
MD5 337782cd13ab4eb6f79da94f1c9036cf
SHA1 0b488dd3e6161976c48f52bbffa017eccf04f3b1
SHA512 d5f9d7b04c6892c5844afb7453cd4bebe45b27a8808a10e16ee5a8b3767f1703b90d6f15fc873722660bd343994ee670d87f930db3d36d5a69191cf1c017d63b
SSDEEP 384:bZcIhsNNUy0eyZARHuHX58EN8vAU0Xf+26etgOIwZOyL8os:DhKy2IaTcfl6eXsVf
TLSH
T1C0828E32A878AD376CF7E205B58A36034FB85067D6C56F80D5FD1B1E01EA699130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0499c54fe82614078385193997a0a0acbd443c708d6374e61b6353d4ddb9e6f1
MD5 d0d139cfba9a6a7adf736198cab55879
SHA1 af494aac27433df36c9a3bd401dddc1627f7184e
SHA512 78f56d5d42ba04342b7636bc5f7fb785e28a710a75b706716adf9814886a6016a47777d24b2274a585cf1d7981568c106702563ab0051de0fc56f6cefb5e3b09
SSDEEP 192:1ONV6wlDgQmiUyckW4X58gZxjzorvA7wbDlMYU6:1ONV6kgkW4X58EN8vAU91U6
TLSH
T12002D735F968BC6B8EF2AE49F48A26139FE5106BE6552F80CAE81A1D00D765C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2592477447037f8201b0a81ccd52da9c1a4d57b1fcced21de2bb84cdca5a202a
MD5 bdf7e174583dad860da4170cf2ebd9c8
SHA1 838a06c7881de238eca59d5e6585f190a0490651
SHA512 f1da2b0a2a4c6e9a4926599ff328f13c5eb44ba0df7a3ded322c776cdb344f9b4b3ba4f6c741ce5c6e2ce7e5bc59d7a9ef644ca158d8d2408d6bdb6010f8d131
SSDEEP 384:aiFiZcIezsN+8TUNTUlIlf0eyZARHuHX58EN8vAU0Xf+29etgOIwZOyL8os:RFQ+nwg/y2IaTcfl9eXsVf
TLSH
T19FA26C3398A8DD3BADFB9744F54A32038FB95067D6C5AB90E3ED5B1D00A619C034BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 68107bff6beb8be4839113d23c6a95afca8dc3b7949fe09db95f096bebc81daa
MD5 71fa04d91396f54569b15d371aa56709
SHA1 21f121b24a7b53887a1d84bd27bf7435375c2c20
SHA512 c13ed110d2a819bbf4f6831fe9022a786725f0dfa3fc70c7b0f64d2477e26f5f2b56804758f4d2fda6cadadd35a7923a2b0f90e45283ab471b8e2588cc48bcf5
SSDEEP 384:5ZcIhsNNUf0eyZARHuHX58EN8vAU0Xf+26etgOIwZOyL8os:Rhny2IaTcfl6eXsVf
TLSH
T127828E32A8789D376CE7E204B58A36038FB85067D7C56F80D6FD1B1E01EA699130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0cc143aa6f86e103bb9f7fa6967f8870f67fb0dbc6ebeb9afd613c66a1f95c7d
MD5 077bd0dc447cd0e0cae836547168fcad
SHA1 88d4a23c6c6865c669b0835a3c6c7ce59f70e080
SHA512 00ba946b72b9b5ceee7fbaaf4423142325400671a1576098dcf2dee612e2d4f4c94d15cfa90fd6895b796479ff3cd547d21068eb268bc9236ce495550fdd990a
SSDEEP 192:1ONn6wlD2QmiUyckq4X58gZxjzorvA7w0XN7R+2Ovep/MU6:1ONn6kS+q4X58EN8vAU0Xf+2heU6
TLSH
T178121735F468BC3B5DE2A549B08B36039FE55127EA897F80D6EC1B2C01EB66C534B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

823f58ab-df66-4c94-aa1a-7ed91d327e96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\823f58ab-df66-4c94-aa1a-7ed91d327e96.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad465f2aab88d28f3517e3207d808212a21315b61339d0e19f3c91fb99abcd41
MD5 798f39ef7f8e8df685f55b9dec5ab5a6
SHA1 c90b79928affa9341cc054eec16e374f12735e44
SHA512 0e69bde91376ccf9f5fb02f1ef9c2d5c92dfa91992c8df8c791a7638152c0bc4390d3d22ff146829e8173c1b22fc6a798fc6f5477a8a9c758d13e6f24aad8e56
TLSH
T13B410758A7FA1118B3B76E4AAFF7A86D447FB8772F0AD49D10410D8E0662A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download