hxxp://xzilio[.]com

Resubmissions

30/09/2026, 09:25

260930-ldvaeas13p3

30/09/2026, 09:21

260930-lbvhdssy8n3

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://xzilio.com
Sample260930-ldvaeas13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{C88806B8-2B4E-4CDA-AA53-4CA9C8D7A451}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4068	2216	msedge.exe	87
PID 2216 wrote to memory of 2816	2216	msedge.exe	89
PID 2216 wrote to memory of 2900	2216	msedge.exe	90
PID 2216 wrote to memory of 2900	2216	msedge.exe	90
PID 2216 wrote to memory of 2900	2216	msedge.exe	90
PID 2216 wrote to memory of 1716	2216	msedge.exe	91
PID 2216 wrote to memory of 1716	2216	msedge.exe	91
PID 2216 wrote to memory of 3756	2216	msedge.exe	92
PID 2216 wrote to memory of 3756	2216	msedge.exe	92
PID 2216 wrote to memory of 3756	2216	msedge.exe	92
PID 2216 wrote to memory of 936	2216	msedge.exe	93
PID 2216 wrote to memory of 936	2216	msedge.exe	93
PID 2216 wrote to memory of 936	2216	msedge.exe	93
PID 2216 wrote to memory of 3196	2216	msedge.exe	94
PID 2216 wrote to memory of 3196	2216	msedge.exe	94
PID 2216 wrote to memory of 3196	2216	msedge.exe	94
PID 2216 wrote to memory of 1580	2216	msedge.exe	95
PID 2216 wrote to memory of 1580	2216	msedge.exe	95
PID 2216 wrote to memory of 1580	2216	msedge.exe	95
PID 2216 wrote to memory of 5108	2216	msedge.exe	99
PID 2216 wrote to memory of 5108	2216	msedge.exe	99
PID 2216 wrote to memory of 5108	2216	msedge.exe	99
PID 2216 wrote to memory of 1564	2216	msedge.exe	101
PID 2216 wrote to memory of 1564	2216	msedge.exe	101
PID 2216 wrote to memory of 1564	2216	msedge.exe	101
PID 2216 wrote to memory of 4200	2216	msedge.exe	102
PID 2216 wrote to memory of 4200	2216	msedge.exe	102
PID 2216 wrote to memory of 4940	2216	msedge.exe	103
PID 2216 wrote to memory of 4940	2216	msedge.exe	103
PID 2216 wrote to memory of 1704	2216	msedge.exe	105
PID 2216 wrote to memory of 1664	2216	msedge.exe	114
PID 2216 wrote to memory of 1664	2216	msedge.exe	114
PID 2216 wrote to memory of 1664	2216	msedge.exe	114
PID 2216 wrote to memory of 4236	2216	msedge.exe	120
PID 2216 wrote to memory of 2396	2216	msedge.exe	121
PID 2216 wrote to memory of 4780	2216	msedge.exe	122
PID 2216 wrote to memory of 3504	2216	msedge.exe	125
PID 2216 wrote to memory of 3504	2216	msedge.exe	125
PID 2216 wrote to memory of 3504	2216	msedge.exe	125
PID 2216 wrote to memory of 116	2216	msedge.exe	126
PID 2216 wrote to memory of 116	2216	msedge.exe	126
PID 2216 wrote to memory of 2284	2216	msedge.exe	129
PID 2216 wrote to memory of 2284	2216	msedge.exe	129
PID 2216 wrote to memory of 2352	2216	msedge.exe	130
PID 2216 wrote to memory of 2352	2216	msedge.exe	130
PID 2216 wrote to memory of 2352	2216	msedge.exe	130
PID 2216 wrote to memory of 3156	2216	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://xzilio.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7fff501cc188,0x7fff501cc194,0x7fff501cc1a0
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17552155559159283607,13180860685256799946,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4693890324236808470,16425201145348272623,262144 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,4392508534768816298,5694502044678617245,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7167616301334128695,6419221650598948609,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3024067204121116112,8620530586716451467,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,14860936098856371615,3777565320907006101,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,6709986364659040568,9942831367519605227,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,14851079773404797655,497375580081679031,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3400,i,5020526422860004355,17023663275271842569,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,5614820411447350897,13552970202758663723,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6746754988935271978,4283183924467527151,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12640701653306633792,14833381814931169930,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12640701653306633792,14833381814931169930,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5132,i,12882145483007834841,1241631834421881538,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,17189135662878165219,5451982593717230213,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,13767133475960758256,10529815646067122203,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,16072097184733897664,13742284469538468914,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4900,i,17101733161249487817,360667959103491303,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10344264117866344167,5392478965737635052,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13090177703038054094,9170739472015411291,524288 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=716 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5420,i,18403389883154873705,11765101669791493006,2097152 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4896,i,8982747395355644524,13521163336841778827,262144 --field-trial-handle=2288,i,698734278303242625,12679490015416923815,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cdf5cb6ff7c3c1771af10dfb6d49f127db2417c075623fa542b98f40d8a506ed
MD5 0fe1f8109294afa22b0a6272620372d9
SHA1 58f34bf75b2a53d0244fef55250595dba0c74198
SHA512 ad6c524b7dbac7b8eafd2448062aab3aadc39c257ca303484f7443aaf9dd40dbe3a8b168a2b19b2669fec9254c1a3293c589af0f15e80abc4a17b0085ae0759d
TLSH
T14361A14DD2AC9575FB68013F77D600EBF33099E04CCFDE429DA4D83A9846B249A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fa3a.TMP
Size 3KB
SHA256 b1638d23ad926e37afd0ca26dfb96b5979bb376889ed8a2a0b51014506532661
MD5 8546202d570187ace89470baf8718f84
SHA1 21a884f0a1d03b977bc2ace3e36dd398937679eb
SHA512 8a94649e1e169dd8acf25d02c52ff4709a9c9d1403121371ebb6c5b314f21251888fa0aacad66b6297250fa48183ae7a316f4ca0aad8cae5830dd6341c7a854b
TLSH
T15A61A14DD2AC8574FB68003F77D600EBF33089E04CCFDE529CA8C83A98467159A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 49f43b6f0372319d73b1c74f345a5a67394b9a20549fef2b106a11b9a6a45df1
MD5 a9ff27dbbdadd8aa6673dd3c48094999
SHA1 096c4166684c216dacdd16db4df6dba92a2d42d7
SHA512 b5ce09454c62e4acc5ebe8e2e1679235e5f86c2470a8f35c01437f0154ace6ccfcd560bd11eb21c1cffbdac1eee1c95cd603a2e6d4d2764273070d4bd993bc95
TLSH
T12C117DF3C3D585AE890556F0AA24EE2BCE2D0505421C7C19C9D4EF2B93E3075D10199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f2c40c259c474eb4819da09f4212cccc4d98724ece12a73da55d18ac73473e00
MD5 0becd6f0ec2b7576af7b5e5a6d1adcc4
SHA1 91b7454ccc7a2471bd0e36615e9572934c7b2ae8
SHA512 187f853b9730ab7253354a477ff28a49cf1af39bab52f081baf5fc4c57da1397dc8fb656643f2dc3e9ee10fe472935fbfdaaea501d650aedbe8e9ba8d885a0be
SSDEEP 192:sxZIdR0Wf/f1usrdIdpGoHo06+WNGYgUddIgrJ:sxZ+hf/fksrevHaGO9
TLSH
T1A112B8526E38A97B8CC7D20DBB55BF53E6F9503261D51E58EAFC861C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f27c5fa47da196f381604d12692bf863a2f59977a8bced54a7d8d12a929d5665
MD5 41c5531785c713909300f1226d0a01aa
SHA1 24078add3625f1d19db1fc990abbfcb55288de97
SHA512 86b2e87abe48860f3cd75976bdf6492cfbe28e3c39905e9885356e3bea0af1d39c7604e32acf0cdce4e82247d866fe1712b306230017b180a8641c2d5df0b3a0
SSDEEP 192:sxZIdR0Wf/f1usbdIdpsoHoI6+WNGYgsddIg5ZJ:sxZ+hf/fksbetHuGSR
TLSH
T1DD22B9526E38697B8CC7D21DBA55BF53E2F9507161D11E48E6FC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 80a9fdd64447a91942d55083f453de3d13161323406599c257ff73ee98083365
MD5 f6d81767b701486f04880e01fa2695a6
SHA1 88eb53276d98970b45d62fd0f4eb1604706cc0b6
SHA512 a00c246f4ba007bc0bb3cfcb68c747df6abd4b2b7e0e615dc5f9ba21c3eb942073b629d414d61af74c2bca1b496d2e7c64f864358a6e1f74e0a23b28deed68ae
SSDEEP 192:sxZIdR0Wf/f1usbdIdpGoHoI6+WNGYg5ddIg5ZJ:sxZ+hf/fksbevHuGnR
TLSH
T16C22B8526E2869BB8CC7D21DBB55BF53E6F9503261D11E48E6FC862C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 88c2f6f702f86cdb1fe0305e535514ef6be00b7bcb105324a9626eab0849ae50
MD5 7be5c44ea9e441f04ddd48987c170b6c
SHA1 85244dcdd8a665fe061deecce49cbd0385050c95
SHA512 427d117ecc15b06ef97a668f591f6f01ad21af3e7d274d196a444599f09f3d067a282c9c67d04c1a7abdfd4d9e3afa0b99bb79e8925f6b040a1767abc9e4419e
SSDEEP 192:sxZIdR0Wf/f1usOdIdpGoHo06+WNGYgUddIg57J:sxZ+hf/fksOevHaGOP
TLSH
T1C222B8526E38A97B8CC7D21DBB55BF53D6F9103261D11E58EAFC862C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dd56b3b2d406cf5fdd3fc0c3bda6e221d2e4726a8c2aa75483d946ff23194bf3
MD5 4ff66ba575f3202e040bc28093f1a1a4
SHA1 02386b6e92740ee473c5ed89059539b03c8ee4c0
SHA512 58b3e7ed267849110775304cf6ad8ea1e0f0ffe94cb0f012431915b08ae665f7a28cd37fdc6221460ad6ef1fefb5b42207090c3a6b0febe5bb215c5f4d1e31ed
SSDEEP 768:tqichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzSrot+i:tqichfPWvPZplu1jan+LKgzJgi
TLSH
T14EC2F93B640CCB7E4FC00A9DDD5A6F9B7EA802D7A6588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43aa75fd79bc8f77c1107d86de97ca4eb91394ad9628a8d716012e2a093a189b
MD5 8250ef135b65f8615e3fce8355826c58
SHA1 20fc4d0857bfbdbdfe700ce0f3139b856af85f33
SHA512 48bc0c4e55a1732ea34c2cd9a54c3f4e8bb7ea5b5532b6fd34bc35e73a1709451dc41e6b48d761725209efbb3b165cee3a6721711d404f8b8d2b23866c1df43b
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLL5LILVLpLzL3LLLkbL3LSLPISLBLkH:KgHyKoUW6KgKPKU8wKFmeZ
TLSH
T15C91012271BB1352797D695C9069971F425131A33254EE2B7FBD00A18F6FE148CFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e86b696-1a6b-4384-9cd2-a57171d6ddf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e86b696-1a6b-4384-9cd2-a57171d6ddf0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ddb4447a1e6d46dd1217d2952dc0a65cf419ab201c3d1272adf82446eaafba21
MD5 338a667ebcf69d2e1d81a9ac928c4a98
SHA1 f31832cd933c42e696bf75701a999309958b8812
SHA512 8a56ce2f317c7c78ecbb146cfeb302966ce5f308d67dca44c460f29a447a2cc13b3a8ab325de36cd96ac96151418efe5154038032f68abf1abe3f87a830f1941
SSDEEP 384:xZcIhsNm5eV5OVB/BGYX5E78pxa++2lDVZh6DKhHEWoZ:ZhiVM3JGYu7WjllDfYGHj6
TLSH
T1BE827D7298785CB74CF7A185F8872A039FB89117B7C56B84D1EC6B1D01EB698230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 91c7e87f5bf54223a399bc1c1f17f9988ec1cbedbc6c69789667579b5261cebc
MD5 d2479a6ec72de8733ad7cf5e9e09b765
SHA1 677bc7081bdf207bb6b771fb285ec1f5dbf25b11
SHA512 469fd158e08c739526477c35ddde108f802325a5758b223ea877445c9aac69f492c804c05f52fcfa9139d31fee50476cc7bc20755c601c06e884a0f35cafb519
SSDEEP 384:5iFiZcIXzsNm8TUNTUlIlAeV5OVB/BGYX5E78pxa++2JDVZh6DKhHEWoZ:QFQDbwgHVM3JGYu7WjlJDfYGHj6
TLSH
T16BA27E7388A8987B5CF79A85F88B36039FB44157D685FB94E2DC5A1D00EB19C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ada1797a63edfb870aa2ae854c3115b59b63ab83e783ae43345f6d5e468f6aa
MD5 877a0f42a40a90f961bab06ee6f8318d
SHA1 0acb7a9fcd64bf24e74c5bde93ef4f32ea6d650b
SHA512 27c2890f59f063d1507818b38b871c87c1dea4893352ae268a075e5c6bed249add7b1dcc52abd4f8309aa680b8cd99453081e833f0b675919544bb2486e759f0
SSDEEP 192:LJONAh6DphmqQmiUySTq8wGYX59eziC8jkk7owxU6:lONAh619JRwGYX5E78bFU6
TLSH
T14502EA35E8787C7B4DE3AE45B58B2B135FE8212BAA906B84D6E81F1D01D764C2307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5ed5d385a813c3bf1ca32e60a6c6b5f8e531d9712f30cd2571c7a1beefadd901
MD5 87a85406d7b298eb2574d0899238d1b9
SHA1 d8102e73919a6deec5a32fabbc6ed50133d7bb36
SHA512 66d84717a9caf5df77ea31fc9cccf1a330f7ef7206f1327d22f622daa13142769b54d391c1db414b6f72d5a6f78cfda632242130a6c5474433e704ddd9bef06b
SSDEEP 384:gZcIhsNmAeV5OVB/BGYX5E78pxa++2lDVZh6DKhHEWoZ:ehbVM3JGYu7WjllDfYGHj6
TLSH
T137827D7298785CB74CF7A185F8872A039FB89117B7C56B84D1EC6B1D01EB698230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c26003172308f967a4e1625990e589fbaa1dfcd7a8dcedfdf3ba0b42283e7f00
MD5 93f58ddfb94cb357a54334d0bdca8d10
SHA1 d530cae8f20d2f603d57dd7fb25aadc2265e1bf1
SHA512 27c2f41b587b8d3204436154be5086accd16f027eb4cc31301c734fa507553a2a031a8a2bc6018eda01e25c4ceb016a871fb2377873b3c88cf0535feadd9b648
SSDEEP 192:LJONP6Dph/qQmiUyCTdwGYX59eziC8px2F++2hkIIWq5JU6:lONP61oDdwGYX5E78pxa++2yDU6
TLSH
T1EA120A36E878AC7B0DE3A591F48B36135FA55227EB847F54D5EC1A1C01DF65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc40430a-f0fe-4256-872e-2e0d38db51f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc40430a-f0fe-4256-872e-2e0d38db51f8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 060ca5121121ce2c183d944e7f9412a785bbb964ab3033c83f56c4a45adb7531
MD5 4013e7439a03b09420cb34a398fd581a
SHA1 d3ebe2816fd2a053571eb8db409f1208b5f1f89e
SHA512 e2b099029d85270cddc520134fac7480d037a036404808592f54361bcd84d5d90fa244da9d095cd5678e1431e87f0325a16cdd6d80fa861af224bc1f81960ee5
TLSH
T151411868BAFA104473737E56ABF2686D487A7D772E4BD59D00110D4E0677B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download