hxxp://r4z9x0m6q2n8b1d5kv[.]live

Analysis

user interaction
yes
max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://r4z9x0m6q2n8b1d5kv.live
Sample260930-s44p4aydld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{13633F92-FBCE-4CCE-8C50-D15847950DBC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4216	3076	msedge.exe	85
PID 3076 wrote to memory of 452	3076	msedge.exe	86
PID 3076 wrote to memory of 532	3076	msedge.exe	87
PID 3076 wrote to memory of 532	3076	msedge.exe	87
PID 3076 wrote to memory of 532	3076	msedge.exe	87
PID 3076 wrote to memory of 3120	3076	msedge.exe	89
PID 3076 wrote to memory of 3120	3076	msedge.exe	89
PID 3076 wrote to memory of 1712	3076	msedge.exe	90
PID 3076 wrote to memory of 3112	3076	msedge.exe	91
PID 3076 wrote to memory of 1712	3076	msedge.exe	90
PID 3076 wrote to memory of 1712	3076	msedge.exe	90
PID 3076 wrote to memory of 3112	3076	msedge.exe	91
PID 3076 wrote to memory of 3112	3076	msedge.exe	91
PID 3076 wrote to memory of 3884	3076	msedge.exe	92
PID 3076 wrote to memory of 3884	3076	msedge.exe	92
PID 3076 wrote to memory of 3884	3076	msedge.exe	92
PID 3076 wrote to memory of 3912	3076	msedge.exe	93
PID 3076 wrote to memory of 3912	3076	msedge.exe	93
PID 3076 wrote to memory of 3912	3076	msedge.exe	93
PID 3076 wrote to memory of 4968	3076	msedge.exe	95
PID 3076 wrote to memory of 4968	3076	msedge.exe	95
PID 3076 wrote to memory of 4968	3076	msedge.exe	95
PID 3076 wrote to memory of 1824	3076	msedge.exe	98
PID 3076 wrote to memory of 1824	3076	msedge.exe	98
PID 3076 wrote to memory of 1824	3076	msedge.exe	98
PID 3076 wrote to memory of 3220	3076	msedge.exe	99
PID 3076 wrote to memory of 3220	3076	msedge.exe	99
PID 3076 wrote to memory of 616	3076	msedge.exe	100
PID 3076 wrote to memory of 616	3076	msedge.exe	100
PID 3076 wrote to memory of 3300	3076	msedge.exe	103
PID 3076 wrote to memory of 1468	3076	msedge.exe	111
PID 3076 wrote to memory of 1468	3076	msedge.exe	111
PID 3076 wrote to memory of 1468	3076	msedge.exe	111
PID 3076 wrote to memory of 4828	3076	msedge.exe	120
PID 3076 wrote to memory of 1868	3076	msedge.exe	121
PID 3076 wrote to memory of 3276	3076	msedge.exe	122
PID 3076 wrote to memory of 4756	3076	msedge.exe	124
PID 3076 wrote to memory of 4756	3076	msedge.exe	124
PID 3076 wrote to memory of 3460	3076	msedge.exe	125
PID 3076 wrote to memory of 3460	3076	msedge.exe	125
PID 3076 wrote to memory of 3460	3076	msedge.exe	125
PID 3076 wrote to memory of 792	3076	msedge.exe	128
PID 3076 wrote to memory of 792	3076	msedge.exe	128
PID 3076 wrote to memory of 3848	3076	msedge.exe	129
PID 3076 wrote to memory of 3848	3076	msedge.exe	129
PID 3076 wrote to memory of 1152	3076	msedge.exe	131
PID 3076 wrote to memory of 1152	3076	msedge.exe	131
PID 3076 wrote to memory of 1152	3076	msedge.exe	131
PID 3076 wrote to memory of 3192	3076	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://r4z9x0m6q2n8b1d5kv.live
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a0
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,11640699314103559137,1777629723519012392,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,13875140701766052733,3354915795866247529,262144 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,8489444433164080524,7409309206477007066,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15824233586735245293,18291119008901219125,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5622614832376551125,7032475378271617061,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,15846386313349216440,3884573387057743472,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,14869625753294367910,11330191957926323162,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3628,i,1949067022231484924,3435032251868298910,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5044,i,2849815540348352048,4777882269969506209,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,6589088033887620305,5069972913710446546,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,179385712563374279,3923847436926454231,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16036287822306871755,5050289603482170342,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16036287822306871755,5050289603482170342,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6204,i,7187722273653774539,17849204267971894226,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,15102201406771681649,6610297893471013032,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,8868771749580581366,5913753216732394090,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,11510248135839849243,9467216242472251876,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2808,i,5165008709957874829,14859223870918939784,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5316,i,12524185440583318555,15115095258649592937,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3264,i,14519843441092310907,13471359141968205869,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,16591755853961514155,10698549498759529908,524288 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=748,i,10905159933531931777,10980377002320830992,2097152 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5668,i,9642272270722928738,8047362375830466192,262144 --field-trial-handle=2316,i,3158887262186386278,1074340026083183775,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ff88af895bf489bc155a2863fa0c4699d7beeeb53a093e85b57bd5ecd6e88132
MD5 a751b01cf494be9403ec0945a9fc94e4
SHA1 37200623c51330d80dc70b1f2f04728f362b6d95
SHA512 c5fe244aee30fb853a608c3c6846977b46a9c523ec91b406afe96c76103f663897238b86f885ec6ceca0833a7f8844253f1b7f29eb3ee69b884bc09087e5b517
TLSH
T14CE04F98AECEC36EE218A4C741689B5C8A943B1ED7D8AE4A57048C847141558B7A6AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3b7a5391b68f24b1a540a9cb6218160fdf4ed09e74303decde313ab3d04d853f
MD5 40fac23513462a9e5e35b600bac225f9
SHA1 883e8ef4babf3b8e40ac60af46b9b6c1919113c3
SHA512 63b9c81a2c1414b1fa22a6d1ddac871991afbea3c1124686d611f16b12e07a9f1906018407362f7d4624eecb0fa6c7175705c2589fa0c0561b8f05d0cc34b589
TLSH
T1E361FD816C404E64FF965F78A3F622FF35B5F0815AF3AD9D31B8C4799466758920434C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a83.TMP
Size 3KB
SHA256 748cd2d3202e7f12838554f3bd12da37df23120eae85dcb854e858173c576577
MD5 55ea950bc18bd5069b0e1435fdc11b86
SHA1 7eb96fb3682c4d1dd9544ce5ef1c790d1c81e265
SHA512 b2d3c8dec3af8fc7a834e839ce79709b54d6aca31353145437b62570c6d1be3d27307d1f27278749154bd484e6bd56f25d1157eb7d452bb9af89ee6c21398a37
TLSH
T13B61EC806C408E64FF965F78A3F622FF36B5F0815AF3AD9E31B8C478A466758920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 41e832021a956b3f1b2a48bf8de02366af1a4e9473f367fc946e10a729a1778e
MD5 ac680b940216e5ac15e03c1caa6e2586
SHA1 5473033571a47b955871839fb58d941ca068bcc9
SHA512 6d9bb4e95d8a9d35f7dabef526920d69f4b18f72ecd9540a984dfbcbd65506e750a2b333c1166f1185592f6ae9c2181f9de0c4fd8907c69fb9b546cf6624283f
TLSH
T135117AF3C3D585AE891116F05A24EE2BCE2D0606425C7C1989D4EF2B93E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c9d5338fb52aeca0c96fb4d17336da35f8732f4b033f85a59ba364ca3fe1f192
MD5 568fdb52ae859f3720d0a305239e9e80
SHA1 43fb01922bf6f1f4f83d4931dd5e0aafcb534dc9
SHA512 75930c526b6b615fe98709bdf286c87b156e777c8ed6f93e7b371188b31fea2560ee372cf6e218c8423a3e6ac95d71271d6680ed9391d796557e31fe4c5f46c1
SSDEEP 192:sxZqROW//fssZeIdpi/H6l6+WNGY36a3bIgrJ:sxZqr//fssZPYH7GXA9
TLSH
T1DD22C9526E68A97B8CCBD20DBA25BF53E6F95032A1D50E48EAFC851C04E66DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8db177ce2ae7f437ccdf69992b900966aeddf3b96f052b26dad2ff9268a4b5d9
MD5 5a368b8a47e2083a6a2231f243a48373
SHA1 1badfe155c3ca07673018c6fa9a476ea80442458
SHA512 538b835306acce44c57fe2e5b99c466c8570b04e5981b0ece686bca5e90a7da027ebe9cea2e540e09b0bb3c4225c1ad13a1be98cd46163ed2b56f5f751540f75
SSDEEP 192:sxZqROW//fssa1eIdpw/H6V6+WNGY36X3bIg56J:sxZqr//fssa1P6HDGXT0
TLSH
T14222CA526E68697B8CCBD21DBA25BF53E6F9503251D10E48AAFCC61C05E76DE1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 300cc1659e88378d6c88a4170ab5cd34b70a0eb54254793d9bd8f128972360de
MD5 5d07dfc34b94516de36e648633591641
SHA1 2357db455129316c5ecfd5f5e49913585ac758a5
SHA512 02cf43c337003bcfcd23f0d30f48a40ca8ff7f110562773509e55ce31d63c5152cc37f18708f8bd57b3cc5dbe2101dad59acd9447ed4d4fa732b64ba4fe84813
SSDEEP 192:sxZqROW//fssaKeIdpi/H6l6+WNGY36a3bIg5YJ:sxZqr//fssaKPYH7GXA2
TLSH
T1AF22DA526E68697B8CCBD20DBB25BF53E6F95032A1D50E88EAFC851C04E66DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e7e1d6c34c69edbc96d26e9164009c4bb433b71ef6e8d57b7918f829b0930f32
MD5 dbf6574d1e3828ffb2d8b76cf4178b7b
SHA1 38b65597b5a8d329d56c192ef44cf6fc3b08aa65
SHA512 2e333e8819486a34952a7043f52b24cd1375bf11bc20c7e25706cc447f0bab5e485984975e768aae24c8b547975913d45f02827bb5b8fee8b9cb2c63d7097bac
SSDEEP 192:sxZqROW//fssa1eIdpi/H6V6+WNGY36W3bIg56J:sxZqr//fssa1PYHDGX80
TLSH
T1AF22C9526E68697B8CCBE20DBA25BF53E6F9503251D50E58AAFCC61C05E76CE1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 992ef0d133e9351cc75bf623ddd7ee9474dce69d83ece30cc79f89d2004fa127
MD5 8fc4afed1ed298e93c88c2033d7cafaa
SHA1 e622c50743cba2ab08a7fc490ec2e63802fa4c9a
SHA512 cc30b53ec5f83d7287e0893d79ceef263a34c89bb82eeb4c8346b925190977f7d25fae06c12bb3fa9fbcb83e1ee1d4c89f1989f7ba80b9693e4f0784a0f802b9
SSDEEP 768:kOKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/xroVid:kOKlm7QWvUYe0u1ja8/L/E/KVid
TLSH
T1C8C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c639b84-ca47-4c4f-ace5-fd91a7a8bf4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4c639b84-ca47-4c4f-ace5-fd91a7a8bf4d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a1c46d64a6b2ef4b9d780143a274855380b28d719bfe271c890639c790624489
MD5 46ab9ca547d98471a479b527720fbacd
SHA1 71856478f8ae3ea458aad23a8a81319679004753
SHA512 e30758798617458247515ad1c9b088d8326494e56c9bca9c6e6a214edd076f6d6afebdf91df2543a886560924d01b75d9d694c3fdc8be78590af2aa93586569f
SSDEEP 384:kZcIhsNmWM/gbTOt4h//Pe/DtgOIwZOyMpok:ChQitE/WDXsXr
TLSH
T19E827D329CB8ACBA5DE7E144F58737139FB48467A7C56F8499EC6B1D01DA1AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f75721a214dd01a151324cd7669c25cb5da9977ac856c3e288b3fb4ab827d378
MD5 41b54b414dadf97fa1b5e50f48a14b26
SHA1 52837a164eb1c1a82ff8fb82c7dc2fd7911e1d23
SHA512 9da16f7c8530a5e969362af91ac7cd41a69596733eb3b359450ac5378d1a885b757dd17843337351e436c77c768fea12d74327c851caa5adfb9bc0914d67ae65
SSDEEP 384:CiFiZcICzsNm8TUNTUlIl1M/gbTOt4h//PepDtgOIwZOyMpok:JFQKLwgnitE/uDXsXr
TLSH
T161A26C339CA89CBBADE79A44F58B33139EB440A7D6C5AA94E6DC5A1D01D71DC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 03162bf8f19171fa236ad41709c740b630e0a683eadf42531219afc8b451e925
MD5 57cc14e62c2a52e2cab8f79b594d5830
SHA1 8e975cf4a3de5e48da7fe8a98d42b81652901fd5
SHA512 c79121f7667cf2dfa1ff169386af2bddc05fffd20019deeffeee95743826f4625612f1113f1f9f247138efb60165eff3d91f1d8b2f819a259a62af59ab78df40
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5laDDBKP4v+Y1xf//ojdexBywvBCdq:BONX6JUm0QmiUymdso//3ywvBCJ/VSU6
TLSH
T12002E938BC687CBB8EF3AE45B48777235FA4106BA6952F84DAD81E1D01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b228096651704f209787658bbe69f134a3dd41a9c1ddc9cfc8d64b35701dfd1f
MD5 b26ed9b65e47429ff60b3bbfa3823275
SHA1 54683a54a5a2928b7de2f81f04f1cb4552baf39d
SHA512 9e4d77fd7fa396d4e36cb372fdfae93893646d6b34e55ed885ccd3b6fbec487fcfe4611a136aeddd38b27c23de49a000cdfd821027c940cb6352e284c63d81b0
SSDEEP 384:SZcIhsNm1M/gbTOt4h//Pe/DtgOIwZOyMpok:gh7itE/WDXsXr
TLSH
T1D1827D32ACB8ACBA5DE7E144F58733139FB48067A7C56F8499EC6B1D01D61AC030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57c7bca6e5188fcb1a760a47efe4fd0273480b045e4e68583e14e5587a201bb3
MD5 4c50d7f20541735babbd8e60455a9d51
SHA1 866edaaab26cf84d77499171e4fee1c23c4f5121
SHA512 a3a43d52ccbb8907c9d1f4fa0bf1f0be4d5cabff2c11da649457e7157f8d2dc36afa40f7d2fa275ea5e3b395f73958077ed016d8a5fad4e9192e57022e9becb1
SSDEEP 192:BONn6JU8QmiUyHdbGo//3ywenezKNxNcqbU6:BONn6+MiSo//Pe9DU6
TLSH
T19712FA35B8787C7B5EE3A950B48737235E644167EBC96F90D6DC2A1C01DB19C530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3356c5e-1c31-4aa2-8431-666c35aefa90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f3356c5e-1c31-4aa2-8431-666c35aefa90.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5315d01e302351ff827f0fa891e08d545118b1aaae95b5c079f0a3b287176cb
MD5 9716a88d1f5ef7d42c2fca5112fe0bb7
SHA1 cddcdb0f676fc0ad06aa42181900b0db2d76b997
SHA512 fccff5ea259198e89818bc5aaca15e860707414d5037e9c905f31d4b55e5c34853ad9c39b6543de94721bedb76cb3267ea8eaedf2f530c0e856dec17606e301b
TLSH
T157410B58B6EA1148B3B77E5A9BF7A46E487E79732E07D55D00110D4F0A23A40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download