hxxp://catbox[.]moe

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://catbox.moe
Sample261027-pe6xdatxcx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{CE7F53CE-237B-41D4-B028-012EFD314074}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	msedge.exe
2120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3736	4452	msedge.exe	85
PID 4452 wrote to memory of 3320	4452	msedge.exe	86
PID 4452 wrote to memory of 4280	4452	msedge.exe	87
PID 4452 wrote to memory of 4668	4452	msedge.exe	88
PID 4452 wrote to memory of 4280	4452	msedge.exe	87
PID 4452 wrote to memory of 4668	4452	msedge.exe	88
PID 4452 wrote to memory of 4668	4452	msedge.exe	88
PID 4452 wrote to memory of 1972	4452	msedge.exe	90
PID 4452 wrote to memory of 1972	4452	msedge.exe	90
PID 4452 wrote to memory of 1972	4452	msedge.exe	90
PID 4452 wrote to memory of 3968	4452	msedge.exe	91
PID 4452 wrote to memory of 3968	4452	msedge.exe	91
PID 4452 wrote to memory of 3968	4452	msedge.exe	91
PID 4452 wrote to memory of 2052	4452	msedge.exe	92
PID 4452 wrote to memory of 2052	4452	msedge.exe	92
PID 4452 wrote to memory of 2052	4452	msedge.exe	92
PID 4452 wrote to memory of 4616	4452	msedge.exe	93
PID 4452 wrote to memory of 4616	4452	msedge.exe	93
PID 4452 wrote to memory of 4616	4452	msedge.exe	93
PID 4452 wrote to memory of 2428	4452	msedge.exe	98
PID 4452 wrote to memory of 3668	4452	msedge.exe	99
PID 4452 wrote to memory of 2428	4452	msedge.exe	98
PID 4452 wrote to memory of 3668	4452	msedge.exe	99
PID 4452 wrote to memory of 2320	4452	msedge.exe	102
PID 4452 wrote to memory of 3964	4452	msedge.exe	106
PID 4452 wrote to memory of 3964	4452	msedge.exe	106
PID 4452 wrote to memory of 3964	4452	msedge.exe	106
PID 4452 wrote to memory of 3732	4452	msedge.exe	107
PID 4452 wrote to memory of 3732	4452	msedge.exe	107
PID 4452 wrote to memory of 3732	4452	msedge.exe	107
PID 4452 wrote to memory of 3012	4452	msedge.exe	110
PID 4452 wrote to memory of 3012	4452	msedge.exe	110
PID 4452 wrote to memory of 3012	4452	msedge.exe	110
PID 4452 wrote to memory of 4004	4452	msedge.exe	112
PID 4452 wrote to memory of 3448	4452	msedge.exe	113
PID 4452 wrote to memory of 4512	4452	msedge.exe	114
PID 4452 wrote to memory of 4836	4452	msedge.exe	116
PID 4452 wrote to memory of 4836	4452	msedge.exe	116
PID 4452 wrote to memory of 4836	4452	msedge.exe	116
PID 4452 wrote to memory of 3868	4452	msedge.exe	117
PID 4452 wrote to memory of 3868	4452	msedge.exe	117
PID 4452 wrote to memory of 1564	4452	msedge.exe	118
PID 4452 wrote to memory of 1564	4452	msedge.exe	118
PID 4452 wrote to memory of 2120	4452	msedge.exe	119
PID 4452 wrote to memory of 1284	4452	msedge.exe	120
PID 4452 wrote to memory of 1284	4452	msedge.exe	120
PID 4452 wrote to memory of 1284	4452	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://catbox.moe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff97559c188,0x7ff97559c194,0x7ff97559c1a0
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14954138059767787161,14214341061314711209,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,6190720110652969922,16627163801703842087,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,3424801284007510312,7674964339630120132,262144 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,967623530495659931,2706932751090776940,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16485176852457280434,11272832051243695074,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11723251893526144120,10815101308942060054,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,16176136044833945454,11058609484208753171,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3457375621496371595,1381477662766139587,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,8590402004625035302,16695483773294475994,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,392327975398310241,8225139061977301539,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,392327975398310241,8225139061977301539,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,18232982103339063415,16241338172083981986,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6412,i,11356279475073340519,13589672299846185983,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4396,i,863869468257321184,2076620473501776193,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4073433252408194764,1453441837035453722,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2674019000857898437,9217980024392940316,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,2574100347918245190,18077500096314182923,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3000,i,14249764431904397369,8143818880636030690,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4114809194485913362,4213510070708347478,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5281964892576847767,4632456559418655640,524288 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,12663603351271337362,16290898184912556601,262144 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4492,i,4719217893343396693,16842064494872791008,2097152 --field-trial-handle=2412,i,14498312027240529613,15883409963785260337,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

242e492e-6617-4022-8e2c-2622bafcb2ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\242e492e-6617-4022-8e2c-2622bafcb2ac.tmp
Size 8KB
SHA256 6a14009e62a1a8df70b6c970dcd425326211707a6f5a09cb54b233ca498718a6
MD5 4045d72593eacc003a2e54a255ae66e1
SHA1 c9a8f43ea291c490cd8f920e4704c6efac9e3a2e
SHA512 8e5605102fce8e06f980c36e2219e43c0635ff695f4340337d78f2bc86636c59bc4aff1ca5bf1ed67f4fb5887ed5a7fd0dcfa0822af5df735c6bb0966a015389
SSDEEP 192:IONm6nnHIQmiUybbyYcX5hQDP1aOV/CntSJr1g35q52U6:IONm6nIuyNX5+DtaOV/CnsJrqq2U6
TLSH
T1B4120B31B9B4EC774EE3A595B0873213DEA55167E5857BC0D5DC3E1C01EEAAC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51eed225-9d2b-46fc-b4fa-0032b3df73b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\51eed225-9d2b-46fc-b4fa-0032b3df73b5.tmp
Size 18KB
SHA256 46f5e8eda92141c74989c5cbea173b62bebb7df191bd2c125c134c99e2946abe
MD5 836e1d4f1974d3d0429112750f8fa3aa
SHA1 f9a98864e778cc681cf4005c48beeaf751492301
SHA512 8aec27b550f99b59d5c6b08a144213d91d784a31dc48df995dce8e681b5eebbca76a573f3955d8217d8443e94cbdc6cbcc8ca1fd9eed7641ce6b71e437f25576
SSDEEP 384:dJQkUSv0sNLSMPOiG9PuQX5+DtaOV/CnsJrdq2vaTZcAHAIIlJ:dr0RrtkDQOEshdq2vaTZcAHAL/
TLSH
T155827D32A878AC374EE7A660F14A3643DFB4A167D5C46BC4D5CE6F2C01DD6AC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56093542-61b3-4ae7-b363-7b5a28dc40b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56093542-61b3-4ae7-b363-7b5a28dc40b2.tmp
Size 21KB
SHA256 d363cda805b31765217039c414d883618be7a3dbfd30731c96fee10dd277bad1
MD5 a8724c043e41944e0784991205c3ecf7
SHA1 181f9bdc73e6f4a04f7a21fd91ff21fa7a1c40ad
SHA512 67ab47316e41af0e890660742bbd67fee39dfe211321a401eb0da6c95f154bd2c29471d9a527e389c9d84bbba722700401a1c0d8dbde10c9b23cfeec8a2da30f
SSDEEP 384:TLQiFzQkUSvGzsNV8TUNTUlIlzMPOiG9PuQX5+DtaOV/CnsJrBq2vaTZcAHAIIlJ:HrFd2YwgprtkDQOEshBq2vaTZcAHAL/
TLSH
T1FBA25C3298A8DC3B8EA79B50F54A3203DFB49063C985AAD4E6CD6E2C01DE1DC234BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

0850e33b-a4fd-4837-9f38-2bc8474813b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0850e33b-a4fd-4837-9f38-2bc8474813b9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19086bf4-cdb2-4d85-a5aa-9b533499d3ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19086bf4-cdb2-4d85-a5aa-9b533499d3ac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

19e080b0-10a8-4caa-be84-d86280805122.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19e080b0-10a8-4caa-be84-d86280805122.tmp
Size 10KB
SHA256 36200dec358d7dbb0c3cf7ce9a27cf63a89523593cc516575beac0780ac06e67
MD5 494274ffbc9862acc89ea29b7da5bfdb
SHA1 9420e042b4939e8f5788f25b90827838ba210418
SHA512 a31fd8af26256a51dd74ac912d6a801d33027c3e3d5a850f5a43638f18173bcda26fef76a80386e9aa73e84b25675fb112fae770bedfc3abab0c3d122be28112
SSDEEP 192:sxZSREWx/fSsyrIdpG4HAj6+WNGYYBmMFssTIg5TJ:sxZSVx/fSsy0/HPGfIsr/
TLSH
T14622C8516E38A97B8CCBE709BB55BF53E6F9503251911E48A6FCCA1C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27bbabeb-241b-4742-9980-15225fd9361e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27bbabeb-241b-4742-9980-15225fd9361e.tmp
Size 10KB
SHA256 2943fd10e99472c620bc9b41fcb4bc1edc4ac9b441308a25e6b44860760f67c1
MD5 e9de933fc636df23140e98b8551138b0
SHA1 c9fed17032fa57578658bdc45ffbabe229622c35
SHA512 22885682d5e917a10f0ca8e58f043e7a7fbcfc319e6f1d1183343366c493490dbf8c97d136aec40215f3555d8ff870aaed1dba584f1e4819f5adfe4d4031d978
SSDEEP 192:sxZSREWx/fSsyrIdp84HAb6+WNGYYBZzxssTIg5TJ:sxZSVx/fSsy0BHfGfYsr/
TLSH
T18B32C9526E38A97B8CCBD70DBB55BF13E6F9503251901E48A6FCCA1C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38a7e881-c723-4ca0-8fde-0b534e4d49d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38a7e881-c723-4ca0-8fde-0b534e4d49d5.tmp
Size 10KB
SHA256 65ab635381ed72ed237aa926e315429bc9de72d15b1de3bfc2383d0d11307723
MD5 1607deecd0bab855a29ae66a8f0a9667
SHA1 d80291ae679aa5f2c92f7476b473a51935183bef
SHA512 6455258efc818599bcf41390c5c74d9a51ed5d6478d7c46db384d51fecf2ba7f6d8b7fc2b1fb386c1914cc0ca90a704345e67d3a00a3918458a0a6b046c3b2d7
SSDEEP 192:sxZSREWx/fSsGrIdpG4HAX6+WNGYYB1GFssTIgrJ:sxZSVx/fSsG0/HjGflsr9
TLSH
T14822A8516E38A97B8CCBD20DBB55BF53E5F9503261901E48EAFCC61C05E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b3f547e-2d7c-4188-b141-1d9fcffe986d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b3f547e-2d7c-4188-b141-1d9fcffe986d.tmp
Size 27KB
SHA256 48c8c089875da74edf2c9c6f93688ab2299608cab6bf79abe94b8e792b8983f8
MD5 99e3126ebf1ddf0fb9c05c7d7a37661d
SHA1 4a1045b450da6a06fdcff0eeb18c0f3ff4fdb23c
SHA512 f6ee28ecc07d962a2a73fad3a16f5cfccb26c6220256f182c8b92817d0238479acb0f9980d953918d47bd4b78da4109247a86a5f0d8e96e9bb63e91f9f67513d
SSDEEP 768:UpyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXLropRvA/8:UpyYR7jWv3NpBu1ja/CL8OX4nl
TLSH
T1BCC2E93B640DCB7E4FC01A9DDC5A6F9B7E9802C7A6548D4047FA944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 20c78628538996cabc8801b4dd98c7459a26e27722f8df1abf101fd7870ec893
MD5 dc1d847e2911fe62b79372b9970debc5
SHA1 8258c27677c111231cacfe3180a4a0e8fb9e4f53
SHA512 75c40e73872dbab5d72a6e40617973bee1fe6630aa2d5a607e14550fd22518eae87a843a788bd8a6af96fdc614ed604e8a072f9b4ff1e1927153e3cca1cbef90
TLSH
T1C2E07D84A5C8C23FA24AA4CB156C775CDB913A6AD7C0FA0E7F00C58C7287040B3C2F90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 65ee3a1ef9d618567d90de4329b5b11263d64f6a4f83e7b1591740724ac9fa58
MD5 f2e20d574e0a9d50eec2ae0e13a18833
SHA1 286e51fe1c251522a4a138eb1d6fc189b30cf0e4
SHA512 7f3296051e414cc85cd6ea434a59dd48e3978c947faf3f921f9b7f3aa7a14a020c37ce863fbf7569fa016369ba59fda0126882341b081482e83e058dcdfd46cb
TLSH
T1D4319DC2569B207FF7AAAD3589E132833A375E9056AB0F3304B9C0776E8B7D09114143
MD5 SHA1 SHA512 TLSH

Submit Download

d7c7d68f-bf60-44ea-9254-2daf74c955a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d7c7d68f-bf60-44ea-9254-2daf74c955a4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1a865544-1130-429b-be6e-3febf3d58ec9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a865544-1130-429b-be6e-3febf3d58ec9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

22bbb264-f878-4c7b-8b74-722e12f6e4fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\22bbb264-f878-4c7b-8b74-722e12f6e4fe.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

70598f6c-c942-4ab4-84c9-502146e74141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70598f6c-c942-4ab4-84c9-502146e74141.tmp
Size 949B
SHA256 2b97f9ad8e2d4bf7fc021ecdc8370380e9c726ff682d38b34f9befad0fb73902
MD5 d759080258731492f7591364af69953d
SHA1 eae66d7c03c6a191211a6530c815b7ee62f35946
SHA512 5bb3ac28b68a9019c89aa0855d5aa21ca39a8b798b598ff30b01ffcfd878fb8d5c492d39a6034184a57dcebc1ff7e0bfa0a89562485fcb0bd3af0408347a4e50
TLSH
T18F115BF3C7D5956E890156F05A24AE1BCE2D0906821C7C1585D4EF27D3E3075E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 323f20698f2425803e6d522ac78af4d941bebf27ea02e9e44b4bec450c1d802e
MD5 be9232c10c3d0b4b96a0a47234fc2ee8
SHA1 602b4165e5261135700194d71601c7bc2e3c909d
SHA512 4ec4740923032544bb4a9a5f2eb1f6f90d657208b24b6e477a8611f2f4108ce32751a9e5d4d5c39df4d581d3b9ed07796ed67719af38b0e2a993b233af42eb02
SSDEEP 48:KgGh8g+kkdbofQIS4dK9c1edx2NY3IkmyLuJkomscVbgnoISAVK9k12VxOFYfgcd:Kk52KyQi2lKKmQt1mKu0iuTSKQwH
TLSH
T19FC1DE5130B7060038BE258C91B6876A024272F37055E67BBFBD04F58A6FE145EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf850677-85d3-4ed3-9647-118999bec4a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf850677-85d3-4ed3-9647-118999bec4a5.tmp
Size 10KB
SHA256 300276f0df51057389d752ab629da7efad47f762be352dfd53c89a768c8f1a77
MD5 c0e619f27861b58b7f5b8d26826f228c
SHA1 3f950e9a7eb06519e24aa3b87d5120ba55f177f8
SHA512 11ddce750be2e4273837f9abdacd5a7371ea2509fc0c9bd0d18410538feb80e12e8e32cf6524bcf3c88d9ae50a19f7a0038e4daaf2f2f103ccf3527dcda0cd8e
SSDEEP 192:sxZSREWx/fSsTrIdpG4HAj6+WNGYYB1GFssTIg5pJ:sxZSVx/fSsT0/HPGflsrp
TLSH
T12C22A7516E38A97B8CCBD309BB55BF53E6F9503251901E48AAFCC61C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2ee5e4c-fb58-460b-9a67-afe506a2d812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c2ee5e4c-fb58-460b-9a67-afe506a2d812.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c5994377c22e4c1aba49bbcab6c560cf33090424ef95d18f35c4503ecb4a5ecb
MD5 93bf3e7bd896967fceb2b331d8987820
SHA1 e3b10c0772f34d3c7bf4f87ced9545c1eae7ebd0
SHA512 0da034ea276eb1fde86dee866d8daffb6623c3b229238bfd108653a8a31cb660b02952c54c45c2e55c74aada9c03f65724ecea094ee3d0c6048384876e87359d
SSDEEP 384:bLJQkUSv0sNLzMPOiG9PuQX5+DtaOV/CnsJrdq2vaTZcAHAIIlJ:/r0SrtkDQOEshdq2vaTZcAHAL/
TLSH
T120827C31A8789C374AE7A660F14A3643DFB4A167D5C46BC4D5CD6F2C01DD6AC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aff2c871-c9b2-493d-b8bb-74937a08f29c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aff2c871-c9b2-493d-b8bb-74937a08f29c.tmp
Size 8KB
SHA256 4b90ee25ec6662a8b7f310cc6a907190b2dcfa62bd11639d708c01d727b0aef6
MD5 a41362d6f0bcac94b6c9282ccbf70750
SHA1 e70f4ff6c7dbd4b2bda43733674a84fc52f8c420
SHA512 7290affc935dfb5eb7f8066bf21efcd6ee4c13315de457cbd8f1f8403b87e5d79f9c877c7c4e5c59ab77aff97e5bedd7cd0ca0e70daa0c1cab6e8d64bd9f3b39
SSDEEP 192:EONq6nnHGQmiUymbQYcX5hQDP1aOV/CGMcnoU6:EONq6nCZQNX5+DtaOV/CmoU6
TLSH
T1B202EB34BC786C7B8EF7AE49B44637139FA5213BE5956BC4D6D81E1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69d0cb4a-d9d4-4b92-b0ad-b284054e3cb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69d0cb4a-d9d4-4b92-b0ad-b284054e3cb9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 487fd6bcf070e518497975b841f4153c6e9ff1f0b3dd03a9fc1780162bdcecb8
MD5 f51583f95efbfee3ed589eba135a2d15
SHA1 a50b7fbbdb7335ccb88eb87282822dcf3367351e
SHA512 9349c46d6872f181e337d6411af9a09ef44b4445cf94e558b457d83074b6dfe35a6da9dbc3f31fa84b33a8809d17256bc5225e912ee33ff427c5018d0693b40b
TLSH
T1F341235DBAFA0148B3B7BE5A9BF7A86E487E79372F17D05E10010D4E0676A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download