hxxp://154[.]82[.]93[.]249[:]443/123456789[.]txt

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://154.82.93.249:443/123456789.txt
Sample261027-ptj16ade78

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4508	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{A176B7B7-06FE-478D-A734-B3CFCEA78AA8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4468	4360	msedge.exe	85
PID 4360 wrote to memory of 4508	4360	msedge.exe	86
PID 4360 wrote to memory of 1780	4360	msedge.exe	87
PID 4360 wrote to memory of 1660	4360	msedge.exe	88
PID 4360 wrote to memory of 1780	4360	msedge.exe	87
PID 4360 wrote to memory of 1780	4360	msedge.exe	87
PID 4360 wrote to memory of 1660	4360	msedge.exe	88
PID 4360 wrote to memory of 4536	4360	msedge.exe	90
PID 4360 wrote to memory of 1188	4360	msedge.exe	89
PID 4360 wrote to memory of 4536	4360	msedge.exe	90
PID 4360 wrote to memory of 4536	4360	msedge.exe	90
PID 4360 wrote to memory of 1188	4360	msedge.exe	89
PID 4360 wrote to memory of 1188	4360	msedge.exe	89
PID 4360 wrote to memory of 868	4360	msedge.exe	92
PID 4360 wrote to memory of 868	4360	msedge.exe	92
PID 4360 wrote to memory of 868	4360	msedge.exe	92
PID 4360 wrote to memory of 4156	4360	msedge.exe	93
PID 4360 wrote to memory of 4156	4360	msedge.exe	93
PID 4360 wrote to memory of 4156	4360	msedge.exe	93
PID 4360 wrote to memory of 4680	4360	msedge.exe	97
PID 4360 wrote to memory of 3828	4360	msedge.exe	98
PID 4360 wrote to memory of 4680	4360	msedge.exe	97
PID 4360 wrote to memory of 3828	4360	msedge.exe	98
PID 4360 wrote to memory of 4372	4360	msedge.exe	102
PID 4360 wrote to memory of 1800	4360	msedge.exe	107
PID 4360 wrote to memory of 1800	4360	msedge.exe	107
PID 4360 wrote to memory of 1800	4360	msedge.exe	107
PID 4360 wrote to memory of 3108	4360	msedge.exe	111
PID 4360 wrote to memory of 3108	4360	msedge.exe	111
PID 4360 wrote to memory of 3108	4360	msedge.exe	111
PID 4360 wrote to memory of 4076	4360	msedge.exe	112
PID 4360 wrote to memory of 4076	4360	msedge.exe	112
PID 4360 wrote to memory of 4076	4360	msedge.exe	112
PID 4360 wrote to memory of 3144	4360	msedge.exe	115
PID 4360 wrote to memory of 4092	4360	msedge.exe	116
PID 4360 wrote to memory of 4144	4360	msedge.exe	117
PID 4360 wrote to memory of 2380	4360	msedge.exe	119
PID 4360 wrote to memory of 2380	4360	msedge.exe	119
PID 4360 wrote to memory of 2380	4360	msedge.exe	119
PID 4360 wrote to memory of 3600	4360	msedge.exe	120
PID 4360 wrote to memory of 3600	4360	msedge.exe	120
PID 4360 wrote to memory of 3704	4360	msedge.exe	121
PID 4360 wrote to memory of 3704	4360	msedge.exe	121
PID 4360 wrote to memory of 2268	4360	msedge.exe	122
PID 4360 wrote to memory of 4372	4360	msedge.exe	123
PID 4360 wrote to memory of 4372	4360	msedge.exe	123
PID 4360 wrote to memory of 4372	4360	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://154.82.93.249:443/123456789.txt
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffab7c2c188,0x7ffab7c2c194,0x7ffab7c2c1a0
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,15647850702970004757,8803459545781437041,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,15331718204345060736,17591099026124234543,262144 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,14663412301181795339,4753706587922950317,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12943430388645588555,8033923238512878507,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17534369583085284437,12277964766556807028,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,3709549807039046092,702553784885787276,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,17486364962251220230,16180260103339040580,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2303809813168446240,11451202844742899776,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,14298953598727972487,7409478269577161136,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4493019554952618568,7469179808191584932,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4493019554952618568,7469179808191584932,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,18422711638492876559,4234126335936059579,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3656,i,2831282252587661925,7039601574799313013,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6328,i,6715781966841792403,15084419184242456381,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,14108916279851726095,17270805047988959503,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,17219289374735547382,10870374808094840469,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,13347203087592526851,2590039454867811322,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2508,i,3945731569893249595,12007641063408256965,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,7583498941403003272,10837503356100222613,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,18197018039919834197,14528763848361424647,524288 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,6378240326460768528,2195334699130706741,262144 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5188,i,12793995441419508642,15694783972213676249,2097152 --field-trial-handle=2704,i,1537417668052043456,648417769344058367,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04e2b5b4-ae84-4924-9ae6-afea24b6a170.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04e2b5b4-ae84-4924-9ae6-afea24b6a170.tmp
Size 18KB
SHA256 c47f8e8740c793c9a2edcc6a194920050cb63c8ccc01cf60115f34fdd1e6fc3e
MD5 e3de7040464faaaf800925c1e4c4c6aa
SHA1 99f902bdb715447b65b9e7d97808c0ca00ea583f
SHA512 971e8c9b55461217d8f2444b011d0685b76351bc8b7462edfbc8d76df1cf2fa62d2bc4dd642ca2e59675ae30c435cce8682133d4afe8cfb7c6d80ae4e11ebd29
SSDEEP 384:5QkUSv0sN1PwNb4P5OjTVINOrnjRrTvaTZcmIIlh:b0zQ0nWO7jRrTvaTZcmLP
TLSH
T191826C31A8786C774DA6A251E54F3243DFF48167CA852F94E5DE6B2C01DE29C330BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10f8a6d3-82dd-43fc-a510-f732452ef417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10f8a6d3-82dd-43fc-a510-f732452ef417.tmp
Size 8KB
SHA256 666d8447b31edd2559e7bbc9808609e2d86a59c8d8d8f945555c8c0391273e29
MD5 da64fd1279f138242ed9db1a31117f8c
SHA1 8e536f4820824a27120bd21566ada1f82aef87fd
SHA512 f22400156c5de621a8882fb43224d180990047e8a0db86aa64251074cce474889f186ab8a697978707950b2e04f33fad675db0b223a0d1f5e07a7a7bc25c7169
SSDEEP 192:SONu6ygpQmiUyaNtOCTVg3NOqm5zPr5uU6:SONu6lHNtOCTVINO9rkU6
TLSH
T19602C634AC783CB78DA2AE45F58727139FA8116BDA562F84DAE81E1C01D775C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

928cfc31-2072-4506-a222-645db466e307.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\928cfc31-2072-4506-a222-645db466e307.tmp
Size 21KB
SHA256 6c7a9fbd845514c3f7be17c2c0f2d9965758d0a5433a3b99a25bb1df724961c2
MD5 3c092b5d625537d5630fad1f72730843
SHA1 41726fff99b3d17514c6d8d0ad3c9c732dff59a7
SHA512 8634f9fe208a533cecfa81bd07e210146ee6c6a0ffa1e5af3dd9567864d45553d080d335f3e43214a3f4cdc5ecefd60d26aed3e91270cfafd8a68113f7c901e2
SSDEEP 384:riFzQkUSvDzsNP8TUNTUlIlowNb4P5OjTVINOrnjprTvaTZcmIIlh:GFdHuwglQ0nWO7jprTvaTZcmLP
TLSH
T1B3A26D329C689D7B9DF69B40E54E3203DFF081A7CA85AAA0E6DD5A1C01DA1DC230BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

1377185c-fa34-46d4-ab42-1ac79e319c06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1377185c-fa34-46d4-ab42-1ac79e319c06.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f20a3b4-9953-40b1-a90f-a2f7da7a2af3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f20a3b4-9953-40b1-a90f-a2f7da7a2af3.tmp
Size 10KB
SHA256 b11e08a589bfd43156e89ca09e1bb4d94501002c66f5cefffa4ce58bc8a032e5
MD5 93d6de27e79dfb22b762fc7500b3f880
SHA1 5eea46414b4a01e1efe72e60b7592fe8c92807db
SHA512 2778955487439fba3d4708ed97f9f4ec26b1ba18fc2621c4e367e6fc8a4da3c3315b184b04bc13ca710bd391fef4aeda11f4fb31449e5c309d1afba8bc9d5366
SSDEEP 192:sxZNRFWC/fXs3vIdp0olHW6+WNQBF/YRP8H7RYIg5GJ:sxZNSC/fXs3A0wHbE/mkuo
TLSH
T1CE22B9516E38A97B8CCBD31DBA65BF53D6F9503291D41E48AAFCC61C04E6ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99fc8130-c06e-409d-b043-92360788bb90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99fc8130-c06e-409d-b043-92360788bb90.tmp
Size 27KB
SHA256 332541d526204c38f5e0d6203cdbd8958348f7e9c271bda09c64bbff739ad476
MD5 708099d01cd680441ee52f0bcb3a6ac7
SHA1 3a1230b85d65df3ca1d3ccad45782f91e0e78724
SHA512 55215275b8a6cc0dc5b35285bd990a47802cb61e5e11ed688f4ae9693dad19919b46668611040c3aa1db542a0b46eb9b17d1ddc9872645c612bc9c36c889c045
SSDEEP 768:eMK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3xroK+vQ:eMK9uzYWvcQWsu1ja0HL7Q3KK+vQ
TLSH
T10CC2F93F640DCB7E4FC01A9DDC5A6F972E9802D7A6588D4047FA984C02C77EE522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 936b49ff941301013d62d4bd337116dfe0c1c9d233dcd897964dac6edf0e063b
MD5 0670cc58d4a0fcaf05f29559fb6ca495
SHA1 891c13c84374484eb26c24483bc8058944df1bc8
SHA512 aa18595a19268cc86b9e07700b9e67c47454faaa9b2eac0386ec7308d86e9bc162cd24a03663a1a9b8678af25bb875a5ebb602bffe3a6b49889b4faccf2012a9
TLSH
T117E020D9A5C4C25FD20C6447837C635CC782271A96C0FA0F1B04C954724708462A1B50
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a0cce30548b11360cedeeef79d34644280fd07f20f4edc34f29ef9a66247a8b0
MD5 835c0ed9134703b852419fd3469a9bf4
SHA1 034e3fdf68f43244c035291d4859c66e947e9616
SHA512 a6a2b861343d960de31ae1d35e41799d34d68fbb627417fe7e2321096593c8dfc26563f7216d9c8fdfea22bbf1215806ffba059e664e0eb13c339946c1c776f5
TLSH
T157615EB1344F8D57EFA851BC99F5108B3A3C7DF045832E4E89B4F8EA43BA3569040847
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 19969ed64dd5d53a21d039708fbfae955b0d0ba3d16cbba23e9e0857db8887fd
MD5 3439547466cdac8ee5326b7e1b81daab
SHA1 c72459ce8cf3acfd43feb93eb5e5417a98aa8c33
SHA512 9d7ccd95cf967cc9cecc0f15b4987acd0e53bd126dc5c60057e2369f6c520bc85ddae3ec4d58ef1001a9276df3e5602ecb6b4d27ca0f881acc66717d6b1029cb
TLSH
T1BD615EB1344F8D57EFA851BC99F5108B3A3C7DF045832E4F89B4F8EA47AA3569050847
MD5 SHA1 SHA512 TLSH

Submit Download

2f32d83c-a9a4-49a3-bcfe-dcc315060463.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2f32d83c-a9a4-49a3-bcfe-dcc315060463.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

48dd8d97-26f0-465b-ae5a-5a3fc5c61298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\48dd8d97-26f0-465b-ae5a-5a3fc5c61298.tmp
Size 949B
SHA256 d80f8452784d379d3b9324511b44a59a289f225e1756d94f99acb0c83698b9ce
MD5 189ae76c88a7287a33e3a1d92cd91fa3
SHA1 85acbef67650ef8842ef0cf4af7d40ba963eccbb
SHA512 51e955c9fc23f07b29a8762aae9fc4cf6d34cf5f449aedf4b073bd077a07eba440109ada5fbe50b1ed0b28cedf5ebf42bfefaecc4a1ce89bad3651490bd68adb
TLSH
T164117DF3C7D585AEC90156F05A28EE2BCE2D0A05421C7D5985D4EF6B93E3475E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

72863a48-2190-462e-bb7f-3e2661444334.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\72863a48-2190-462e-bb7f-3e2661444334.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

83c16ea6-4727-44ac-af75-14a8991e0122.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\83c16ea6-4727-44ac-af75-14a8991e0122.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

af0be9f9-640f-4150-8bcc-bad18fd72760.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af0be9f9-640f-4150-8bcc-bad18fd72760.tmp
Size 10KB
SHA256 30f1ccca247ab7bd0c60b592fc114389170fb2fdb8b7cfc498456fd4896e0ec6
MD5 bef48ba73ab101b185d38b522887ce6f
SHA1 202e94f3ec0b13c60b36d1a0fcfdb81679e9a34b
SHA512 a54ca701431a1f98ff5637b4e8214ec6404febaa8425b88089e1b50d675be289346405f2ff9c362d351d4df019b7826c511ac4d08e95b1fc2eaeb1b91b378de7
SSDEEP 192:sxZNRFWC/fXslvIdp0olHW6+WNQBF/YRP1VRYIg5sJ:sxZNSC/fXslA0wHbE/mGS
TLSH
T1EB22C9516E28A97B8CCBE30DBA25BF53E6F5403251D41E48AAFCC61C05E6ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd3ad5af-80c2-4699-a897-d85be743682a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd3ad5af-80c2-4699-a897-d85be743682a.tmp
Size 9KB
SHA256 576b5962b0a014ec9f311f56924bac0dbea790fce3303550c2898badeae2c563
MD5 558e15a69cbb5b85a852d3e8034ea6c3
SHA1 4aeed17c6017d3f507a0977dd41b4c493457f319
SHA512 e251747da4b3d60e237f252009cf5b55fec856eca6bc0480214f64cf5f10dc87f37f6e4effc2cad32730ee57948141bb946545945b900f143ca5c6a22865c225
SSDEEP 192:sxZNRFWC/fXsV6IdpJHW6+WNGYRPJ7RYIgrJ:sxZNSC/fXsVTJHbGmY9
TLSH
T18412A7526E24A57B8CCBE31DBA25BF53D6F9503261D41E48EAFC861C04E6ADE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d63d6286-f2b5-4da8-8f4f-f954c18337b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d63d6286-f2b5-4da8-8f4f-f954c18337b6.tmp
Size 10KB
SHA256 e8d963d4358e6cb209c87afc514bcce08546eeb7d854978dbd84a58deb941bb4
MD5 b72a2ed8f8629635e3e1dab425019498
SHA1 63a1b0223281e4621dbd8c2e41a1d3858052701c
SHA512 b6ed5d56dc50912345f1df6a3a631902f8d2bfeea58c1c9840103571e1fba49d431cf818ebb98b9fd9ab0f5e04586b994418c3eba108def294c7e29b03656c06
SSDEEP 192:sxZNRFWC/fXslvIdpaolHW6+WNQBF/YRPqKRYIg5sJ:sxZNSC/fXslAawHbE/muS
TLSH
T17322CA516E38A97B8CCBD31DBA55BF53E6F5503251D01E48AAFCC61C05E6ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a132b1cf-5473-4847-9474-00666389dc08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a132b1cf-5473-4847-9474-00666389dc08.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b902647f-ecbd-42ed-8dac-5683bb8b6abd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b902647f-ecbd-42ed-8dac-5683bb8b6abd.tmp
Size 18KB
SHA256 53688cdbbf4ca0262fe84a4159a92898cb89e61350a73a946aafaa2207b72303
MD5 59350fa6783e990b011dc525633616b6
SHA1 55ce7ced67c905be5713491d53273503d052263c
SHA512 9c1cad5cacc369020793711e349f63ad2dc200e17eb393c2272c225c6063bbe056013dd3a137211567e65c68a616853a1a30f8894d88206c7a67dcb86110b6f8
SSDEEP 384:2QkUSv0sN1owNb4P5OjTVINOrnjRrTvaTZcmIIlh:W0qQ0nWO7jRrTvaTZcmLP
TLSH
T133827C31A8786C774DA6A251E54E3243DFF4C167CA852F94E5DE6B2C01DE29C330BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd4cc947-de48-47ca-a4eb-3264c7ceb214.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd4cc947-de48-47ca-a4eb-3264c7ceb214.tmp
Size 8KB
SHA256 40f86cdda188db1c237343c819167e35d1ac7511f2e269a05c421b03f90bd6f1
MD5 96564133d9979e22d06e7354a2935e51
SHA1 ab2d1e774fd4584e13105cd39842a69feacb1d96
SHA512 08ebcb7a863139d9a3ac3747920e8ae8372251279b678c3e79d5352d320a6a1a7719ad50ba9d84e06218b7753eb87a8032f83c0f3925ddd767a296527ead632e
SSDEEP 192:TONY6yQQmiUyvN7OCTVg3NOqmjnjOebL3Ur5quU6:TONY6PC7OCTVINOrnj6rTU6
TLSH
T19A120A35B8786C775DA2A545F48732079FA48167DA4A7F80D5DC2F1C01EF6AC230BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f0c378d-278c-49d3-bc4d-6333ed32b8b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0f0c378d-278c-49d3-bc4d-6333ed32b8b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63107d477d01170893517ee380f7883b844b05616723ed6532efd73239a663e0
MD5 9787c54f1f2fc5f249cbc77907083435
SHA1 bab321693b2914dfdf8ee825a2ee24730d5ff9ba
SHA512 b4c89311b1817af26f510e28040720b6d72c7572910371fd9ac82ffba51490c3cf7f73affe445da7cced1132f28503afe925b3109e38b6c5b7c8375837fba8fd
TLSH
T11E415A58ABF95158B3776F46AFF6A86D447FB8372F46D05E00110E4F0A22A00D971B37
MD5 SHA1 SHA512 TLSH

Submit Download