hxxps://minecraft-mp[.]com/server/365234/vote/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
19s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://minecraft-mp.com/server/365234/vote/
Sample261107-pcnb9acy3j

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	21	https://minecraft-mp.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a56c3d6db9f6932c	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{D59F4420-56C0-4058-B0C0-E91A4F7E845F}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3356	3068	msedge.exe	80
PID 3068 wrote to memory of 960	3068	msedge.exe	81
PID 3068 wrote to memory of 3444	3068	msedge.exe	82
PID 3068 wrote to memory of 3444	3068	msedge.exe	82
PID 3068 wrote to memory of 3444	3068	msedge.exe	82
PID 3068 wrote to memory of 2392	3068	msedge.exe	86
PID 3068 wrote to memory of 3028	3068	msedge.exe	85
PID 3068 wrote to memory of 2392	3068	msedge.exe	86
PID 3068 wrote to memory of 2392	3068	msedge.exe	86
PID 3068 wrote to memory of 3028	3068	msedge.exe	85
PID 3068 wrote to memory of 3028	3068	msedge.exe	85
PID 3068 wrote to memory of 4524	3068	msedge.exe	83
PID 3068 wrote to memory of 4524	3068	msedge.exe	83
PID 3068 wrote to memory of 2004	3068	msedge.exe	88
PID 3068 wrote to memory of 2004	3068	msedge.exe	88
PID 3068 wrote to memory of 2004	3068	msedge.exe	88
PID 3068 wrote to memory of 1916	3068	msedge.exe	89
PID 3068 wrote to memory of 1916	3068	msedge.exe	89
PID 3068 wrote to memory of 1916	3068	msedge.exe	89
PID 3068 wrote to memory of 2868	3068	msedge.exe	90
PID 3068 wrote to memory of 2868	3068	msedge.exe	90
PID 3068 wrote to memory of 2868	3068	msedge.exe	90
PID 3068 wrote to memory of 5296	3068	msedge.exe	91
PID 3068 wrote to memory of 4588	3068	msedge.exe	92
PID 3068 wrote to memory of 5296	3068	msedge.exe	91
PID 3068 wrote to memory of 4588	3068	msedge.exe	92
PID 3068 wrote to memory of 2228	3068	msedge.exe	93
PID 3068 wrote to memory of 1148	3068	msedge.exe	95
PID 2228 wrote to memory of 4920	2228	msedge.exe	96
PID 3068 wrote to memory of 1672	3068	msedge.exe	99
PID 3068 wrote to memory of 1672	3068	msedge.exe	99
PID 3068 wrote to memory of 1672	3068	msedge.exe	99
PID 3068 wrote to memory of 5092	3068	msedge.exe	100
PID 3068 wrote to memory of 5092	3068	msedge.exe	100
PID 3068 wrote to memory of 5092	3068	msedge.exe	100
PID 3068 wrote to memory of 5816	3068	msedge.exe	101
PID 3068 wrote to memory of 5816	3068	msedge.exe	101
PID 3068 wrote to memory of 5816	3068	msedge.exe	101
PID 3068 wrote to memory of 2668	3068	msedge.exe	102
PID 3068 wrote to memory of 2668	3068	msedge.exe	102
PID 3068 wrote to memory of 2668	3068	msedge.exe	102
PID 3068 wrote to memory of 1928	3068	msedge.exe	103
PID 3068 wrote to memory of 1928	3068	msedge.exe	103
PID 3068 wrote to memory of 1928	3068	msedge.exe	103
PID 3068 wrote to memory of 2132	3068	msedge.exe	104
PID 3068 wrote to memory of 2132	3068	msedge.exe	104
PID 3068 wrote to memory of 2132	3068	msedge.exe	104
PID 3068 wrote to memory of 5312	3068	msedge.exe	105
PID 3068 wrote to memory of 5312	3068	msedge.exe	105
PID 3068 wrote to memory of 5312	3068	msedge.exe	105
PID 3068 wrote to memory of 1828	3068	msedge.exe	106
PID 3068 wrote to memory of 1828	3068	msedge.exe	106
PID 3068 wrote to memory of 1828	3068	msedge.exe	106
PID 3068 wrote to memory of 3660	3068	msedge.exe	107
PID 3068 wrote to memory of 3660	3068	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://minecraft-mp.com/server/365234/vote/
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffb92b2c188,0x7ffb92b2c194,0x7ffb92b2c1a0
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,9481920399071505371,2444625363749965641,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,7790039906002154875,9210355566004381505,262144 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,13636334902994813307,10437785420836677720,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,4571372107943003642,18266106763726372375,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,14871677407254027239,5436091485301197217,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,6268228387838825160,2950562716459278014,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3540,i,10588069343475943154,17522481660926973767,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3396,i,8343475168094200037,10428705952974708934,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2074987739777423087,13621066697536982793,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,13353355580120859070,2238714615536896030,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,2810337123931130564,14365450728434073321,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1081690082371736634,11057550503585162462,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1081690082371736634,11057550503585162462,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6284,i,14664844747527981490,2432266689863225182,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3500,i,5412018195879124088,13085029811428405890,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6884,i,13044802955115731791,2536827605994692680,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5088,i,1135945268928195171,9421374978881805552,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6628,i,12050294137765171570,3447715452466168213,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7100,i,9071740168119062721,5624114455431242630,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7088,i,3492288373671396348,16032039870315590139,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7468,i,2090232584129308898,14125016676037571505,2097152 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,16257638039399398193,13331396089749883663,524288 --field-trial-handle=2040,i,685497896520884286,2390229525863722028,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:12
  2⤵
  PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f4d5ab9-4566-4c9f-acee-b04f0a32a9a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f4d5ab9-4566-4c9f-acee-b04f0a32a9a9.tmp
Size 25KB
SHA256 6dd510ab365c022f056a1b24c00cf20c60166c964cbb1654d96b607d237c8e64
MD5 ac7a5eaf8bbbfd9b7c647f828e40f324
SHA1 7db2e2588343937736511c9e30726b62afefea30
SHA512 5f7a5852d7c59ae26cdb9e60d8fce82ddee46147792d0a201bee93a9d09327743243f1ef4ca8ee91dfd2b26809d684cd256041a50cb1de356dc26c8cf107e91a
SSDEEP 384:nUiFiZcI638NC8TUNTUlIxBwqBf5gbzWfg9Anf119EoE7O6R2FeorgL/7IzPoS:vFQ63dwgwU5Ex9WioE7TRmJ
TLSH
T122C23A36ECA4C9BBECEA8EDAA74A7A06DEE00153849C8AD4D9D85D1D009759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a8312ea-2fb9-4e0a-8edc-0238245a0144.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a8312ea-2fb9-4e0a-8edc-0238245a0144.tmp
Size 27KB
SHA256 94d1bbaac3c02df58af6f7c099d9d76619a9a003a5532d0521ad29d5c7e9f0e7
MD5 5d2a9d358eb25680f212b741b6d2dddc
SHA1 318610eb70e3586a896f3055d80cca703d7f388a
SHA512 8a68022e9683c2f36dd409288635b1ee73b307e63c209d55c82499583156dc9e46d2cafa9efe9064086954a42388d8447710e5889ebc70b9f212a987f03aea33
SSDEEP 384:nRiFgQkUSv98N58TUNTUlIROwq/zVbzWfg9Anf119Eiqf78Y7gYKsjbOxgL/7IzN:4FI9ewgFWhx9WiixY7gYKsj3lw
TLSH
T18AC24B36DC65CAB7EDEA8ED5A64E3607DEE08153D89C4AD8E5D86C1C00CB1DE134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f2d1519-9152-46a1-9031-97acf3f2fa7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f2d1519-9152-46a1-9031-97acf3f2fa7e.tmp
Size 27KB
SHA256 3c3180d829da8839401006e1d1b794b79e372d551a33b91ab5ee2f10766f754a
MD5 7c45d776eba995dad809efc6d82963a6
SHA1 afb17a3ea4a593cd4f96c6bc2d238aeff1830494
SHA512 d5b9b7380aa2bae724fdde9254334b69be00637f39eabbdabd261b3e8012f00643d839130631a43ab8777f14b751b964687ea2f8e550218a5cc28dd584c084bc
SSDEEP 384:nRiFzQkUSvR38N58TUNTUlIRiwqLzVbzWfg9Anf119Eiqf78wgYKsjbOxgL/7IzN:4FdR3ewgFChx9WiixwgYKsj3lw
TLSH
T1E4C23B36DC64CAB7EDEA8ED5A74E3607DEE08153D49C4AD8E9D86C1C009B1DE134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9487972b-40a1-4dd9-910f-0523b7db6ab4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9487972b-40a1-4dd9-910f-0523b7db6ab4.tmp
Size 26KB
SHA256 cac922940f1eb73aa8bc93c5f71db1a01964173464951bc47758457cfb77507d
MD5 a43cc5ce2b3a8c2a79532097d0791748
SHA1 10fb68d92fe680a531b28ba402a07c87fe78d19c
SHA512 888e455a1d21677a54df4cdd76bcb1231ff6bcb7d8c8c601771ef7da7f199d7abe7009c729c5f0becb0a2a5a20c41e07431af464c428d3046638ec4e5f299ec5
SSDEEP 384:nyiFiZcI638Nd8TUNTUlIxBwq1OWbzWfg9Anf119Eiqf78ug7O6R2FeorgL/7Izx:5FQ63uwgwJGx9Wiixug7TRmJ
TLSH
T1B7C26C36ECA4C9A7FCEB8EDA974E7606DEF04153D89C8AD4E9D85D1D009B19D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

00e61f09-9f5f-4267-90ca-a73caf54363f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00e61f09-9f5f-4267-90ca-a73caf54363f.tmp
Size 12KB
SHA256 d0f809e4fcb998788c7b7d907851d016175a64cb693c0d9d77072c7dbf6e252d
MD5 b5bb15896c6ac81e4508244225d1b234
SHA1 d588fc2e078521fe716c1ef75d136457291f9e55
SHA512 e7dd13c008d44233ea08d34d95b3a941c4374d969700b720fe51d1b546144357daa0542615dd7325f60f1e98a9e75775eeaa38f4e749f8f0b4a81c7e095a89c1
SSDEEP 192:sxZOR3Fm/fssuqAzodpAlD/W6+WNMnd/Y0YUee2bIgjgJ:sxZO7m/fssuaa/bW/5xkjE
TLSH
T14842D815AD38A93B9CD7D319FA19BF57D3F95032A0911E48A6FC8A1C05EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 23KB
SHA256 dcbc6554139e42bf4714608321dc70086820e8decc034401793c1458b7af19b8
MD5 45fa3eeb6dbf853aa12aac507a0dd272
SHA1 74f603eed6bfac4a793ee286ad64a3934c19c67c
SHA512 783eb14dc78ef402a91a09a32f8c3add64ab33df707adb5142d23046174d96b6db77f5fe743588d97651a9dbd29427ab2beb7c3ea960a09fbdcee1c6d6154782
SSDEEP 384:lmSI+eI3axwR3ns5hcbfeNJDpMRdTgydKH2pkVLJ3pEKm1yBn3he1lXswnezyqNM:ljI+eI3aj5umrpuTdKWOzS1khgegD/
TLSH
T1A0B2E1CDBBE1C9CB748D39E627D315881C398DDC05D7F82D25EB329DA760388A660328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954101fa-a3a0-4ff7-9813-de48786492c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\954101fa-a3a0-4ff7-9813-de48786492c4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

86455c6b-a928-4a35-9912-c4291f1dd670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86455c6b-a928-4a35-9912-c4291f1dd670.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c31cf9ac-6f59-4a57-8391-51a54c4be5ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c31cf9ac-6f59-4a57-8391-51a54c4be5ce.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d1798aeb535f2699c17bca5ecbb6429401840a8a1bf8f936000a2f9966e97f21
MD5 33a768c8fd698937a4ace90000ad4070
SHA1 d07fa3631741d50a842f3ea363dcb1b84eefa8d7
SHA512 656f3c503a7d63c73d049b3c6e423044cab27e9645163d01f03174201bc1422c54057c4c9e1164e788346d1afe31eb0bf0f6752f079ee1dcb2989a143ab13303
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21Wj:ir/+SvIrlfrljh9DdgslV9rnWVFi
TLSH
T10EB2651571BA12453CBE291881B5972F128236B33119E62F7FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cc77fff5-167b-4f4e-8506-0f3ff0ece3db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc77fff5-167b-4f4e-8506-0f3ff0ece3db.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d60f891d-be43-444c-9533-0ed3ac2c0394.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d60f891d-be43-444c-9533-0ed3ac2c0394.tmp
Size 28KB
SHA256 384d310da0f638363652b3c15113a294034adabfffd8d9100994dbd7165fede1
MD5 998057979322b56fa5b41084200476ac
SHA1 3ca4f36b38d758e7a01a15407d682b8a17e16727
SHA512 44f23e26b1363a54508999b08276c62208eea5152af4fce9ef8738d6ec09fd1415b8c5f26494ed3cd8ab1ea4e2995f82ffbca3ffb02078853766ba0b61866db4
SSDEEP 768:SPcas8Tw23fWRmLJQV18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroqm:SPcas8Tw23fWRmLJQV1u1jaKVOLph8+x
TLSH
T1B5D21A3F640CCB7E4FC01A9DDC16AF976EA802C7A6688D4447FA994C02C77EB51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e687a8a2-b6ab-46f8-913f-603205fe559f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e687a8a2-b6ab-46f8-913f-603205fe559f.tmp
Size 414B
SHA256 f89b92d1e176719840b75ac378b8028dac45c3c4faff384f419198d8b2b9ff5a
MD5 624c3e59c809040887a7c67f8fe0aaee
SHA1 e348b3917f53012d580d3884dae1b6cf2922fb49
SHA512 0ccdc17090e8913e74e9c3141e23631a360fdaba79420848e6d7e39da94d5400a471335e7964f09cfc9c8caf15b1442402c508a229c9604089c9ef35840fd840
TLSH
T1FDE02BAEC925EC672DFC4B28A06047C5E751535B2A50458F3B7C820D8FB662B06DEC1C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-303-0x0000016232B40000-0x0000016233B40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads