hxxp://url7254[.]govtas[.]com/ls/click?upn=u001[.]ZCx8SEvFUnsHCsy3GeLa6H62llxT2xiGDaDEHYtfcv0qCK-2BcDMcLZEufQWoUsY3SAuoKsHeU7-2BF7ywrk-2BiYEAA-3D-3DxdmG_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5gyW9vYE8guLU4lpJPkuhsfO3R-2BI168FlpYbIumrtP6AhWXkdWTIV4w9AKQdH0jV0auwqfg7jgUzE2wx55rr51UMbEHThPaHXTBFgBUk6ZTTYKOrMygBqDWA-2BMyhQgPXF84RngM32dZfvYEzDTR-2FXzzw-3D-3D

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url7254.govtas.com/ls/click?upn=u001.ZCx8SEvFUnsHCsy3GeLa6H62llxT2xiGDaDEHYtfcv0qCK-2BcDMcLZEufQWoUsY3SAuoKsHeU7-2BF7ywrk-2BiYEAA-3D-3DxdmG_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5gyW9vYE8guLU4lpJPkuhsfO3R-2BI168FlpYbIumrtP6AhWXkdWTIV4w9AKQdH0jV0auwqfg7jgUzE2wx55rr51UMbEHThPaHXTBFgBUk6ZTTYKOrMygBqDWA-2BMyhQgPXF84RngM32dZfvYEzDTR-2FXzzw-3D-3D
Sample260525-e45eqsev2t

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4940_1277687509\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4940_1277687509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4940_441848357\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4940_441848357\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3172	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241570529271238"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{D93E418F-D6F9-4368-9432-F9740C147C06}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5588	4940	msedge.exe	84
PID 4940 wrote to memory of 3172	4940	msedge.exe	87
PID 4940 wrote to memory of 2652	4940	msedge.exe	88
PID 4940 wrote to memory of 2652	4940	msedge.exe	88
PID 4940 wrote to memory of 2652	4940	msedge.exe	88
PID 4940 wrote to memory of 2224	4940	msedge.exe	89
PID 4940 wrote to memory of 2224	4940	msedge.exe	89
PID 4940 wrote to memory of 4152	4940	msedge.exe	90
PID 4940 wrote to memory of 4152	4940	msedge.exe	90
PID 4940 wrote to memory of 4988	4940	msedge.exe	91
PID 4940 wrote to memory of 4152	4940	msedge.exe	90
PID 4940 wrote to memory of 4988	4940	msedge.exe	91
PID 4940 wrote to memory of 4988	4940	msedge.exe	91
PID 4940 wrote to memory of 2044	4940	msedge.exe	94
PID 4940 wrote to memory of 2044	4940	msedge.exe	94
PID 4940 wrote to memory of 2044	4940	msedge.exe	94
PID 4940 wrote to memory of 1300	4940	msedge.exe	99
PID 4940 wrote to memory of 4084	4940	msedge.exe	100
PID 4940 wrote to memory of 1300	4940	msedge.exe	99
PID 4940 wrote to memory of 4084	4940	msedge.exe	100
PID 4940 wrote to memory of 3008	4940	msedge.exe	102
PID 4940 wrote to memory of 4732	4940	msedge.exe	109
PID 4940 wrote to memory of 6092	4940	msedge.exe	110
PID 4940 wrote to memory of 4912	4940	msedge.exe	111
PID 4940 wrote to memory of 792	4940	msedge.exe	112
PID 4940 wrote to memory of 792	4940	msedge.exe	112
PID 4940 wrote to memory of 2692	4940	msedge.exe	114
PID 4940 wrote to memory of 2692	4940	msedge.exe	114
PID 4940 wrote to memory of 3596	4940	msedge.exe	115
PID 4940 wrote to memory of 3596	4940	msedge.exe	115
PID 4940 wrote to memory of 4120	4940	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url7254.govtas.com/ls/click?upn=u001.ZCx8SEvFUnsHCsy3GeLa6H62llxT2xiGDaDEHYtfcv0qCK-2BcDMcLZEufQWoUsY3SAuoKsHeU7-2BF7ywrk-2BiYEAA-3D-3DxdmG_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5gyW9vYE8guLU4lpJPkuhsfO3R-2BI168FlpYbIumrtP6AhWXkdWTIV4w9AKQdH0jV0auwqfg7jgUzE2wx55rr51UMbEHThPaHXTBFgBUk6ZTTYKOrMygBqDWA-2BMyhQgPXF84RngM32dZfvYEzDTR-2FXzzw-3D-3D
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffc7580c188,0x7ffc7580c194,0x7ffc7580c1a0
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,264870608301002489,13580598733055987850,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8581683237374958426,14031655136744751117,262144 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,16857863586453981998,4034855358577835726,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8486347537303795744,5171635535875239476,2097152 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15141954204736639711,17084982137819552552,2097152 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5024,i,7236748655830674978,9868355352797045014,2097152 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,11757455035840604465,8632445392605867007,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,11580111342088021335,6280818488309928057,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7126347883393419041,11257863956334605771,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7126347883393419041,11257863956334605771,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16031951893486295699,94834376630803734,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5392371550776970316,522832465314256099,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14310287428989989208,12197635108590604134,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,2397426268077516602,6477423829813950623,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6947978020326808363,7564545497358003873,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,625887948309580345,14463489810108664999,524288 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,9080596252773986330,4867380841592636100,262144 --field-trial-handle=2280,i,9771566306367858405,16125675704628835747,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 84e7f8e388f99a0b45275b7d8917941bb4193e529d2f51778992ca1db15d9367
MD5 8f88871a271b05d696e240bf2fa13e38
SHA1 a2b486c3d14b425d95c87d18bde78e1e8cff53a1
SHA512 3e0785d4f9eecfb412bb537ab4f147c6a0be1aa45b4ff121c16297a7156d3cd901f4d0ae2a42b4183031279da86e64106dc72c7351f483722491fd3e65d398ac
TLSH
T1E6F0A9E5CD21AC3718FD1B2960A94B46F75413673B41855B3B3D530C8FB5A3B468591C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0dcf4df2d18ab4d7d877c46248ec5271898c07a43abe4aff47490c083be2baf
MD5 009d21f50d82ad736baf3a984d31aea9
SHA1 17a1a3d8bb1df400cec475982ec0909853ba611b
SHA512 1499cc8f38a3bbe9aca7f3dce1984fbf4180427870bc10a71a45952f66e2fe30e7dcbb0d67ba66f8182d42dd77edc07e8be96338aa5174ecbe8704e989957e94
TLSH
T13B519838CAB13B20FB3710B190D86255367582C3F5A76F7BD1D8B87D563E3244136841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ac6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588ac6.TMP
Size 2KB
SHA256 37878f2e8c63d90e98db8a0a74b5c60e4734aa692a9730bdcbc84cb13c2b230c
MD5 95c6e525dcb64e42ed4385760fa695a9
SHA1 8894856b7bbd7e35426f12684df79dc901d2857a
SHA512 064ddc2e6e734e051b11573ad07e154d8f2cc79e5379fa256d3a75ac89c656037819d8be864739d0215a8f70e273ab6dd39f3bd1a8bbe603eadf8907ab06bd91
TLSH
T116518438CEB22620F7330070A0EC56A5367982D3F9A7AFB7E4E5B13D563D7248136044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f6aa367965787d2cde0a4c119e1659a2c401c7b5d7f8954085b5e4b52321e776
MD5 bf76656841a703a8335d039a69d9e09c
SHA1 7ddcae077e46f05c7550a82b85fa69b3d0905771
SHA512 70b228d13cfc9102f93fff92332c4c60988db56274c7b6ca7cf0ae10ac404eb370b7a3ec3190d5315cc02c7d7a8b6b9fce04029b8367d4efab3e4b3a86be0188
TLSH
T126619AF783F8852D891256F4A718AE1FCE1D0514832C7D6A88E49F1B93E3470E101B9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f7778dc02a48acbf3218203ef82ff634a4acc4f322515ce85b929fb2d56736ba
MD5 1767eaab3f5cb443abd021d5fa123418
SHA1 43649cac4e19727ecabd9b22df24a2b7d66af6f1
SHA512 4d26aa1632e382ef0c6ed81141f22859a8778a3533f44a63f2825951927220166bc7df69a49b46f73c67e056fe787195f245ea7d7fe74271ef93a67d2229d6d7
SSDEEP 384:sxZ3yoqo2/fosWZC5rl2z5dHf94/Ac0tVY9:sPQo2/faZqEvHf9qAcKK9
TLSH
T1D672E916AA3849778CDBD21AFA457F53D7F9557391904E449AFC8B0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 17326dc34cc1479dc0659f4622e6fe131f6f1c85fe726534a96e5a28583703c7
MD5 58d7662859d6ddbab867f7f20244b06a
SHA1 98243fc8cc766f386e34f28b7c2419f62c467c48
SHA512 8faa62b65bcdfbc6c2c486d03f6c471b6dddecee858bcdf7a9690bf7f63e78be0d7a01ef579716ba358e3ff1362b6a1a69432f26738837eb83583911e1292f0c
SSDEEP 192:sxZ3Ro1yMqZjK1Ml8Mk2/fos878Z5z/l2QYCzodpOSHm56+WNZok4/YQkxcRiIg7:sxZ3yoM2/fos87C5rl2z5dHf94/Sc0jf
TLSH
T19362E9166A38597B8CDBD20AFA457F53D7F9557392904E449AFC8B0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0cec550a3c49114bebbb11eefae41be1480f3b6016d05bd4490b686e156714c8
MD5 ba5b40cd61a0e5e16fd76a0d5d88f01a
SHA1 28d1e4354b265ad466b08a3e832740202e3dbd55
SHA512 410651ae2d991306d6c66aed72c4e454d07b1589798785e5f5a5fa79e32cfd62d36871ef47e8aac79d5c6046c978a3dce8659a65dc586f544410fa21cdc41a15
SSDEEP 768:cFADqyj7pLuLniGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGHSRLl5bKp7ro3:cFADqyVEniGWviq5iu1jafHSRLDmpIUM
TLSH
T1E3F2FB3B6C4CCB7E4F844E9CED2A7E8F6DE8028B5698895447EA840C02C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 c51732594e2b8535daa6a496dc7ef9948477ed2a82d9ef2438a68cbe9d77cdbe
MD5 b79d026255ff7809b6e6e7cb6f1f4252
SHA1 f3da199468aeee53f30b351a9f8b6c2d2808d7f8
SHA512 d1b8c9b5aff024fccfdec2fbb13eb0734c65aaf8acf9f1f171461723edba6d3d35a5d73f3c64b113f4a70ae0b41040bdafb0df5f966b7453c16f49b6b9123ce4
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2A:cVSnNDxZ9l3iZ3QxVl/1hVPEzBD
TLSH
T18FA24A16713A461238BD6D4CB3A68A3B4F4271633418E5AF7FB810760E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8165235f8777d38acd0978a2e46552fc268a25f92748271ab42ffff626c9837f
MD5 a8ee71ebe086e6a37308f73e37a54cb7
SHA1 6e1b7ae414c4f727ba0eeb36ec00a62f975ab90a
SHA512 0d832ab57ac51a17def2f84eda57f868b1e4c7f2508aba3ab705a0fcff8850d891c64af0804625b2348935204f4b4698a700d541ce2c3c6e739411373944aa1e
SSDEEP 384:niiF1tNnNnb9/sR3sNM8TUNTUlI4k4JbhSCifbZoiexId93dXhguVj4F7IgNI:pF1jZbG3ZwggQoiexIl3jOI
TLSH
T1E1E2D5F198D79977E8AE4B93A33E2E429ABCC167B5885990F7C44D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dbb597dd4f45e12a939fc4a34fc3ca928dd3e199794fbc050e028d55e1e526fa
MD5 8ccd3561452d6a141ae5cb110117266f
SHA1 0c4afd2a8d44efef18c16a3002f1fcc7a49fdd1b
SHA512 10fac0a18f4a8566f0c59653192e9b00c9885caf80c370edac0713bed017b9c2d03d9bd9f5c89fbdf7e26477b514fb62fd334668295f10b39b7dcafe5a0f97ed
SSDEEP 384:ndiF9CcmyWCs3sNA8TUNTUlImkrJ1DJCifbZoiZmhkP+lFYS/I1l1F7IgA:UFccps3RwgFloiZmhkoFYS/MS
TLSH
T154B25B36EC98CA7BECE64FD6E64A3A47DEE011B7959899D4DAD81D1C00CB1DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 296ea4414397d70c2f099d2e73f8d71200178a4a68b2e11880a197a8c2271657
MD5 4ab554fcca73d326b03c8b07b7c2f967
SHA1 736487c0ac7cdbf09d3765e966511f60d6ab57e2
SHA512 658843188c9265aeb3888af89156872492f330abba64923ff2706d99298eb4bd0a73129a48294c2a671eade4a7b08e7e200bd5d43337123d050b4d2e21968e11
SSDEEP 384:nSiF1tNnNnb95R3sNM8TUNTUlI4k4JbLSCifbZoie6Id93dXhguVj4F7IgNI:ZF1jZbx3ZwgCQoie6Il3jOI
TLSH
T15BD25C32EC64DAA7FDE74FD5A24B3647EFE451A799985AD0EAD84D0C00C72AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 962875a150d4e72b59a8fab28e2e65d2d2ee4f1de0342cb536f588e238ad1ffb
MD5 0e728588ff28d79f8dbbbfb093078c72
SHA1 df87cc3c5426c4730e2e38b4a744cba8a543791b
SHA512 0cb6cd6cc8e9e1cc48063a85bf004a5eb7002729961d43d582b3ab94e4aa369ea5290e0b15261697abd580a72a9841c4b4694a4b1d0fec0c806b696cb68f865a
SSDEEP 384:nciF1tNnNnb95R3sNM8TUNTUlI4k4JeLSCifbZoie6Id93dXhguVj4F7IgNI:HF1jZbx3Zwg3Qoie6Il3jOI
TLSH
T162D25C32EC64DAA7FDE74FD5A24B3647EFE451A799985AD0EAD84D0C00C72AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9e4b950aec2b4b3cf3b707ffeacb49beaf3a3c3a8af3f1c3e3c56bcaf7ad19e8
MD5 fc999c7e0672a9f47c17fe7310de1904
SHA1 c015e84ad62aedbee4263b3bad9165ae5f05b6cf
SHA512 416610c558e0058f1541447a779a2d5330aba9888ecb965bd7bb8aa6751921000c63942152d3b4123d6baa0a7f1160c6f07ebf666aa4c6f3146729258ff61470
TLSH
T13A4130D11C791AC1C4BD0E6FA4CB78FC82ECD729F1A4317D6858EA940A7D61D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d0f7cb221b84c0bb8598a1b3ad66c1ee89d48d493b62079c1e15c8139c2de11
MD5 11e6a6525c60ec64050e66bf82c2ed0e
SHA1 59f890ac92404f5865fc63a02b10ba5969ba8e8a
SHA512 5d3987c3387b569fcc2868126c7b465534a2e0623d80030c9e272473cb25037226bd80babdbc0106c3908a43c4daddb285b9707ad838cdfb572b23014b545cd7
TLSH
T1814141E15C791AC1D5BD0E7EA4CB78FC81ECC729F5A4307D6858EAC40A7961D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4937fb584a86974be279fba7fa3c629483a8ccf5e7e874d8e5719fae5e30573b
MD5 70ff44f8da49fd64bcf91fa6527e1277
SHA1 b06fbdc7f26977d17cda248a541c4baf102ebf9a
SHA512 f747d9c5cceae7c802c31e7d28086feda80769de77414999a173e8cdcea177f188db986b746f45b49e22b5f032ff92905e771a02d74f7ef88bcf449df290220d
TLSH
T1BB410B98A6F92158B3B76E5AAFF6A56D487F78332E16C45D10010E4E0666B00C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3008-198-0x0000022160CE0000-0x0000022161CE0000-memory.dmp

Download