hxxps://eot[.]archinect[.]com/f/a/Cb5ZoTn0i4whmc9HSS8RdA~~/AAAHURA~/7C_WF6HN68FBqXk5dQWmPhiyzq_xSEYDyRZuHViczuJ7iI5l5qxDgKfRKWtdxPqrlwTbrMHLcq00M9KhPZ9LOwvOO6eHeL5RUVEOzxWQNKwhVMZ-YSg4b4oAUoOBk9Dy6n72J1PCSm5XOkHaDBObbMOVN5ERH41XZt4-aUHnic25bJ0tpdDkCYy4-ZL72_Po6m4tGAr4io9sXhBkNjPBXc7uNfFP9lF2coCpdaA7MwBvzLYXwcKtFbZi37RSiQZ

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eot.archinect.com/f/a/Cb5ZoTn0i4whmc9HSS8RdA~~/AAAHURA~/7C_WF6HN68FBqXk5dQWmPhiyzq_xSEYDyRZuHViczuJ7iI5l5qxDgKfRKWtdxPqrlwTbrMHLcq00M9KhPZ9LOwvOO6eHeL5RUVEOzxWQNKwhVMZ-YSg4b4oAUoOBk9Dy6n72J1PCSm5XOkHaDBObbMOVN5ERH41XZt4-aUHnic25bJ0tpdDkCYy4-ZL72_Po6m4tGAr4io9sXhBkNjPBXc7uNfFP9lF2coCpdaA7MwBvzLYXwcKtFbZi37RSiQZ
Sample260702-x4kpfads21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274938769653261"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{BD85425F-04DB-48C4-ACBF-2FFBBFD551E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1744	2560	msedge.exe	81
PID 2560 wrote to memory of 3568	2560	msedge.exe	82
PID 2560 wrote to memory of 2068	2560	msedge.exe	83
PID 2560 wrote to memory of 2068	2560	msedge.exe	83
PID 2560 wrote to memory of 2068	2560	msedge.exe	83
PID 2560 wrote to memory of 4808	2560	msedge.exe	85
PID 2560 wrote to memory of 4808	2560	msedge.exe	85
PID 2560 wrote to memory of 4844	2560	msedge.exe	86
PID 2560 wrote to memory of 4844	2560	msedge.exe	86
PID 2560 wrote to memory of 4844	2560	msedge.exe	86
PID 2560 wrote to memory of 2540	2560	msedge.exe	87
PID 2560 wrote to memory of 2540	2560	msedge.exe	87
PID 2560 wrote to memory of 2540	2560	msedge.exe	87
PID 2560 wrote to memory of 1832	2560	msedge.exe	89
PID 2560 wrote to memory of 1832	2560	msedge.exe	89
PID 2560 wrote to memory of 1832	2560	msedge.exe	89
PID 2560 wrote to memory of 5084	2560	msedge.exe	90
PID 2560 wrote to memory of 984	2560	msedge.exe	91
PID 2560 wrote to memory of 5084	2560	msedge.exe	90
PID 2560 wrote to memory of 5084	2560	msedge.exe	90
PID 2560 wrote to memory of 5060	2560	msedge.exe	92
PID 2560 wrote to memory of 984	2560	msedge.exe	91
PID 2560 wrote to memory of 984	2560	msedge.exe	91
PID 2560 wrote to memory of 5060	2560	msedge.exe	92
PID 2560 wrote to memory of 5060	2560	msedge.exe	92
PID 2560 wrote to memory of 912	2560	msedge.exe	93
PID 2560 wrote to memory of 912	2560	msedge.exe	93
PID 2560 wrote to memory of 912	2560	msedge.exe	93
PID 2560 wrote to memory of 708	2560	msedge.exe	95
PID 2560 wrote to memory of 708	2560	msedge.exe	95
PID 2560 wrote to memory of 1960	2560	msedge.exe	96
PID 2560 wrote to memory of 1960	2560	msedge.exe	96
PID 2560 wrote to memory of 3900	2560	msedge.exe	97
PID 2560 wrote to memory of 4680	2560	msedge.exe	100
PID 2560 wrote to memory of 3844	2560	msedge.exe	101
PID 2560 wrote to memory of 2476	2560	msedge.exe	102
PID 2560 wrote to memory of 4508	2560	msedge.exe	103
PID 2560 wrote to memory of 724	2560	msedge.exe	104
PID 2560 wrote to memory of 724	2560	msedge.exe	104
PID 2560 wrote to memory of 3588	2560	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eot.archinect.com/f/a/Cb5ZoTn0i4whmc9HSS8RdA~~/AAAHURA~/7C_WF6HN68FBqXk5dQWmPhiyzq_xSEYDyRZuHViczuJ7iI5l5qxDgKfRKWtdxPqrlwTbrMHLcq00M9KhPZ9LOwvOO6eHeL5RUVEOzxWQNKwhVMZ-YSg4b4oAUoOBk9Dy6n72J1PCSm5XOkHaDBObbMOVN5ERH41XZt4-aUHnic25bJ0tpdDkCYy4-ZL72_Po6m4tGAr4io9sXhBkNjPBXc7uNfFP9lF2coCpdaA7MwBvzLYXwcKtFbZi37RSiQZ
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd7224c188,0x7ffd7224c194,0x7ffd7224c1a0
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,13133570366973654314,11064844143216662845,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,14981460331023451389,13202765649229471923,262144 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,3039371663292752149,6532548966857801644,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,724402929572737237,2201045768106271831,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17036199108802031494,1101788013025826628,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,13638238570166476952,17792906713734600586,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14781860248677711349,6170324814974198931,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4352,i,8169338751307822187,8483269265377245535,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4380,i,12599596177544279999,11050675785854032910,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3624,i,1196480193545043524,659808078246061296,2097152 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,250070133469785321,7200641383898479354,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,18204227944000600434,788498676021825509,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11853052518642489149,2036895582339773252,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6846861658608304374,4389332058951131000,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6846861658608304374,4389332058951131000,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,8119901249199197502,9246693554562652749,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,17458422138740823063,7079865269910065977,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,11752362576622355258,10076836522691210544,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,7757414517725845374,9732864079814488290,524288 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2332,i,7590815476284065849,7302636344031151247,262144 --field-trial-handle=2176,i,2258926387855188786,8629127705507691639,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 caec8c5ba0957099c5a12f05d522a3ab3f74a60bf095ab342055713b30d65556
MD5 c0317a96ea973784188ea46fe4e361e1
SHA1 2cd1eeed365263cf9bd6340fa5386ce26b5d740d
SHA512 2025461dd46a9ab659c44ae4722392dfa6176dc79bbb42a0a9cda2cea4ad0c559406329cc6800b0a62f02459d36d99633a57227cd7e7818d4239e41b04024ac4
TLSH
T1D1711B14054BD593E3213B31B6D2524234B087AB0A9B9F2355AC81F7ED39BE1EEEE1D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d8a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d8a8.TMP
Size 3KB
SHA256 2ae41bfdd81bf56a7fc39feb98da4077c0d0c3d0203e5e9d15d20d69731ef8ef
MD5 12a98e6e8cd4c779e9aeb9c8ad3787a1
SHA1 b794a43aa32d312a463c14a4844a3c892d69cb3b
SHA512 b053cfae01e298bc799a6bebaa150be1bce649fc09b28d453cecb37f4c196e36f4fc25d52c52ab64fec608fad65a7e1076cc5b04ab3373558eb10da55f6efa22
TLSH
T12061E914064BC593E3213B71B7D26182747087A70E5B9F6311A845F7ED38BE1EDAE1D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e5fcd211a87e4166abb301ce96d4b595f304622621fe62370a0046546142105e
MD5 3f61b68c326cf69b2a410187d6b294e7
SHA1 fb05ac47f27899b444a1b244ca4044f0ef97542f
SHA512 338d12f3aefe612bbb8411562a8fb72b1c0112926341100e73f5f8c6e51033f3264c10a73dd376eae0aef0b25ce85b8a23865c526449f98fe15f9afd4c108826
TLSH
T1A381BBF7C3D9812DC91116F4AB15AF1FCE2E0624832D3C6A88D4BF5BA3E2471E11665E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1837882102ed38991c7a0f5d7732677ea292b2686e776371c78b3cba6adcac74
MD5 b0e8d0507881a4ece42324f4507545ca
SHA1 b1865d9b447bbc4b58a70c8bff478b7b97081854
SHA512 1d778d470f1eafb05a5109211abd38c6bd3514455c0fdefebee2dece641b409feca4c98228662356d0590d3d79d94bebdfdf3d7167cae93d85c8b57fbc7fa311
SSDEEP 192:sxZyR/yM/jK1Ml8UQaFi/fvsvGKCfIoIdpHnQ/W6+WNrCv/Y0uBHWMJY1FIg5aqJ:sxZyZqAi/fvsOXfIZw/bk/5uGx
TLSH
T1A152D7126A3459B7CCDBD209FA45BF53D6F5047296900E44AAFC9B1C02E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d6d383094505b2877929a2f67875f5001a2453526bd46f4c0cf36b77dc5e9741
MD5 429fe14f04d37b1db3d8891e2b5f4798
SHA1 0a8f2d2f95316d997dd959b8aca7962a97ace6dc
SHA512 13ffcb4859fe6f344279251a013e1f20cd0310c37732e97ffd47d7808c34d57898bd8a41ccd41d870751ae699e88a9479a704adc7254c540c381eb4531c2d5ce
SSDEEP 192:sxZyR/yM/jK1Ml8MFi/fvsdGK2fIoIdpRnQ/W6+WNrCv/Y0uBH/tXFIgrJ:sxZyZdi/fvswLfIZy/bk/5u19
TLSH
T1AC52F8026A3459B7CCCBD209FA55BF53D6F5047296900D44AAFCDA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bf7f33ab3c817e6ab2bfb5fad07ba4a91a96b469680cad3cd455a0eedc013ab8
MD5 76cc786a6b4acd33c22bb3f5143bf732
SHA1 c4d80cd7e3c6c890ea95572e09d8f6bf3cca20ba
SHA512 3ed1d84cd42fdd8f351746bd44abeb4035baf49df60c0e56ae78c77a146e24bd1814ea7e0b98bbbadcf9504d9ab56d59c9ebb0f40937822f725512ef543c6c0a
SSDEEP 768:jy/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lOArozp:jy/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dla
TLSH
T11BE23A3B650CCBBE4F844E6DEC266F976ED801CB96584D4047FA894C03C73EA411A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e96429e6cafaeabbffc9e1d385e8afb76d83299b2366b00c69da40b7db808aa5
MD5 dfc6eaba761da492190b25126ddb1af9
SHA1 05a77f1599524370ae8edf1d8680fc91e819949f
SHA512 e1cf21bd958a08bf600318e45ff539c0350d57df6a5127b13746c0850de0d26d73c3246aad52d0a3307a31288d89f4c3e1600078ad41acc369264296176b14e5
TLSH
T1F2A002B406C02865E9444376198A51442764E910A509CB53699B01449DA3369B24D163
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60d577f935a28b05c516b723424ef9eb701a256eb2598cb1e469287befdcc782
MD5 289e9c1787a0989d7073bd1ded427625
SHA1 be0f3a3cd18383dc925e8cdce9d8a5e45949941d
SHA512 8570d0f5caaf3855524dcfc485b3c816fae8db5ed3baa51f432ed036ec3f499669850557ed75443d0f830fe0e0da505e008d2949b26907c48e3b6c575b9883df
SSDEEP 96:K08gKFG66oK3K+un6KgM0lyLf1vz3W7g4:acLZflyLf1vzG7g4
TLSH
T1E3911D5235BB02023C3E3818D6A587674B8275A73018B42B3BB844B5CE67E264FFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddde5ec4-2129-4885-a36d-eaa33883446e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ddde5ec4-2129-4885-a36d-eaa33883446e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 aed057c10546bffc7df977483e850077b037583abad91b0b25016f1b382c81c5
MD5 e38c3a3f6cf2eebd8501d58f3a5678e3
SHA1 4c3ec085ae61ad6a1ab8364e1602ccf4a2961962
SHA512 e0f40fe2df8f31de904f1320138238044bf0247a55d438b8213e3f6a26893e5b5849d978bc2b93c06c7e347c3c1724ebb5c4044cab2bd1117bc48490da7d4be0
SSDEEP 384:GtNn/s3n9Sf8NU/NrFrbi40Hz0s0FptSD+qgQ8uTqKl8BhBTPLBliAV:Gj+9UZ9kYTbkDR4vKl8BvTPaAV
TLSH
T110926C325C341C6B5EA3998AF047391B9EB4417BA6C43F9496EC6F1D05DB39C2306A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5ebbad64a594f43c6f78c21b7765c54574bc5d8ab4dbb4a661312a97a2e15951
MD5 dbbf0e69c08466bd5cc738e5375866ac
SHA1 3a46adf271296bc1fac48dbde3c12e26cbaa17b1
SHA512 4bff56c00982c5ab5c13b4eb225742da3392151ae76697f76c360bf824d2d27bc3e722367c5191a2746a16d0e479b4cb4088df0d2cdea5de6c898432486b60be
SSDEEP 384:KiF1tNn/s3n9Sj8Nc8TUNTUlIlQNrFrbi40Hzas0FptSD+qgQduTqKl8BhBTPLBZ:BF1j+9eBwgc9kmTbkDR5vKl8BvTPaAV
TLSH
T16CC229F248D7487ADDAE8B47A33E2D178DBCC067B5806A50B3985A0CCD972BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 08073ca115bc083359f104f1ec1743dc45397237d28f48fc09c98c960859f0c9
MD5 cb541cd446e63e703e8cd4f6a41d72a5
SHA1 c3632a5689ea3ca51201166bbf7cbfcc8f8c2dbe
SHA512 203ef9b292e39c9adaa157b6a3852e00c3250dccafb790451139c286c2a70a3a95fe426632da9ed23b96090846d21dfa2dd344192fe136bc9ec0efd826f4d963
SSDEEP 384:XtNn/s3n9Sf8NUQNrFrbi40Hz0s0FptSD+qgQ8uTqKl8BhBTPLBliAV:Xj+9Ue9kYTbkDR4vKl8BvTPaAV
TLSH
T115926C325C341C6B4EA3D98AF147391B9EB4417BA7C43F9496EC6F1D05DB39C2306A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4179c6203f0a48bbe630765d28d94d26de525d091e9f7f22cd278f5ffa35481e
MD5 44f6393a7105695eb985dee9fc79e262
SHA1 692b1f63f87c81b275f009178e5968ef66415779
SHA512 d483d5eea55eddaf0f72d557076516d80d0d8341eaed146f9cbaba0c1aed6822c74f8b136978f003a896aaf035ab1ae9465f04a941bbfe8d1ab8e870e9b52b39
SSDEEP 192:qGN56d9402QmiUyK0vNTBF2oP1SD+oGwzZqU6:qGN56740SS1TBFptSD+uwU6
TLSH
T1F002D83668382CBB8EB3AE45F4473B176FD5212B9A846B84D9E81B1C41DB34C2306977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1e5832f2e08fa1df208b9d9f6a24c557804300544b3c9929b60ab2097852dc8
MD5 bef2be6df79e76bc68904f9131054311
SHA1 00b614d1f2d82aacf37ef3299647be4641316353
SHA512 91c1aad63f4e81efd23d18853d904de37c1a1da8458f17a6d49c621e2cf107afc658fdc73e26fa8c27e094a5ec358722309c670249b11a7b9be3e2a8bcbee908
SSDEEP 192:fGNN6d9407QmiUyK/oN8BF2oP1SD+qg7YkyPiDunqqqU6:fGNN6740t48BFptSD+qgQyuTqU6
TLSH
T101120A3758386C7B9EE3E855F4833A176EE54227DB887B4095DC2B1C01EF69C230A567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73ea3d67-d303-40a5-baf1-f14a3a17fb09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73ea3d67-d303-40a5-baf1-f14a3a17fb09.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download