hxxps://salutevl[.]sbs/tQJukKvJBM/api

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://salutevl.sbs/tQJukKvJBM/api
Sample260706-msy3ksh12p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278082668224585"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{0A478F16-4EBE-47D4-B2A1-67CE976603D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2076	5032	msedge.exe	83
PID 5032 wrote to memory of 464	5032	msedge.exe	84
PID 5032 wrote to memory of 3420	5032	msedge.exe	85
PID 5032 wrote to memory of 3420	5032	msedge.exe	85
PID 5032 wrote to memory of 3420	5032	msedge.exe	85
PID 5032 wrote to memory of 3288	5032	msedge.exe	86
PID 5032 wrote to memory of 3288	5032	msedge.exe	86
PID 5032 wrote to memory of 2164	5032	msedge.exe	88
PID 5032 wrote to memory of 3912	5032	msedge.exe	89
PID 5032 wrote to memory of 2164	5032	msedge.exe	88
PID 5032 wrote to memory of 2164	5032	msedge.exe	88
PID 5032 wrote to memory of 3912	5032	msedge.exe	89
PID 5032 wrote to memory of 3912	5032	msedge.exe	89
PID 5032 wrote to memory of 1036	5032	msedge.exe	90
PID 5032 wrote to memory of 1036	5032	msedge.exe	90
PID 5032 wrote to memory of 1036	5032	msedge.exe	90
PID 5032 wrote to memory of 2056	5032	msedge.exe	91
PID 5032 wrote to memory of 2056	5032	msedge.exe	91
PID 5032 wrote to memory of 2056	5032	msedge.exe	91
PID 5032 wrote to memory of 3112	5032	msedge.exe	93
PID 5032 wrote to memory of 3112	5032	msedge.exe	93
PID 5032 wrote to memory of 3112	5032	msedge.exe	93
PID 5032 wrote to memory of 2140	5032	msedge.exe	96
PID 5032 wrote to memory of 2140	5032	msedge.exe	96
PID 5032 wrote to memory of 2140	5032	msedge.exe	96
PID 5032 wrote to memory of 1832	5032	msedge.exe	97
PID 5032 wrote to memory of 1832	5032	msedge.exe	97
PID 5032 wrote to memory of 1848	5032	msedge.exe	98
PID 5032 wrote to memory of 1848	5032	msedge.exe	98
PID 5032 wrote to memory of 4060	5032	msedge.exe	103
PID 5032 wrote to memory of 3352	5032	msedge.exe	110
PID 5032 wrote to memory of 3352	5032	msedge.exe	110
PID 5032 wrote to memory of 3352	5032	msedge.exe	110
PID 5032 wrote to memory of 1668	5032	msedge.exe	118
PID 5032 wrote to memory of 4836	5032	msedge.exe	119
PID 5032 wrote to memory of 640	5032	msedge.exe	120
PID 5032 wrote to memory of 3724	5032	msedge.exe	122
PID 5032 wrote to memory of 3724	5032	msedge.exe	122
PID 5032 wrote to memory of 3724	5032	msedge.exe	122
PID 5032 wrote to memory of 2756	5032	msedge.exe	124
PID 5032 wrote to memory of 2756	5032	msedge.exe	124
PID 5032 wrote to memory of 2024	5032	msedge.exe	131
PID 5032 wrote to memory of 2024	5032	msedge.exe	131
PID 5032 wrote to memory of 2024	5032	msedge.exe	131
PID 5032 wrote to memory of 1552	5032	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://salutevl.sbs/tQJukKvJBM/api
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffee8dac188,0x7ffee8dac194,0x7ffee8dac1a0
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,12103706635940553513,11850204566340993233,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11275755607010543813,7349447372171994950,262144 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,18046688752952091629,6983091297183941237,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,12089868791801969196,12351361415192914420,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7116445687397298605,7402508986550100538,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,18355150578799311861,16467337286480161282,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,793225883237174079,11296002131338472744,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,15527682354652320891,3816136933780906701,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3592,i,14340515176068761818,6919607567089561854,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6800568091605681131,4466131575716976946,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,2088023681847429786,8578294699810450290,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10738068853802872080,6253526086820175517,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10738068853802872080,6253526086820175517,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5108,i,8359051760129101387,2443652702784284104,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,12525281911448961891,13266668636411739300,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,5417644216057145170,9946118552053984389,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17088498499607494708,2909732416533769155,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5364,i,15122134200858847985,8640860829033039995,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,17457878319491857333,8158621553467865697,524288 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=760,i,31918838877457050,5031299534228970978,2097152 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4344,i,3538232883191653476,15268492004891135993,262144 --field-trial-handle=2272,i,15062099853506731858,6473906859131797897,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32a596bf84fcc8f9b182031f9d9d161970edf4b11df454da89c39085bf040357
MD5 8d886d35526343cd2798d624b78f761b
SHA1 33d08703a00fa3d8da06ccbf1ad6d41c11c2ff9c
SHA512 261fba45782df63d2eb88d4cddfed1b97c4b38bd0c3905146caa01861da79c4708c91bf9df89dfc47c924c4899494ccce988119835383e17866685b03399a062
TLSH
T1DB71B5653351A4B5EFE5493CEDD24AD579B070850A139EAA01705B3D2BDDB5F0C201CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b65b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b65b.TMP
Size 3KB
SHA256 809c12afb780c57d3eb813e3d6563cdaa1f48bd9a1079416482670158deaafea
MD5 5d6070be895c20b11fcb0a5def7046b7
SHA1 6e37e114c40b0183cd808dd83a47873313470002
SHA512 9d9e92f869bf1e3c70c12ce00169447ea06bbc021cdd95d8d4ffc21b54a461f847670d1556e951c1753996e2f3d157e2c0e9fd5c2f5c93f16d7caa25a6b8c80b
TLSH
T1B371B3663352A4B5EFE5493CEDD24AD979B0B0890E139EAA01705B3D2BDEB5F0C201CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1327a9475fb420c8ae73f376e1bcc272df646a25eaaee3706cc1826a4144397b
MD5 a150d0d25c2322f3adbfc29e06548dcd
SHA1 01f916cd905e0d5819f77fb230df93d8bcc61bbf
SHA512 42e5c89231f574e94cb4be92f73979d73b8017b82c017b6c11b41a4c295ca38b485c4f439f6a5b52f943930d1d49fe30cfa0a0e4f745b24ebd493a3326f50918
TLSH
T12D117AF3C3E585AE8A0156F06A24EE2BCE2D0606432C7C19C9D4EF2B93E3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e72eb82377b25940e6ce507f6ca10e8ab7935c96d5c40ad3c212a1eea18719bb
MD5 5c847aced57c10a0e4f93cda522654fc
SHA1 0389cb587430b698b467f27c347b405c0dd3da56
SHA512 d84c534a3f334fefb830ae49cc13cfea2211f3e9f84333b2c400490de3822acb82d296e59987a106bcfff609423a6c837ddecb43e80a8261d29b7c2c68f4671a
SSDEEP 192:sxZBRqyM/jK1Ml8UQ/kv/fFsgZSvdIdprCHW6+WNGY4pNnDIg5zJ:sxZBMqsv/fFsgZaeeHbGl3
TLSH
T1C052E816AA385977CCDBD219FA55BF53D6F40472A2900E44AAFCCA0C05E7BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 754194574553465dbce2ca5289f7c094ab7eb229bfd4724c1008b1762a5bcfca
MD5 c1b71996c4e74e6b0f8e2acf13c663b9
SHA1 948e34182431dcb5ba849a2814ae7c701253f924
SHA512 56e56694b55a0b6c4715e069c1d68bb3c8871a2ca14b34edd1fdaa827419e2c4e0b071e1cb020b62a28df15f4904637c42df3f37e1a316bf67f7556a3003f907
SSDEEP 192:sxZBRqyM/jK1Ml8Mkv/fFsbZSJdIdp5CHW6+WNGY4wInDIgrJ:sxZBMMv/fFsbZAeEHbG79
TLSH
T11A42D816AA385977CCDBD209FA55BF53D6F80572A3900D44A9FCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2c6fae7758d3edeedc6d2593a09e9466851b9c67ef7ae72776830e83768dbd05
MD5 2eb0f6af2e994aca03151fc754340735
SHA1 2a3b5214d0f5f9d738b8b15f942d4043c9659745
SHA512 675190f4029e3a534898c54e0bf6b84bff3d5e4bfd1da92554bc980617089b349721b015838715db2b8bbb8074dcaac5349d8592ec4e3c9c91868bb6d8fbf9d0
SSDEEP 768:sW8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdzroWkqeUn+:sW8iJPNWvx76ru1jahALocdAoeU+
TLSH
T192D20A3B680CCB7E4F845E9CEC266F966DD801CB6B948D5447FA880C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec86a1ede7c96683e1795b228b49f4f9567fef3c17af00a4d3a44681254e8da6
MD5 9ceee1e775ae6bc245fb96aa53ec6e63
SHA1 5282fed3275e0f797c0a3487015fe6d4aa5196ac
SHA512 d3d3513913129cfc1e116dcafc363621c6bbdca7923be2d2d3e96ece0ab901dc664c9feb4853536d1b6737e55f9c6c9fb8eb01f113e8bbf673bd49f2f546ed47
SSDEEP 96:KoZ+Ky06SCsKnqNgRkQiOCYWm7LgYYK49gKYcY4rKQ1Hc9oMmqL:093wgRkQiOCPm7UY89gK3Y4rKQ1Hc9oU
TLSH
T12D915205327B02852C7E6418D2A48B67DB8672633015E42B77AC06F24EAFE254DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595356.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d0edd94787a3e7703fd15e59377ed2787beb4783db901ae11c86344cb70a4232
MD5 6ddc7c36a15aff40994d007861c90eb8
SHA1 2d37a850de2502f6ec07abf420add856ae594bd6
SHA512 4aaf1e9c5fd1c21bddd1eb9a8d97603368acdff84df8125f82f63427a9823cc749ff0f915a7b0e4578e596cb707beb41647c0ec26dcdaf660384de28a21141d6
SSDEEP 384:diF1tNn/s3n9SIzsNV8TUNTUlIlc5H2t5kVHtZDdOObjI9G6w7p:UF1j+9bwwgtqB29Mp
TLSH
T1C8A27D335C688A7B9DA38A54F54B361B9EF441BBC7C56F94E2DC9B0C01DB1EC0306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d1a06b0908f3c28e339af15a83a927ada747b2799ecdc7991749fb3ba1d3277
MD5 293d5a9fb9ec685d26e50be2cc7e9c5f
SHA1 37f4e376bdc303628eb911ac6962dec08f897371
SHA512 1aa9fe184a7e89d7eed6773f9e79ceefe25923f7dc7afb6c46bc35498f6b8e84cf893fe7e4463fc2f52becd74e9582c1791b25ae250ad6afa669303c662caabb
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5x35DxLBhPwivh50xy0SFYKRAxcC:gONp6kDfQmiUyT7Z903YRQiXQU6
TLSH
T1A902D83568782CBB8EA3AE49B48B37275FE9113BEBD52F84D5E81A1C40D725C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 811ca10dfa9d36273c2769d28013105ce4ef19b56275a82d7bf49001d55f0599
MD5 108f874eefd62f50b478d7398afd4194
SHA1 708d5a05aa8820d33cf1c39edc69cef3b71ed6bd
SHA512 c5ba228bf11387c12dda2fe2db4292fae929699479ff09ff44c3d0e794039d5992a6e79efe9914db15c6b1938672303c08fc49cd5bd8fb882f266cd53488c48b
SSDEEP 384:1tNn/s3n9SfsNLR5H2t5kVHtiDdOObjI9G6w7p:1j+9UdTB29Mp
TLSH
T1DF927D32AC785D7A4D93C565F04B3A1B5FF8826BD3C92F8495DCAB0C05DB2AC5312626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42706d25190bf520e25e1ad625143ad70f53f1e39964823051a0a045fbf95b12
MD5 4543ce95814f1f62a44a90efe94d2263
SHA1 989c7f0cc01646f8701f42e516230181372707ef
SHA512 ae332060a297b854495641472391581980964869f96765f04e5bd0203378e92667c88a6127ea8955bac49e90407fd26a72cab38970ec62604a7958624702f84d
SSDEEP 96:fwqONkoZQsjpfmUTepK5ih/cIPURHl8h4otop5x3sDxLBfzPwivh50xy0SFYKRAj:TON26kvQmiUys77903YHHNhcR7qIdU6
TLSH
T13D123B32A8B86C7B5DA3D955B08732275EE48227EBC97F80D5DC1B1C01EF2AC130B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0ac617a06014e048bba837b26373c514600d68f36696acd54cb5954a9bcca3ec
MD5 eb65cd51c2065fbc3e32d0ce8855f584
SHA1 552f31905bd5eeed8e2dbf04af798c3be1bc28b1
SHA512 a5cf841f9a3285ab83bf330f13aee0fcb070016ed59bab5d7702e070c94af4ae0de46a0db702d15f14d7a5748b2293dd53fe93d1cddeda6ba56812c4f9f0f6d1
SSDEEP 384:btNn/s3n9SfsNLc5H2t5kVHtiDdOObjI9G6w7p:bj+9UeTB29Mp
TLSH
T197928D326C785D7B4DA3C564F04B3A1B9FF4826BD3C92F8495DCAB0C05DB2AC5312626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04991b4a-e5c9-48a0-8c81-e61f7bc4c44a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04991b4a-e5c9-48a0-8c81-e61f7bc4c44a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6291bf1586c25f38ffb77351096fd9cfb01b09679a1c599ad471e2f6ffed38a6
MD5 64af831a106e1ab18614e2e51dcbcd0d
SHA1 ad3f3589deeaf8ad132f7022aa7d7cc1c95f603b
SHA512 87363a1fb73ba64f13bd7376663ce71fc57b6481d9a854a7d8c7808b4638f965859da3b70963a3cd236d97f349397234d48befc3423295d48c955c2feef85a84
TLSH
T1E341285CAAF91108B3777F4A9BF7A96E847AB9332E47D56E00110E4F0623A40D972737
MD5 SHA1 SHA512 TLSH

Submit Download