hxxps://megadb[.]net/qi8ucq5zblcn

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://megadb.net/qi8ucq5zblcn
Sample260709-yymsaaas2w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281015224581679"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D0C8CAB4-36D7-4325-B2B4-75061427550B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2416	3884	msedge.exe	87
PID 3884 wrote to memory of 5032	3884	msedge.exe	88
PID 3884 wrote to memory of 4164	3884	msedge.exe	89
PID 3884 wrote to memory of 4164	3884	msedge.exe	89
PID 3884 wrote to memory of 4164	3884	msedge.exe	89
PID 3884 wrote to memory of 4668	3884	msedge.exe	90
PID 3884 wrote to memory of 4668	3884	msedge.exe	90
PID 3884 wrote to memory of 836	3884	msedge.exe	92
PID 3884 wrote to memory of 836	3884	msedge.exe	92
PID 3884 wrote to memory of 836	3884	msedge.exe	92
PID 3884 wrote to memory of 3312	3884	msedge.exe	93
PID 3884 wrote to memory of 3312	3884	msedge.exe	93
PID 3884 wrote to memory of 3312	3884	msedge.exe	93
PID 3884 wrote to memory of 420	3884	msedge.exe	94
PID 3884 wrote to memory of 3268	3884	msedge.exe	95
PID 3884 wrote to memory of 420	3884	msedge.exe	94
PID 3884 wrote to memory of 420	3884	msedge.exe	94
PID 3884 wrote to memory of 3268	3884	msedge.exe	95
PID 3884 wrote to memory of 3268	3884	msedge.exe	95
PID 3884 wrote to memory of 2252	3884	msedge.exe	99
PID 3884 wrote to memory of 2252	3884	msedge.exe	99
PID 3884 wrote to memory of 3564	3884	msedge.exe	100
PID 3884 wrote to memory of 3564	3884	msedge.exe	100
PID 3884 wrote to memory of 1520	3884	msedge.exe	102
PID 3884 wrote to memory of 4500	3884	msedge.exe	111
PID 3884 wrote to memory of 4500	3884	msedge.exe	111
PID 3884 wrote to memory of 4256	3884	msedge.exe	112
PID 3884 wrote to memory of 4256	3884	msedge.exe	112
PID 3884 wrote to memory of 4256	3884	msedge.exe	112
PID 3884 wrote to memory of 5112	3884	msedge.exe	115
PID 3884 wrote to memory of 1460	3884	msedge.exe	116
PID 3884 wrote to memory of 4100	3884	msedge.exe	117
PID 3884 wrote to memory of 4168	3884	msedge.exe	119
PID 3884 wrote to memory of 4168	3884	msedge.exe	119
PID 3884 wrote to memory of 4564	3884	msedge.exe	120
PID 3884 wrote to memory of 4564	3884	msedge.exe	120
PID 3884 wrote to memory of 4564	3884	msedge.exe	120
PID 3884 wrote to memory of 1328	3884	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://megadb.net/qi8ucq5zblcn
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffcb753c188,0x7ffcb753c194,0x7ffcb753c1a0
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6820197843538278549,4579483582678216794,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,2203359199946322896,8075195451420836256,262144 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,8441944567402180670,9414798216553873515,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14914276177488707629,2928706430927103786,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5042363103715787690,5251262417093403557,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,4073561076093440640,14299146059264958314,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8072277075958101387,2890998336857389588,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,3853267908889927689,13154034781546405731,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,7731814508473064934,8070107173012837415,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,12222280573126000145,1739974439319324169,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,12222280573126000145,1739974439319324169,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,11469389466931624199,12242540255112142395,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4528,i,8445680979489036680,5527073437711263668,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,11952037018607881398,11919854147447071588,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,592442472582170688,4525974216877996874,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,10053187933948445137,14506071836377954520,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,15269983643177167821,1216173578326959041,524288 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4248,i,11903527914396758473,1014426923124201514,2097152 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7080,i,1666807166534779094,6844987725645377682,262144 --field-trial-handle=2256,i,1049983785371869570,15868518267578402106,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e82fcafab9a3a10f1a72e42b5ed24436d46efaa95dd26640498c18b35a7cb1a9
MD5 b570052fc67f7afeec2ac5f869c326b2
SHA1 7a89cd04f9194b6398479b92b884aa0843da6484
SHA512 8f9319252c978a20c1cd86e9c113d6b772c1b6a49cf7c83c0e144ef892fb05c87dbc7e9ec28c21de586505b5acfaf2f55ac2b99a96189b14ad56ee1e599fbb5b
TLSH
T12671C4BD0292EDF6E3E1397180D03AA739F1D0E8F927FD1D129384B5A41AB614A694CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be79.TMP
Size 3KB
SHA256 52c8da51abf6e871cb3a3060562729494f36d38d4c2cc3591aa267a0aad674cc
MD5 06bd65f419e38387edfb9ee931da241f
SHA1 ef49f293092ddf784ea1439056ae2c6133223b96
SHA512 ebd5f53e61cf7a944573de3f76f05cf34b5798d0d032d2e1e5ddfff255d150bfc190ee4efbc6e39711fdeaad9c70600d4256bfa77f3b5ddeaf4876c109202a5b
TLSH
T1BF61C3BE0582EDF6E3D13A3190C13A8738F190E8FC23FD5D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 743d6fa43f40db82b6ac19f10713d0e57a9e159cedc6a815880ac32e8d482bd9
MD5 ea0d6e4ef634219dd7c7a63059f174a2
SHA1 4b64ede460e03f89b51f72f9be069d805fda65e5
SHA512 3aefa856d6ee01d30c79188cda3ed47a80b223081fb545ac83faa508df3d2597cd084414dd48219367b7790784cb1ab2613f88de182a62f6f1c80d07363832b5
SSDEEP 192:DWHnVv5hRrEAjYbQF6ublM885VcoMJFb8KYj6yGr7otQzhm:DWHnVv5nrEAjYbQF6ublM885VcoMJFwF
TLSH
T1B0D16BE2C3E4861DDD1152F4AB146A2BCE191D1943283D26CDEDEF1BA3E18B1E20275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed647a1d50fe41b16db8db3e7fb7fbedcf3d3a2aef7cfed550c4b59bd10a2e4d
MD5 58146f993bb3a54f6eaf58463c1bfa9d
SHA1 a1cc236697fb93b362fdb3e3859b3f3324b2d9f2
SHA512 2eb5a7ccbf68361f47ea6ac455e026750f668012762ec849969e86ec8d45165242d8d4f2557cf46a08f309fd03f28efe3f96d810a4844eeb58af5ad289e81818
SSDEEP 192:sxZOR7yM/jK1Ml8UQs92/fKsNkNfYIdpwpHW6+WNlB2ZY9I+styUIg5yJ:sxZOdqq2/fKsN+R4HbmZSYA
TLSH
T11F52D712AA385977CCDBD20DFA55BF93D6F5547292900E44AEFCDA0C01E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dd4993e35aaecb6d9fee576bee81d8ac3cbbe0a0983042ebbd9cae6a76a51fdf
MD5 72afe906e0b308239786b8daac299b87
SHA1 6542ffa84230caa6fc120350f1215f112ad6dacc
SHA512 97e023e1bd9eb6a029fa2a398da28955163df54abff21d12982af8c99d52ff3271b795f349f84314c1f2aaff12b8eee4dc7ed4a2632a7be8e6b7e97b2c258eb7
SSDEEP 192:sxZOR7yM/jK1Ml8M92/fKsNkXfYIdpGpHW6+WNl8zXY9I0RtyUIg5AJ:sxZOd12/fKsNER+HbqXLYC
TLSH
T11F52D8166A346977CCDBD20DFA55BF93D6F9157292900E44AEFC9A0C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69255296a1cf828fe8903602224f19b1760593214379f7af0ee2ff87a2f14f0e
MD5 6a5223e6ee1304d0718fff8bc09f8cad
SHA1 25f938a67b814cf30d1db879760fef5cc95b317b
SHA512 aa83cd24001d5f14ef74c633df13afb43ab10da656449beb91123488b261df493f7d04e26c7b64dfa997418c8c1aa1b578079414631472b3348c83adfed8e348
SSDEEP 768:DEcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNEroJg2z:DEcv21wWvu+z+u1jaeFLeRNPJH
TLSH
T161E20A2B280CCB7E4F845E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 efcab20dddda60b4c4bd091f0533dd2f016ce8cd3f0278f0c18bdb5e0bcf4f7b
MD5 bf6a08e7a7916189bcbb341587904fff
SHA1 f52463b4b9c2fb33a668ec7df78bf5f1bc086625
SHA512 f2b74e46134cb8884acd77544e063d6fbf385e520d22cf4cf372d4595b20a82f302ef5fa9c3e8c3c4b9727afa849072091dff5574182bba0983083e88956be16
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaHwBUAyeSIWWLbgIIK4Ng6Icoob0:mTfHHwBUAyeSfWLkIMNg6noob6AFHoZR
TLSH
T152917711307E428338BE6C8CA26A856A4E8171A77459E57F7FB900910F2BE136DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc193857-f20b-4ab0-85f4-35b128746505.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc193857-f20b-4ab0-85f4-35b128746505.tmp
Size 12KB
SHA256 de18928c36cf59fba43182a189b0df2247342c570ba89e3adcda1bc653d9ff04
MD5 3a889f183371ff3de995b94b3491f8b0
SHA1 923be84102cc939afea8a2367e337567745fa302
SHA512 026b304f23ae5e417930c7446d19c183f4887fee0ddbda291d4b34fc32bf1d2015cdc16df827862fbe5705fadfbda2251f541dc31e932ed96d82a0bf218bda63
SSDEEP 192:sxZOR7yM/jK1Ml8Mk2/fKsakXfYIdpGpHW6+WNliI/Y9I+RtyUIgrJ:sxZOdM2/fKsaER+Hbj/9Y9
TLSH
T1D342E8166A346977CCDBD209FA55BF53D6F9157292900E44AEFCDA0C04E6AEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592f92.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c33a00d5889e26b9c7c7548448a3eb2667f3951db79bbb15567903be957c5450
MD5 9c826d1a07e2b956f160a2c9f2c593c9
SHA1 26563fbbe6f1148a160d55b40d20292078fffab1
SHA512 a3860b429e1f4110070bbe72fea80c4ed9c6e67616d0cae6d4350398cf6125fb89ce33d089649340db21141ded7f192bdfc87b988af73f19e5bed4bf5bbc964a
SSDEEP 384:ytNn/s3n9SfsN56l3RUzirYIe+CXOmep3Jrm0nDVcl1lIO7w/RwFtn:yj+9Ud3yBbvO9p3hm0nDVcLCO7w/RW
TLSH
T1F9928D36A8656C7B9AE6A595F4073A0B9FF8917396C63F80D5CC7F0C01CF69C0306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f55529b4e8eeee969c1c31df7e14c2a746f8608f57026870a66dde00666433c1
MD5 d504dcfd2a582c7154b1b8d45f0b75b6
SHA1 fadff90f800ea5fd6ee1684da03f5214d29bf35f
SHA512 04286209e8d8f1f23c794d192261e1d1712a6b55edb590f7eed3049d4e8a6088159bd144e74401e15cb975731a4da15449a0c8f28c5933bdbb8e3265c4968e12
SSDEEP 768:dF1j+9smwgv3ybbvO9p3hR0nDVcLCO7w/RW:E9suMuCt/RW
TLSH
T1A5C208F254D7483ADAAE5B57B73E2D078EBCD063B5852A50B7C86A0CCD8A1BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd8bd04c8d0d1e9f21f647a63c0d8f77c55a01de1f2265db176ad47c794a45f1
MD5 0eb6f24fd5f622bc6eefcc260464ed19
SHA1 e4f4515f6b99db5649957881057e930afddd491f
SHA512 918dc91e5306346ef9b79dfc9cbbcb5482458e064512fde0113c5cc9ad34e6a2ed7535b9a943b18a6864ef55f6e0f147b8cb600a2e43b00a0a1d56873f9f1973
SSDEEP 192:JONO6v+YLNQmiUycDZh+CG6Om9oEus1lU6:JONO6vz/ZZh+CXOme6/U6
TLSH
T13B02D935BD281C6B9FF25E49F98737275FA8217BE9952F80D9E82F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f783449db2093495b447590f8ea7d13e82ccd02a50946ac46f766c62e2d85322
MD5 935249d7831dc2cdc0ec8e1882f8144f
SHA1 93d1e8ec439a5de9809ab1e5818d57382bd9d93c
SHA512 cc9dae28818e8b3d45ffef6357dda5997d378cf515912ef79b7568c92269dbc97f4f8a0665dd4f056dd255332c4fd63ba63d302dfe0b9a42566d0b96ef372d82
SSDEEP 384:NtNn/s3n9SSsN5nl3RUzirYIe+CXOmep3Jrm0nDVcl1lIO7w/RwFtn:Nj+9d43ytbvO9p3hm0nDVcLCO7w/RW
TLSH
T16E928D35A8256C7B9AE6A595F5073A4B9FF8917786CA2F80D5CC7F0C02CF79C0306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b84ef51bbc4fa0668ea2a56f80b5d57e9b1ec1fcec587c42959455b648cbeae
MD5 91b124a10e36c8ae80ee757c8f1f2d46
SHA1 58d6b12eb0e24b19a19a133c787c2f99b917f12c
SHA512 801df78703064a2ccf30c75458f9620c0e3c45c8ebc89297afda93254573ad0e2e98fe6c57be74e69cac2dfc67256fe1df06ede0bec8978e908b5cac0d39927e
SSDEEP 192:UON86v+YLKQmiUycD4h+CG6Om9opwSJrHwQCH0bqcU6:UON86vzSb4h+CXOmep3Jrk0nU6
TLSH
T1B2121B36B8685C7B5FE3A595F48736139EA85177EA8A3F80D5DC3E0C02DF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7d84ec3-dc41-43a5-8bb8-cc11c48c2a20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7d84ec3-dc41-43a5-8bb8-cc11c48c2a20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdb5f813d9eb0cd4959236ea2baede717d9a4a1b4c80f39fd4deb21df5f30bdf
MD5 352ba927ba008b43e3858e344c5fd569
SHA1 1a3f919d25a1d44c33375891c0e1648f4db60e96
SHA512 46734fccd996b0971b656480e170463d30ed0aa27d073db59cf6165401655b5f0be2a21218c4deb826f62fd3b81ffdcedc8e7a9dd9a74297d8f2d494f8a4e5aa
TLSH
T1FE411658A6E91108B3B32F1A9BF6A8AD447FB9772F06D45E10110E4F0A23F44C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download