hxxp://teloslmpact[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://teloslmpact.com
Sample260713-sxpbtsdv21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284302349677060"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{ECBF10BA-4D38-4682-B164-6F391971FB57}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6BDD976D-F30B-4FB0-A21C-C17321F607D1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4500	4116	msedge.exe	84
PID 4116 wrote to memory of 1568	4116	msedge.exe	85
PID 4116 wrote to memory of 2000	4116	msedge.exe	86
PID 4116 wrote to memory of 2000	4116	msedge.exe	86
PID 4116 wrote to memory of 2000	4116	msedge.exe	86
PID 4116 wrote to memory of 1704	4116	msedge.exe	87
PID 4116 wrote to memory of 1704	4116	msedge.exe	87
PID 4116 wrote to memory of 3772	4116	msedge.exe	89
PID 4116 wrote to memory of 3772	4116	msedge.exe	89
PID 4116 wrote to memory of 3772	4116	msedge.exe	89
PID 4116 wrote to memory of 64	4116	msedge.exe	90
PID 4116 wrote to memory of 64	4116	msedge.exe	90
PID 4116 wrote to memory of 64	4116	msedge.exe	90
PID 4116 wrote to memory of 2856	4116	msedge.exe	91
PID 4116 wrote to memory of 2540	4116	msedge.exe	92
PID 4116 wrote to memory of 2856	4116	msedge.exe	91
PID 4116 wrote to memory of 2856	4116	msedge.exe	91
PID 4116 wrote to memory of 2540	4116	msedge.exe	92
PID 4116 wrote to memory of 2540	4116	msedge.exe	92
PID 4116 wrote to memory of 2324	4116	msedge.exe	95
PID 4116 wrote to memory of 2324	4116	msedge.exe	95
PID 4116 wrote to memory of 2324	4116	msedge.exe	95
PID 4116 wrote to memory of 3608	4116	msedge.exe	98
PID 4116 wrote to memory of 4520	4116	msedge.exe	99
PID 4116 wrote to memory of 3608	4116	msedge.exe	98
PID 4116 wrote to memory of 1756	4116	msedge.exe	100
PID 4116 wrote to memory of 928	4116	msedge.exe	101
PID 4116 wrote to memory of 1756	4116	msedge.exe	100
PID 4116 wrote to memory of 928	4116	msedge.exe	101
PID 4116 wrote to memory of 1824	4116	msedge.exe	103
PID 4116 wrote to memory of 4436	4116	msedge.exe	104
PID 4116 wrote to memory of 4436	4116	msedge.exe	104
PID 4116 wrote to memory of 4436	4116	msedge.exe	104
PID 4116 wrote to memory of 4368	4116	msedge.exe	105
PID 4116 wrote to memory of 4368	4116	msedge.exe	105
PID 4116 wrote to memory of 4368	4116	msedge.exe	105
PID 4116 wrote to memory of 1068	4116	msedge.exe	114
PID 4116 wrote to memory of 3760	4116	msedge.exe	115
PID 4116 wrote to memory of 2840	4116	msedge.exe	116
PID 4116 wrote to memory of 4568	4116	msedge.exe	118
PID 4116 wrote to memory of 4568	4116	msedge.exe	118
PID 4116 wrote to memory of 3664	4116	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://teloslmpact.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe5ca9c188,0x7ffe5ca9c194,0x7ffe5ca9c1a0
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,8343255207049722621,2153761087462939159,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,10951613030408887620,10852507338773891238,262144 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,12306753052679663094,6224543151038567843,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,11747503881165541148,6820175492511316534,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1147764945903315707,1704081451156474956,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,9535603584912303431,13302800915321441707,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12589662468510771216,7048925963144055058,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,13015349452974972782,4453775656727630009,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4402106405235581823,13065668174712133818,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,818681541089365947,92363781339081925,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,12149684352644566339,4958411229684728044,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,7203540392704676808,14350300014559341618,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,4891413385674643207,11205797658962547893,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,4891413385674643207,11205797658962547893,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6468,i,3322342600505325015,18113447917598521502,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6768,i,6306527699143806412,11240453365123212896,2097152 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,15558203614260551407,16040786789043816133,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,6216086662619988824,14563591149767669908,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,11250050453908894063,7283985016263206293,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,15727381116965424445,2592956667401461422,524288 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,10960041806262666049,54361592407981110,262144 --field-trial-handle=2184,i,16944005349288740683,5509954127291277891,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 345041bb5350da94fbf2d207ddf3e29eb461948aa7470661f626822e3ef9cf40
MD5 b7731fd9467bf55c8f260d22fb760abf
SHA1 2dc52a05e56076efe5472925afb0dc628c882db1
SHA512 3e7cb0909961ffcc70c0cdebba798321dca2dd27d4ccea0dbd3976c00a04b1528444acde8cbe5d8f66cf4d07d5448eda74f8c261b81d92f4ea82a20c570c5d90
TLSH
T1607107789E1708A5D353A0B375D252C032318AF7F426EAB1C16D68B0260B76BEF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587e82.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587e82.TMP
Size 3KB
SHA256 435178d4abf21f2212e99497fe8328d3ff676fa9e0ea0fc33d6583d2c585081b
MD5 52e48a741eaba15d250667cef1393684
SHA1 18deb7cf22da89f127f353466fb662c2bee5e9e2
SHA512 a1363d43d5bbf3145d7def5389c3a8cce7d08b46f17d0223758e709680b01ef8ca09a58c330746aa5b0d11a1fa79564a378d464811d690cbf1cba17c90a57dbb
TLSH
T14871E8785E4708A5D713A0B379D252C032318AF7F426EAB1C16D58B0660776BEF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 947e5f03e6ce429ba405f587cf0284bdd2191723bb91e24a119f259f1445b11e
MD5 a42895e44fc8b7b47bd4285f808be720
SHA1 414c7c7d948c43c12769ce3bf334cbb253d61a12
SHA512 fa747d3390b65631e325c30e309cfd0dc74e9a56960c482d92c210803da3a6bbcdcebc0370e7ae7640d6b1d11f54e6e3373302397037162507465904f3c214ea
SSDEEP 96:DCOm78bAzBS+N2wBj6VP5YwHciaRDBWZnkra:DBm78bA1S+Mkj6VP5YwHciaRFWZnkra
TLSH
T122A1DEF787B4862D894255F0D618BE2FCE2E1558436C3D5ACAF8AE4783E2571D082B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c19cf438b502b08eef63c59db0e71b5d7d226ebfd93c297e0e1f0aef94ee2ed
MD5 c6167a583ad474404c4eac842ee7f199
SHA1 1272913a5e159a03d5f50b9b2677d2f7b8a14473
SHA512 d1197ed7c9a0757abfe6f7b1a746232f1891de37c596fa132c0b90d0776440bdfacac9e9b3324b60f3bf93bf7bbd4b811e84a880072463e99482ab7833fb780e
SSDEEP 192:sxZIRRyM/jK1Ml8Mkm/fYsI91IdpmRuHW6+WNVpbU/YIbrBcIgrJ:sxZIzMm/fYsI9GRHbA/89
TLSH
T1AF52E812AB345977CCDBD209F945BB93D2F5157292900D58AAFCDA0C04E6BED2207D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a2895f696fc9326e774d094f0e5a8fef135fb8badf50a54d80b83150aaae0dc6
MD5 2baf167cd4a3df4295c4817d07b66661
SHA1 0ce2df883d32594175ee6078e1140263c2a895d5
SHA512 c9258225db164f833c4fc6d7a1ed106020a98f0ff257ea37ea68454454aeb73f461dd2db201a56621baeb60b267d2088910378e3aa0d24f328bd70341fd09d57
SSDEEP 192:sxZIRRyM/jK1Ml8UQakm/fYsciF1IdpgRuHW6+WNVpbU/YIfmgcIg5GJ:sxZIzqpm/fYsciFGTHbA/SU
TLSH
T1B052E722AA345977CCDBD209F945BB93D2F4157292910E48AAFCCF0C04E6BED220791F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7593396088b3195100c0ab1ad69771b1a6bbe0d42c03606c790cb6239bb10e98
MD5 85c7ea0554e77f5f69d65459841606bc
SHA1 6df8a82f3dd7bd374c4a458623cca1a9c9a319bc
SHA512 6cf0af7f28ea421bae6337ff3163f665b2177fd5e79c70d3a9b858b6e378f66aa6fccdb793ddfeb0bda2e18498db22a4407da3fb0aa76ef5f96bdef2a14e29bc
SSDEEP 768:+IsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9TrontUIH:+IsqxXlWvJD0Tu1ja54LAs9gntU+
TLSH
T187E21B3B694CC77E4F840E6DEC26AED76ED801CB67988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2b05c58a8edaff35d610ecd620ec7c977ef878aab5cca9fcbb1996c771356b1e
MD5 919ebebb81d77748f46ebba5affbcedd
SHA1 1452757ab6e70b679c99194d813cf9e60eb2f25e
SHA512 12f56f187e7e96c5c34b4a826ed7d59d7c9a8267b2007810af576f710ebd01891fd09a25478b3d63e1dceedfb740c68664d060c802ec4eb97e86d021437878dd
SSDEEP 96:KYbaKYIKSogKteiCQQKp2SAgKdG6Wh2KKgwiXuykoP:Exb7j+rtG
TLSH
T1CAE12746713B220338BD2948A76696769E4231A33418B86F7FB841725E77E224DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5906cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5906cc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 aa93be81ffc5857f0f5f0b8de4af1e5dae51342e1fa40483ac296b730a9ab036
MD5 a0260ff04cecacc88737f0a32de3e34c
SHA1 041c99db835621a798d3be36293f1831bcd1d3f8
SHA512 26d8178faaffe00a17f1d02ed89339dc9e90157b9706ee3b92f4ba8333ad0049453d525b9aba9b690b459e35f6a5c1f0c27e6c9d71f5d0cbd3c83b6d20e9e7cc
SSDEEP 384:0tNn/s3n9SfsNxJvDhbCIdVRN+Oi+p9gQOObjI9G6w74:0j+9UgDH+Ois9gQ29M4
TLSH
T1A4929D32AC384D778AA35555F44B365B8FF8507B93852F88D0DCAF0C05EB6AC5306A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2879507c757c7effcbd236301abae0f836d18b8fd18c1f8c3aaabe2323528a6c
MD5 a12eb42b2d755fdfae96c9415fab3c83
SHA1 d74391e4920f10330cca8d4acb873df7a6a0a5e9
SHA512 f5ae6fe7f7533d77f95ad2246c10b30f36cf4dff7286e56928cf061940a73df75cf7fc324b8b235bdc0f5f51edf97d65771a477a89e0e5626939c628f6401e0d
SSDEEP 384:gxiF1tNn/s3n9SzzsND8TUNTUlIlcvDhbCudVRN+Oi+p9vQOObjI9G6w74:lF1j+98uwgsDH+Ois9vQ29M4
TLSH
T1B4C239F258D7493BD9AE4B47B73E2D178EBCC067B5812A94B3C85A0CCC961BFC205911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f15f9fa0373a23907471288446baf36abae2b8495dbb44227da0aeee0c7d8ed9
MD5 86360042d30499bb9810cd6c0c0a556c
SHA1 3bf4c2d44d2cd38efa97bb4725f6967e9e75b37b
SHA512 1a6cefb22be486841030db60b4533cdffaa672e2dcacb09a16ae6f3bdfb095062b15297ea59a94a2b087d602d0447b336ad83da4af700d234886ace826e65702
SSDEEP 384:IOtNn/s3n9SfsNxcvDhbCIdVRN+Oi+p9gQOObjI9G6w74:tj+9UNDH+Ois9gQ29M4
TLSH
T12692AD32B8384D774AA35555F54B365B8FF8507B93852F88D0DCAF0C05EB6AC5302A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77c094f51a2fbe8f64bad47eef9220cad0bf4433f1328c6d457ac884b8c4fe96
MD5 d8d9616b95db10579832a090cc780ef7
SHA1 58f98f67424f2ee5f6ef5aa02e3ec12f0e1b799c
SHA512 e4d1f2e2c42db9fbac71ee0e8d367648c24844c92a55cb59bf471955a3932b40ba608cfee1692eade2dd04340e1808a100d60178ba78f3c32227b1f5a8086b5e
SSDEEP 192:tONd6JkRtQmiUy4bW+RN+OmJ+Nh3aRCU6:tONd6Ur/W+RN+Oi+3jU6
TLSH
T1C902C835AD381C7B9EF26E49B48B27175FA8203BFA856F94D6E81F0C01D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 596f8ed2ef42d0d1f8b4b941c1d7628de669122bf08597ccf2ecc0bd9e04303f
MD5 38d97b040cc4099f051f96e80cd04f65
SHA1 6f1c34a5b5a2074fe73d244992f04202fb654a15
SHA512 1089dfe7b46f09387451023f61f09f9860231d0dd0154557469eaf248ed863076563617ca849b52d1f46bffbc9c7e6e4bb102ab1deddde94355be393846e945e
SSDEEP 192:fONs6JkRgQmiUyMIb/+RN+OmJ+KG9qAVcPqRtU6:fONs6UgW/+RN+Oi+p9aQU6
TLSH
T143121A36A8385C7B5EE36545F48731575EA4513BEB8A6F90D1DC1F0C01EFA9C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2227ca7-a6a9-4952-aaa6-dab4a3bf4468.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c2227ca7-a6a9-4952-aaa6-dab4a3bf4468.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fe8914cd14ec89d7c2613da9c2917770cef9481771c568090eb22049191205b8
MD5 ab9ec9ac2438e817cfe55334a32e54c8
SHA1 68eed76fc1727014bbd676f9a4f51e8a26971687
SHA512 be0119e24cb194054364ea3ed080ca92ad9480c38c15fcad66a8aba6a581c3f2e491186d3ba082531d4d660393dbdd04482599f0e9d5f89c417e8e2ee4c7c6f4
TLSH
T180412A5DB7E91108B3B76F5AAFF6A8AE447B78772E0A945D00110E4F0A23A01C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download