hxxps://drive[.]google[.]com/file/d/13zF7yO3XCscyrtIAjhQ-mA1236sGXavU/view

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/13zF7yO3XCscyrtIAjhQ-mA1236sGXavU/view
Sample260717-pjtgvaex21

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
146	1104	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	drive.google.com
10	drive.google.com
11	drive.google.com
21	drive.google.com
42	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287645485002880"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DC3A715B-83D4-47FA-BDC1-ED91F17962FA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1020	1328	msedge.exe	85
PID 1328 wrote to memory of 1104	1328	msedge.exe	86
PID 1328 wrote to memory of 2428	1328	msedge.exe	87
PID 1328 wrote to memory of 2428	1328	msedge.exe	87
PID 1328 wrote to memory of 2428	1328	msedge.exe	87
PID 1328 wrote to memory of 4556	1328	msedge.exe	89
PID 1328 wrote to memory of 4556	1328	msedge.exe	89
PID 1328 wrote to memory of 1656	1328	msedge.exe	90
PID 1328 wrote to memory of 1656	1328	msedge.exe	90
PID 1328 wrote to memory of 1656	1328	msedge.exe	90
PID 1328 wrote to memory of 692	1328	msedge.exe	91
PID 1328 wrote to memory of 692	1328	msedge.exe	91
PID 1328 wrote to memory of 692	1328	msedge.exe	91
PID 1328 wrote to memory of 3248	1328	msedge.exe	92
PID 1328 wrote to memory of 3248	1328	msedge.exe	92
PID 1328 wrote to memory of 3248	1328	msedge.exe	92
PID 1328 wrote to memory of 2012	1328	msedge.exe	93
PID 1328 wrote to memory of 2012	1328	msedge.exe	93
PID 1328 wrote to memory of 2012	1328	msedge.exe	93
PID 1328 wrote to memory of 4584	1328	msedge.exe	97
PID 1328 wrote to memory of 5100	1328	msedge.exe	98
PID 1328 wrote to memory of 4584	1328	msedge.exe	97
PID 1328 wrote to memory of 5100	1328	msedge.exe	98
PID 1328 wrote to memory of 2816	1328	msedge.exe	100
PID 1328 wrote to memory of 4352	1328	msedge.exe	104
PID 1328 wrote to memory of 4748	1328	msedge.exe	105
PID 1328 wrote to memory of 4112	1328	msedge.exe	106
PID 1328 wrote to memory of 2016	1328	msedge.exe	112
PID 1328 wrote to memory of 2016	1328	msedge.exe	112
PID 1328 wrote to memory of 2016	1328	msedge.exe	112
PID 1328 wrote to memory of 1748	1328	msedge.exe	115
PID 1328 wrote to memory of 1748	1328	msedge.exe	115
PID 1328 wrote to memory of 1748	1328	msedge.exe	115
PID 1328 wrote to memory of 4352	1328	msedge.exe	116
PID 1328 wrote to memory of 1716	1328	msedge.exe	117
PID 1328 wrote to memory of 4352	1328	msedge.exe	116
PID 1328 wrote to memory of 4352	1328	msedge.exe	116
PID 1328 wrote to memory of 1716	1328	msedge.exe	117
PID 1328 wrote to memory of 3304	1328	msedge.exe	118
PID 1328 wrote to memory of 3304	1328	msedge.exe	118
PID 1328 wrote to memory of 4252	1328	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/13zF7yO3XCscyrtIAjhQ-mA1236sGXavU/view
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85a47c188,0x7ff85a47c194,0x7ff85a47c1a0
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,14970407238321895855,3781189162293557893,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,2433142768126434588,15738398913818142701,262144 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,16422553970146281218,13554346580206235017,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12681120207664707447,14135764573955236460,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,13077021169303564108,14023994838923909591,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,18044324291943967776,5266541866345689307,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,18353562107445136727,1081528016879405915,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2003269365141868990,12232275070182901163,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,15670947309985605759,5116372269262554342,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1013576682614483579,14440613437571279709,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1013576682614483579,14440613437571279709,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6915372217855385182,7161167852917120655,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,12014520264559470294,10091438646409312996,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,5260157736095093178,8630805762846144772,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5920,i,2065161059186437609,11219456563731905217,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5912,i,4804014221504917607,7944751779090831285,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3980,i,2633710395328211572,600049893832981037,2097152 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10875633431682936950,18293189215899534667,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,13699116475985496203,18157735612587188850,524288 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,5556402218441710698,5439719791145074581,262144 --field-trial-handle=2264,i,14500868973439881378,5409922982542045750,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4732f91faf1d88cf385978fde616d946436171f92c73ac0d430b08b398083202
MD5 fc3eab6c28f8935be870d7800fceb2a8
SHA1 297ee2f8adadfa7e4a1a45956e002d5a1ecedb4a
SHA512 8cff8d051cb3a4e286090adf64c2429d81dbfc1646ec7d0d4fffaee533cd7d59076d77bcfac66b62b2bed0e3c555dcc81bcdd188dbac7ad1c6b0ffe42ee115f4
TLSH
T1F38161BC020704A6F352573968C3C2D53CF28BE9F52BEEE20110E47B26C57A66178F51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe4c56a5d857cbcfe844023188c16a7c949ecd7060e7559a879a77c77be3ac2c
MD5 a062c741cadd398b989b30605fecaf2b
SHA1 a1e385b83740b566a1d99215550cc09e642233cc
SHA512 1ea1b55531721eddc90a9b70098db3e3dde6c495af0d61f441ccda34b5f754ee8bcbfffa4f002d95a08c543e2c979630d12bb4b3ee4169c02bfd8fe1a3f21211
TLSH
T1EB8150BC010704A6F352973AA4D3C2D53CF28BE9F62BEEE60120E47B26C57A56178F51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d59b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d59b.TMP
Size 3KB
SHA256 5a4e6fbc7e50b14fa6ff728408f54e5b58d2b836d252bfccc4cd6831ad9bddaf
MD5 26dbf986843de442f2811da2e2926284
SHA1 686616f4f5da316c6c3f37145f9b3be9fc504952
SHA512 d25b58ec6b21e0d643762c3b13cee42021d643f2e619d70164c071fd70e2470f2f8a4499cc4b2b70a21aa16fff1c23121fb619612a0536ff3362da26e2c4e49c
TLSH
T1BF7161BC020701A1E356933AA8D3C5DA3CF18BCAF97BEDE61110D4BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 daa14eb64b575ae1e61b79894c5f9455adb2e121ccc8847c46967dd0afa79e69
MD5 cb1192f6839769dd8572ba4981ebcc7e
SHA1 11718e8bfe103df7d35e751ede8adbeb6004f317
SHA512 4f7a7cf9d4d31323bc12555721fd53395933d053e4830e3f0c20607558b78ecb2156d7a149687ac1590c844bba81edd0623d1bdb18f1063f5f97517a9ad429cf
SSDEEP 192:D/TUu3k6ngDEh2n1k/D6D7k+kokRD4DZSqLcqwIbKxzxvxatNLsQ9:DAypggY1YuPZvucVSq4qwIbKxzxvxatr
TLSH
T1FAE17AF7CBD9821DC90566F49B11BF1ECE2D1A1843183C6AC8D8BE5B93E2831E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2064b02022b36df7bbb344896988192078a91f8d96f98f990513a26ce27e1b25
MD5 5818b11b06b05658a1c399d0746ba550
SHA1 233d1754f6c225f863ae4e2cef4ae3e14f0d6689
SHA512 d6a1fc116ce3f58a105ced6f12ffa86e98adff3a2e42b14a2b83a1e3ae019c62623f54f6fd0e02d1929cc5b3b881853421cff5d9078606f8097744f8ef28b508
SSDEEP 192:sxZKRNyM/jK1Ml8MkhE/ffspoiVzqIdp78HW6+WNyrg/YIL+OVIgrJ:sxZKzMhE/ffspdVzjIHb1/B9
TLSH
T12F52EA16AB386977CCDBD209F9557F93D6F5047392910D44AAFCCA0C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 11b0c66d6dde88ad49ca1de16687c04360747b1652566c8fc5588272d9355f4c
MD5 dc4d6b5f40bfa43092eb6a3119e4a9d4
SHA1 a7e417f8eebdac82ed74a1e5c3c866b562c79f8e
SHA512 2dc52d9cc06b0b42604f154c054aa017e01abec66f370bfddd93159b9a6ef633c6f583586a382bea212f501a0204f54942301560708ee88ac813e0feb6f5630f
SSDEEP 192:sxZKRNyM/jK1Ml8UQE9hE/ffsloivDqIdp7/7YHW6+WNye4XYIoZUNZVIg53J:sxZKzqihE/ffsldvDjQHbwX0G3
TLSH
T1B262EA13AA346977CCDBE209F945BF93D6F5147296910D44AAFCCA0C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b3af6691dd9c86fc09a6dd8496b513de024e5ec1beaa019d2f00e7915304e552
MD5 feffc40be79271f4c68be2df8c2c5598
SHA1 da21e1b9da5c77c10c0de6c67b27b9d3a9e5e0e8
SHA512 d234b0ed63ffc650992fbcf4887744f905a4f9c2f0f1fec89c61ac0cf33f0436fcd4d001ac66083fb9e93b22a3b3bdcf7979f9b5d74f2b8fe810e98af3134c42
SSDEEP 192:sxZKRNyM/jK1Ml8M9hE/ffsloivDqIdpp/7YHW6+WNye4XYIuKOVIg53J:sxZKz1hE/ffsldvDjKHbwX83
TLSH
T11852E912AA346977CCDBE209F945BF93D6F5147396910D44AAFCCA0C05E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a607298ecb42bb2e2501c7c3ab2e6adfd4513b6b85ce291864aaaf73b5c3ff58
MD5 a33349b61ca002e5ad7ddae455214845
SHA1 b8cf5885f7e586012336561c21e7b411edaebcad
SHA512 0d726ffb7319712c962ccc3c1a2679ff5fa71def9b2f77efdbbd108d131d7a08fdcf531afade8eb59460e73c2d50f1d965cd1acdae59c8d08b12b23e1d179080
SSDEEP 768:mIsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9xrocTIQ:mIsqxXlWvJD6Tu1ja54LAs9KcJ
TLSH
T1D4D21C3B694CC77D4F840E9DEC266FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e8a7bcfc2b4c1e26fd7b89516c7b0e757151b9eb45f49f1c9bc947636768ee32
MD5 2052ed5b592db813823620eee2ed67ed
SHA1 2c1261fc4440e7a909ac74b32eec22e3fbbc4d7f
SHA512 06c9c8e968010f80f2b533a34160fb9987c261df37398d7138c0657943040a422a48427e89415070dbe66a2b352ba3330f9f2f93950b7c6f9eb2ba9b6413e2ef
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3qZ:ExbPz4h32
TLSH
T1D3E1E546713E061239FE2988B2A685374F423163705CA86F7FB950650A6BE235CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dda55e93-ffce-42fb-85b0-b17859546f02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dda55e93-ffce-42fb-85b0-b17859546f02.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2354cf5f91298c7c8add3c3de9746bf210af037f910919e0ff02a3134cd43526
MD5 a361aea970244bf04fab6e42babbe72e
SHA1 89432fa9fcebb2cf71abe8ef54e719fb8884aed2
SHA512 09e3cda4b43e24e93ebcdc00e9d17635c9a106bcb490ea087f4c698f5e5adfbf85c7fd75e41db5836f66cbcf2d4217d6615a2be1cf364f2379f931c677abdfd9
SSDEEP 192:uULsNqaQYaLJkRbIRQmiU1a9pB4VRNfCk7OmqZZKSR8h5qqTPCR6he1pD:PsNqaDaLUbMApuVRNaEy8h5LlhID
TLSH
T118423B366C746C775DF2A440F84B36139FB4906BAAC92F80D6DD1B0C01DB69C131B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ac88ef0dc5ac61dd15fa72c7a46bf2d9132267d3c395eb65420764028a18d73
MD5 4a9a214899ef792e8c129fa76d5df7c7
SHA1 4d6e58dae79876944b272a385a652fc0dba3f76d
SHA512 b7ce7afdd7671bb58048c6a22854f276e548b26eaedd1bf18a366e1a4723d6af0eed1515ad862364334f68b8a6caf8b09de07d1dd3a5f2d2b335dd6fdf8d3c5d
SSDEEP 192:tONC6JkRtQmiUyR3W+RNfCk7Omth38h52RwU6:tONC6UrWW+RNaET8h5hU6
TLSH
T1E802E9357C386C7B8EF2AD05B48B27175FA4216BBA952F80DAD81B1C01D769C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f50a457d89119b36a1d178cd66dce31ac80418814921994dc87c8daf369681d
MD5 95722c0561f97a4345add6ad07ed6487
SHA1 c85a74969b024d5a60ca43a0084eb57e4a45f23b
SHA512 f134c018ee550f922b15ed71d79fa6419b1126df817673519be0b27077feb231d68896026a8dc714eb4a062837ffe75e051eb9c1375a15bbfc984d3ebed4215d
SSDEEP 384:otNn/s3n9SfsNqXDaLUbMApuVRNaEy8h5LOObjI9G6w7paB:oj+9UzqHaD8h5L29MQB
TLSH
T18D929E326C286D774CA3A850F88B36178FF4906BA7C52F80D2DD6F0C06DB5AC531791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3f95f68eb9931a9ce50a17bad947a27ad4541f210b0b6570b66ef1178e94eac6
MD5 0b5f8cf25148fef66cdf6639260d2fc8
SHA1 2c182a0f12c49d08a174787583feba00a34ccd5d
SHA512 5cad83730eea1059c6030cc71834ae3ce4c1d033c2db268c433b2bbea54a136df370c81a446a070c6aac6ebe882ec56d267872400873a1b828ef4139f9a601ae
SSDEEP 384:wiF1tNn/s3n9SbzsNy8TUNTUlIlXDaLUbMiIIIpP2VRNaEV8h5LOObjI9G6w7paB:LF1j+98fwgtIIIFUHaS8h5L29MQB
TLSH
T1ACC239F258D75936D9AE5B43B77E2D178EBCC06BB6812A40B3C81A0CCD861BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2275a8d30a227242eecd2ae3be5e7669c0216dcc37b99940c2702bbdead2e182
MD5 8c164bd79e0344009ceb3c15c455167c
SHA1 71c1c749cf4730008860111ac488c2e560d2719b
SHA512 a4dbcff2ddfeec839f3e7870a18c84830d3ab0826b83992f9e423955bd29aa9a14a7f78a6b57ef2bc91e449f7ee50b2fe101b87036f71880b90f2770c06bbeb1
SSDEEP 192:TONr6JkRBQmiUyw30+RNfCk7OmqZZKVc8h5qqTPU6:TONr6UfV0+RNaEk8h5LU6
TLSH
T1061209327C786C7B5EE2A841F48732175FA5916BEA896F40D6DC1E0C01DF55C234B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0c220e774b4a3151928b00153e836b2c29697b28ed08220cc5c4c37b3027628
MD5 796ec74f5341806200c54775690ac2b4
SHA1 a7e3bf96e1d411b97568c554a3c84735ab53d64d
SHA512 edfbb2e0fd9d946b9d5be83594588d45697c10854f15ab76cee6405badb07c76d10a5a5eb61625322dedcbc0a574819df029b654280cc9180760c8dd6f583767
TLSH
T16F41365CB6FA1148B3B37F8AABF6A96E487BBC772E06D05D00510E0E0626A40DD71733
MD5 SHA1 SHA512 TLSH

Submit Download