hxxp://www[.]agenziaentrate32532[.]viewf-sso827312[.]cloud/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.agenziaentrate32532.viewf-sso827312.cloud/
Sample260721-psnb7awcpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291109446246200"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6B283058-70B0-47CB-9FD8-2CE3EA646B56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5216	msedge.exe
5216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1804	2592	msedge.exe	84
PID 2592 wrote to memory of 4792	2592	msedge.exe	85
PID 2592 wrote to memory of 4844	2592	msedge.exe	86
PID 2592 wrote to memory of 4844	2592	msedge.exe	86
PID 2592 wrote to memory of 4844	2592	msedge.exe	86
PID 2592 wrote to memory of 3412	2592	msedge.exe	87
PID 2592 wrote to memory of 3412	2592	msedge.exe	87
PID 2592 wrote to memory of 1060	2592	msedge.exe	88
PID 2592 wrote to memory of 1060	2592	msedge.exe	88
PID 2592 wrote to memory of 1060	2592	msedge.exe	88
PID 2592 wrote to memory of 2068	2592	msedge.exe	89
PID 2592 wrote to memory of 2068	2592	msedge.exe	89
PID 2592 wrote to memory of 2068	2592	msedge.exe	89
PID 2592 wrote to memory of 4424	2592	msedge.exe	91
PID 2592 wrote to memory of 4424	2592	msedge.exe	91
PID 2592 wrote to memory of 4424	2592	msedge.exe	91
PID 2592 wrote to memory of 3840	2592	msedge.exe	92
PID 2592 wrote to memory of 3840	2592	msedge.exe	92
PID 2592 wrote to memory of 3840	2592	msedge.exe	92
PID 2592 wrote to memory of 440	2592	msedge.exe	95
PID 2592 wrote to memory of 440	2592	msedge.exe	95
PID 2592 wrote to memory of 440	2592	msedge.exe	95
PID 2592 wrote to memory of 4080	2592	msedge.exe	100
PID 2592 wrote to memory of 4080	2592	msedge.exe	100
PID 2592 wrote to memory of 4080	2592	msedge.exe	100
PID 2592 wrote to memory of 3128	2592	msedge.exe	101
PID 2592 wrote to memory of 1528	2592	msedge.exe	102
PID 2592 wrote to memory of 3128	2592	msedge.exe	101
PID 2592 wrote to memory of 1528	2592	msedge.exe	102
PID 2592 wrote to memory of 4868	2592	msedge.exe	104
PID 2592 wrote to memory of 1760	2592	msedge.exe	107
PID 2592 wrote to memory of 1760	2592	msedge.exe	107
PID 2592 wrote to memory of 1760	2592	msedge.exe	107
PID 2592 wrote to memory of 5624	2592	msedge.exe	120
PID 2592 wrote to memory of 5632	2592	msedge.exe	121
PID 2592 wrote to memory of 5640	2592	msedge.exe	122
PID 2592 wrote to memory of 5836	2592	msedge.exe	124
PID 2592 wrote to memory of 5836	2592	msedge.exe	124
PID 2592 wrote to memory of 5836	2592	msedge.exe	124
PID 2592 wrote to memory of 4228	2592	msedge.exe	126
PID 2592 wrote to memory of 4228	2592	msedge.exe	126
PID 2592 wrote to memory of 5908	2592	msedge.exe	132
PID 2592 wrote to memory of 5908	2592	msedge.exe	132
PID 2592 wrote to memory of 5908	2592	msedge.exe	132
PID 2592 wrote to memory of 5216	2592	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.agenziaentrate32532.viewf-sso827312.cloud/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,16201270199655401811,1239901925516427954,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6475079591050881707,17063215326629255354,262144 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,7822308776211954875,1109154499320119693,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,15731072204376633462,4617266963717946963,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,11272099505665399621,13221663969390337983,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,3898523025758091181,5227546165607036595,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12053581111427285739,16298636228915685095,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,2577560663402480628,15820897360678232077,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3580,i,9815531214403951307,2782800689660168136,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,5653785354788160226,16831143248177075398,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,5303779531798185623,4694902717534317232,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15766098456804854163,18300209102457274388,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15766098456804854163,18300209102457274388,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3748,i,12236816589818693353,4393492753525449007,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,2959629927677665791,2778884603347892318,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,16416913222263369733,360788588143791514,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,3477904947783195583,10590293088880523434,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2112,i,4012472470143762806,7951433796439211476,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,17296587535110836272,17934132040852937277,524288 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=748,i,8539940255636025000,10787983066829099111,2097152 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6360,i,17986978410301286933,6053966939966493597,262144 --field-trial-handle=2412,i,1681771815373346300,3723314560698657561,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0cd87519df404613d42e3c3639ecdb60fafcd37ab36adc240354f6751b5b244
MD5 540c3e7b451aa8162ea9841c720a2dec
SHA1 5df7c83963712a402501ffafe57f3af6d85706e1
SHA512 861733889f3b48270be5aa64269639644323bf43ddb56306e1c61602a1abee923a23096f71ccf1dfebfe87766ed05f1814967363b525aa28cf75b9285cc8e9fd
TLSH
T1A071F755334248B6EFD6013DCDE20AC17AB2B299491B0E6A15709F7E37CC72F0C2048D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b820.TMP
Size 3KB
SHA256 81ef2141e100f7c710703b7d54c2e94ed67c0f7b78d74cf98b9e7eac57801635
MD5 5b42d448975cbdc29d49d5b90727c84b
SHA1 12ce57278aed500d2c00ca0f14cc3665ebe0d103
SHA512 00a748244a8f6f92c84c7b4faf111598321bd71febea67078d764bd5fcfa8a68da012df864c710ef4224102f6c6f2345f7a1e28e25a9da86979b7fe941b557bf
TLSH
T1D471C655334248B5EFD6013DCDE216C57AB1B199495B0E6A15B05B7E77DC72F0D2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3949d07ad16f7c942e7ab09a06ab7ba3ab7a40b3435c4b9c6f55708b7cb91cce
MD5 bc75fc2c3e8f2cd88a71b78b3a3c3871
SHA1 ee333f54b9711ab2997cce291c2511710f8aa3ce
SHA512 4ce59328425d8efde794658c6ba92e316598aa25d5c888d79c21b6d60300104b829bfc4831ff801b4e00a950d99054062a9dec5e54b624bb387db32dd5f1b624
TLSH
T17A115BB7C3D5856E890116F06A24AE2BCE1D0A06831C7C59C9D4EF6793F3465E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4d6b2a7076058c3f7ed22ed6915cd98c6b7653937bf34da60347bac459752c63
MD5 5f244e69a5238e89701aa826f7c05684
SHA1 8be6ba48f78c3f31bf88e9059d473db347bf2244
SHA512 094debe29e689932ea5ade6b8ad9543af5ecb8652633abd224160a5314e00bdf8c08bf4cc835bffb95c5f3f896d653f334ade29184155378b990618d9cb7fac5
SSDEEP 192:sxZLRdyM/jK1Ml8UQSkC/ftsWpcIdpFNHpN6+WNGY4VHdz1Ig5gJ:sxZL9qRC/ftsWpFrHYGbm
TLSH
T18152E916AA345977CCDBD209FA517F53D6F50472D2900E44AAFCCB1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c3dd1ff8be3932e479b883369905fbb8be996cb50d0af52a4c56def0ea4ec077
MD5 d5c8f82d2a334d806c5bb0e0fe89bdd9
SHA1 21e47902d47ccb5c8e7e9147fca57338ccff85cc
SHA512 7e74e8b60e24606f58d2162476ef576cdcfe0d21379b56db2f3012c02100a7ef40b59ab90544d162038dd48042c76d5dbfea83a90ca315b5d70c3ee647eca93b
SSDEEP 192:sxZLRdyM/jK1Ml8MkC/fts23cIdpbNHp96+WNGY4w4z1IgrJ:sxZL9MC/fts23FpHoG99
TLSH
T14442D716AA345977CCDBD209FA557F53D6F90472E2940D48AAFCCA1C05E6AEC230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dd85bd607ffa9c747d2026313b94f95b07f6da3133501ced816efa192164c921
MD5 82a2bae84620db9d8f9ecdb25352be5c
SHA1 aadbafd1ecdb53a23787f3d62ba9e303def69f0b
SHA512 09d89f0162b3b7f96451fd13a5332bda95bd7990de30095afb3e8074ba2329b4f96cad7564ead84ba492245eb6d446a1f113e9e49b9bfa8b86edaa49035490bb
SSDEEP 768:DT8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdIro/k3UnU:DT8iJPNWvx76ru1jahALocdzoUU
TLSH
T1E9D20B3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5957da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5957da.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bea94b433d3e4712f97a30f9226647b01a455768ab3ee47603a73d6e2604971a
MD5 a5e31e71aa24be04db4d2dea74961bf1
SHA1 ad52deba08c0465ea17e008a19cb4e9866cd934d
SHA512 993d20b46b7c94d030f01ed4737ef8cc09147fbf1068e269e17d22246be36cba10f84374a907873301663a40cda9a30cdd349dc688c923cf6e01cfbe289a1990
SSDEEP 384:kHtNn/s3n9SfsNnzuMnJmnkM8YyEXWfmDVcl1lIO7w/sCaYT:kHj+9U0csMYmDVcLCO7w/X
TLSH
T128927D35A8796C3B99E2A695F117361B5EF4C027DBC93F94D5DC6F1C01CE29C030692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 44e0fa07d6c2474b6e421cb81334aaac30db645f8da8c6f90ae233ad3b89a2df
MD5 54f352975ef1f9f65efaaf5b243bda01
SHA1 dc9c2c4a0166ad21cec9c63e4ebeefd41cd02e9a
SHA512 45dc47aa79441e684a9ab7d3fc70398cacb2247a79697f90da5a04e86b70da27c68a31bde3154113c9eb65b80d7d82a48f525462264974d61e7a953167dc909d
SSDEEP 384:I2iF1tNn/s3n9S0zsN58TUNTUlIluuMnJmnkM8YyEXWGmDVcl1lIO7w/sCaYT:IdF1j+9rQwgkcsMLmDVcLCO7w/X
TLSH
T1BDA26C3798A49D3BEDA69A85F51636179EF48027CAC57F90E6DC6F1C01CF28C0306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b6e982299f2acdd1c1877c1bc3ff3971b3721b34f109b17fd50ce6c026021e92
MD5 14d1d15e9aaa1f7facfd09ef86ba4864
SHA1 565039bddbe6901a01ea137e8834e81971816606
SHA512 a01abad17871c4b1f6cad32869bf07b65d78e5d073623f9f9d3028de39cb5a23dd417a8aad2d0c8743db08fef3701b39d676443bc927e849c30a6c40a3777d9c
SSDEEP 384:AHtNn/s3n9SfsNnuuMnJmnkM8YyEXWfmDVcl1lIO7w/sCaYT:AHj+9UvcsMYmDVcLCO7w/X
TLSH
T15F928D35A8796C3B99E2A695F117361B6EF4C027DBC93F94D5EC6F1C01CE29C030692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 29d65022d26df7752c85d6147feda84405956dc5131597bfcef95e24e4d4e1f3
MD5 cf014911fad55bb92890e176e42fb095
SHA1 7137f300e1f2a40559c6482ea8e91d7ce1e622cf
SHA512 ccc4b457caf87847219fdad3eda2afa241f959a7cc794baae486c1bd1af4d0ee831c1b35bea71168a9b3b4e86b46980b7021536635bf24e55ded6e6ebcc2667a
SSDEEP 192:JJONK6k1QmiUyM/V903tjzorYbraEXH6FWcRnqFU6:bONK6yPV9M8YyEXWjmU6
TLSH
T11F122B36A8786C7B5DE3A955B44732235EA5411BEBC93F90DAEC2B1C04DF65C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a93d41653adc4fff43b404231c3a134ee34aa6d96903aaf7e2544e9c36ca34ad
MD5 4c4ef63ca8245bdff3040bf9be156f66
SHA1 beb89481fb816a255839fda82c3633bb3e0c827a
SHA512 0c4b1549064f7f2a04eb7f6a625d2a102c75eae205dee92280478c663d4fa4fc92f845be4bac76ee2988b9e2f3a590cbcfa35777a94600f1077e2bc0b9595d49
SSDEEP 192:gONS6kDfQmiUyf/Z903tjzorYbracQi+zU6:gONS6ghCZ9M8YyKAU6
TLSH
T13002D93568782C7B8EE3AE4AB54A27275FE4112BEA953F84DAE81B1C00D765C1306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8db09908-1cb5-47a5-8d70-990fe11bab17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8db09908-1cb5-47a5-8d70-990fe11bab17.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e8566c48b3a010d4308a85c4423421ba2096191f22b5b91d95cfb69cd4ecc77e
MD5 cd2c0e0eac8c93fb0c5c85f649394644
SHA1 575b854ec3205f8dd97c24e650e39b87f5231672
SHA512 80908911c25a9957641b8f26c5fb4ad66a482e7784cabfb5f8b8acc408b915d74c489fc41e63928fe7c5226e39dc8076b463fb29edf62d2d00b4ffde44e06c91
TLSH
T17541E668A6E90109F3B76F56AFF6B86D487F7D372E0A949E10110D4E4673A01C971733
MD5 SHA1 SHA512 TLSH

Submit Download