c6ca58824efffcec8e61bb873c11914d49fc5caf77560e4de82d594e0fdd46a3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/about.html
Size 49KB
Sample260724-pl8dsaej8y
SHA256 c6ca58824efffcec8e61bb873c11914d49fc5caf77560e4de82d594e0fdd46a3
MD5 bf7e5782790c41c69e8d27c77e312d25
SHA1 7a78ea33bfc2216ecd2a494dec1001150c307139
SHA512 337e1fd4337ccee78f0b569cad0c3e0a79161e8f3e41a76a5c38ede5dbd4029c4fa4ebbe7800c542aa0459cee56b7814420a80dbe876cc2762ff0f132a515fd4
SSDEEP 768:3g8pdKM8Bh76hXLwG88NmmRb4bYb6mh2ETlLd+RAEAnkDXPoWwvTbpBAEA9EDXPQ:20MsXN/JuT
TLSH
T1C1333276A8C0542302B381D6A37467ADEEC2428BDF87994831FC97875FBBC63D957068
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3020	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293699377823350"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EE2AD076-C0F8-4A98-A909-AA0A888CD814}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2036	2724	msedge.exe	86
PID 2724 wrote to memory of 4832	2724	msedge.exe	87
PID 2724 wrote to memory of 3020	2724	msedge.exe	88
PID 2724 wrote to memory of 4832	2724	msedge.exe	87
PID 2724 wrote to memory of 4832	2724	msedge.exe	87
PID 2724 wrote to memory of 1972	2724	msedge.exe	89
PID 2724 wrote to memory of 1972	2724	msedge.exe	89
PID 2724 wrote to memory of 3968	2724	msedge.exe	91
PID 2724 wrote to memory of 3968	2724	msedge.exe	91
PID 2724 wrote to memory of 3968	2724	msedge.exe	91
PID 2724 wrote to memory of 2644	2724	msedge.exe	92
PID 2724 wrote to memory of 2644	2724	msedge.exe	92
PID 2724 wrote to memory of 2644	2724	msedge.exe	92
PID 2724 wrote to memory of 4020	2724	msedge.exe	93
PID 2724 wrote to memory of 4020	2724	msedge.exe	93
PID 2724 wrote to memory of 4172	2724	msedge.exe	94
PID 2724 wrote to memory of 4020	2724	msedge.exe	93
PID 2724 wrote to memory of 4172	2724	msedge.exe	94
PID 2724 wrote to memory of 4172	2724	msedge.exe	94
PID 2724 wrote to memory of 1720	2724	msedge.exe	98
PID 2724 wrote to memory of 1720	2724	msedge.exe	98
PID 2724 wrote to memory of 1720	2724	msedge.exe	98
PID 2724 wrote to memory of 3388	2724	msedge.exe	99
PID 2724 wrote to memory of 3388	2724	msedge.exe	99
PID 2724 wrote to memory of 3388	2724	msedge.exe	99
PID 2724 wrote to memory of 4328	2724	msedge.exe	101
PID 2724 wrote to memory of 4328	2724	msedge.exe	101
PID 2724 wrote to memory of 3324	2724	msedge.exe	100
PID 2724 wrote to memory of 3324	2724	msedge.exe	100
PID 2724 wrote to memory of 2084	2724	msedge.exe	103
PID 2724 wrote to memory of 4416	2724	msedge.exe	115
PID 2724 wrote to memory of 2508	2724	msedge.exe	116
PID 2724 wrote to memory of 3440	2724	msedge.exe	117
PID 2724 wrote to memory of 3500	2724	msedge.exe	118
PID 2724 wrote to memory of 3500	2724	msedge.exe	118
PID 2724 wrote to memory of 1232	2724	msedge.exe	122
PID 2724 wrote to memory of 1232	2724	msedge.exe	122
PID 2724 wrote to memory of 1256	2724	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\about.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffaa95ac188,0x7ffaa95ac194,0x7ffaa95ac1a0
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,542290426749858392,17661263419161353892,262144 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12958987395348275662,11230506471917574324,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,6129107946580579491,14241184975880393918,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,11474271969569488952,13590088985366330838,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,10166313187040415810,18357785531969346023,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4548873329101337845,12390785806574643568,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5311003194837628026,5652243676203087688,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3524,i,9391157127821586038,921564825784267874,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,10616157752837161471,11155747352704030235,2097152 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,588292453067838104,10285194964593902109,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,6352314597508766133,13588087531312353646,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13654050162619555391,15037806025437268648,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13654050162619555391,15037806025437268648,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,7132015020772009973,541226893320009945,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,5497175828627936833,17091908478045930422,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,5237840541100197917,3042632488247236560,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,15957574830129607504,7705204612411479602,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,17041041927911959238,12086618285640753780,524288 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,11217724454087769333,16286411357476618895,262144 --field-trial-handle=2212,i,3218158778568327112,7092385947384452244,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

2fd506dd-2e3a-40df-8ee0-cec53cd87d60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fd506dd-2e3a-40df-8ee0-cec53cd87d60.tmp
Size 10KB
SHA256 4eb19dbc448a20ae7f31be96de9e0fb05f9f62466331a12493f4a0235f7f0a69
MD5 d888b04793570f06d94ce093242a081e
SHA1 1471c949a8b851addc2fa1e35c32b0aa30e42e47
SHA512 9ab9bfff414c77a8ccf6b95cb671b979ef985b02b33f03626e667ee42265b64092711cebf9d81b1fafc357fc6ecb5b4a7f122cb8770434c179239970ef5428a5
SSDEEP 192:sxZRR5k6/fMsSRwDIdpdhHW6+WNGYzQTq+TIgrJ:sxZRA6/fMsSRHrHbGSg9
TLSH
T10422B7166E28A97B8CCBD21DFB15BF53E6F9507291951E48E6FC860C04E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4815e3e372fdf216f104bea0bcb33c5d81c89a91eda5e7b5ebb3c3968ae41cc0
MD5 2792b7db7a2678df0d8c0ba7a657818c
SHA1 c430dd8566997d91847101d8cbc753a0943fe694
SHA512 0a0ee9d53208ab6db8badf597d825431141c23b755ee770d5290961f28f1bac4458c7328af0858095c26e3b185e319516eb24266f27323639aadc3e9b2ba1489
TLSH
T1BE619138C78309A1D7A174B290FD0F24787687E8FAF32D85D8A829346F1B351C3682C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591524.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591524.TMP
Size 3KB
SHA256 2d6aa7a9c26dce6e023c871a269064ba65b3ea2486975943db0d700159e333c9
MD5 3e58e0d86c57c490f45250d4804a0570
SHA1 08c9118b67551136d6cd4825541f05f3ca71c688
SHA512 1e3a864f07b37921dbd2a7e80b827d45a9546e96126aaa80409f6167d26d17470975d8db6931ceb53e72ae97d0bd7971fe309ada817504f3a8327d9d84c627ac
TLSH
T14D618138C78309A5D76174B294FD0F24797687E8FAF32D85D8A829346F1B751C3682D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 54aec3414f378da098b1d4e855569515d483494f97159262c2ef44857b54f098
MD5 e19d88d6281e8fc4d7f81b36c092d42d
SHA1 b5c2af6d8fd6d593bdcc4be52b9970a3a1966239
SHA512 909a7050fa2d60f26091570553f4efb90baa729d359dfb8a237e025d0eb868df2ce9fc3c1831d5a308244e63b603a343b08dacb862734c30584225bf6f7f4ed8
TLSH
T1E8519CB7C2D887AE881152F06B247E2ACD1D165A82283C668DF5FF5F63F14B0D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2e124603ecb58373df72e55c4e41c830609f5025aa983334379440fd08bc5d21
MD5 13528cdcad3ad2a26d5be76e19425b84
SHA1 92019354fc7d48656b532866074e418e07e2e579
SHA512 218812cd92f20eaad9a92a86736efd3df4d5ba1b30c49baebdf964ba56defa9631e7c68ccda25de4c9d23033b82a63a7ffcbfd97a2cdd8e84421497824859732
SSDEEP 192:sxZRR5k6/fMs4H1wDIdpdhHW6+WNGYzshq+TIg5fJ:sxZRA6/fMs4H1HrHbGgg7
TLSH
T14B22C6166E28997B8CCBD21DFB15BF43E6F9507291951E48A6FC860C05E7ACD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 78dfca3c03fb12f66f0a2c1640191a498317cf04d85eaefcc2160478331047e2
MD5 30ce4137c8f12647af33eb2dfbdcfbcd
SHA1 bb4dd6c348fb092d3280f7307c87d026aab1fd22
SHA512 c3d15762eb2fccc3f921aec6e3bf7046c754e47ce8be9ae4a232e34829f48d15f6bd7b8d9be2ba3c715abeaf749628616fec8fb5b2d4cb8f852dbfc1decd6794
SSDEEP 192:sxZRR5k6/fMs4HRwDIdpdhHW6+WNGYzQTq+TIg51J:sxZRA6/fMs4HRHrHbGSgV
TLSH
T1F522B6166E28A97B8CCBD21DFB15BF53E6F95072D1941E48A6FC860C05E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a31ff15b9aa7ef59d55bfa7122fecbaa1420a64f8d526fe65e6c565a112151f7
MD5 216f7f807f54257f1ba40cfe7438c728
SHA1 e3bc317a56c60a7be4f7f3625eb8ece8cab7d662
SHA512 179488ba24acefa3180cf85367ec8008628066a538d835ba98c6cf8596ca39cffe1108e564b2a590c1df3835ea8b0e3a976f7b29ae90b98db581b4f5cef308d8
SSDEEP 768:xtk7u70Wvqica8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBsroyAMY1:xtk7u70Wvqicau1jai5LA3B3bZ1
TLSH
T19CC2E93B740CCB7E4F801E9DAD566F973E9802C7A6948D4087FA994C02C77EA61264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bf224e926429a93e4e61975c651cd9fd21e09f398746759e2d16225640c42523
MD5 8dbab718b783fd26162dbc037f3da1a6
SHA1 f39a88070fffb316ca443d398f63fa8983ecbfb9
SHA512 2fbeca5019f4f5b36d31bde5cdc093ba3577db8ff7f9950740a6f5bc639d18d8d4362f7d14bb4b864de58c6d09a28d702e2d680f72fc7398179d2f21d4c99efb
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTTIIjK1Kc7y5CI/KT60brIBK4g:KIbCKcTIwK1K6aCgKT6krKK4g
TLSH
T10E918906313A0E55387E294DB29796365F4276633018B56F3FB840A11E6BE224EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

f3e9bff7-9904-410d-a685-92cdd035a7d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f3e9bff7-9904-410d-a685-92cdd035a7d8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d8d5606a7a0b228be2c7df2263a2c3286189fd20783232cc6ed9a5e05859b80b
MD5 1284f6d23dbea8288b9c9de21711f389
SHA1 a2bc7a99c235f48c5616e70347c7a2dd42210efa
SHA512 2f1682958a13d65fc218d2c51868ce9d5ba58dcf1a42e3ac37de2a2dcb6d925e13b66aa55afe20e44760a8c0001f17a163149e75fa1b580209b92f8851270ec7
SSDEEP 384:dZcIhsNuUKtL3bI7r4Mdtp5CEJrFUOObjI9G6w7fW:FhFL38rtphFU29MfW
TLSH
T155928E329C385D769966E511F4863A139FF89177E7C82F44F1EDFB0C05A6AAC131780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 75a0c08a982339ccac9c9d00d10bbbbc1fe125d334c918d20595af4d4de0b2fc
MD5 7290e38486c85ec86d9604bbbffe62c2
SHA1 1d41f9fd153a900139ff3905eb0c2c19c63f7ffb
SHA512 4315c829058b54cf67141367c951e2e11678a35e0fcf5636e31996532f0864796fd23f65a0ec679f0f378b492e66e697bb8c65015e51d918ad3fe2554a18fcda
SSDEEP 384:GZcIhsNuU7tL3bI7r4Mdtp5CEJrFUOObjI9G6w7fW:UhuL38rtphFU29MfW
TLSH
T1F5928D329C385D769966E511F4863A139FF89077E7C81F44F2EDFB0D05A6AAC131780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 fc9c5ae0687a3a7d56f5e2d91421d3b48362f1afd123e88d062812b2ad53556d
MD5 089bfcd697ea82672d3e3a27755e5365
SHA1 9bc9587933141150136c168a610b29a260aead6f
SHA512 015db538d345f7fe16187274eba1f4146bc5f258268b74b328f1120dad495db6b211aaf68793d65d00184af37bb148407462b8e1bc59b750fabbebc3ab4cae4c
SSDEEP 384:+iFiZcI4zsNz8TUNTUlIl7tL3bI7r4Mdtp5CEJrCUOObjI9G6w7fW:VFQEiwgjL38rtphCU29MfW
TLSH
T107A27D335C64897BAE6A9A11F98A36139FF440B7D7D8AA50F3DDAB0C01A75AC1317C09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c41bbc1295ac3043138e28531269be5fc703af03c63f246f9a4fe39ad2fc0eac
MD5 a642f8279ef7564471d984a14c7da59e
SHA1 cc1c4187ba429ba5879b62e1cefaebc38ffc7d15
SHA512 9747dce2d17e9595e550a833fdab497da5419b64175716e426fc654504cbee70ca5efd0fffd0228c8f300163c985f59189539309f6a6c23b6213a09d0eb8b526
SSDEEP 192:MONY64BAQmiUyz81zDW5GBPKK7+FdG29poaD/UxU6:MONY6eAvJWLdtpROU6
TLSH
T14A021A396C796C7B9EB2AE45F58637175FE8107BE6805B44EAE85B0C01E775C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59e8b262c0dedfbba2c4e28a123b3990d3463811c4a2d73d96fa1e5cc669d736
MD5 7c538a617939019bd4b4afc16aea78ef
SHA1 aeb39efd17cf9dc320ecc4a9342f549a0b905354
SHA512 566c403591dc92a6707739f0ac9a50a7bb9d5e200a3e52dea33eabc967e3258793465dc732f9a18d1296ff10731e31e1822337ad5455f4cb0895da947a2332cd
SSDEEP 192:8ONk64BXQmiUyzlzDU5GBPKK7+FdG29p9hFC1SJr7WwQqCU6:8ONk6e5aULdtp5CEJrHUU6
TLSH
T17E121936ACB86C3B5DA2B541F48736035EE84177EB896F50F2EC6B1C01EB79C2316806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ba8f058756ce04c3d4028054ccc7d27dc87d998ad108860d7ae6711d766494c
MD5 4d763b57bbfc841dbc1527d61aac58c5
SHA1 2ce5a178185e8cad8425bbd812e8998ae2f07840
SHA512 e187776c93cccfa3d8b24003accf7d7bc353a5f44e36d08254d575cefe5d65a9b5355c69b7a5a86793616378f5148ee4227909c15e4e6585f035b11873a3219d
TLSH
T153414A5CB6F91148B3B3AE0AABF6A86D443BBD772E16D45E00010D4F0672B41D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download