17dfdbf87bf37232f2ec5058dc2b3762f7a5b3ad883ceb548911e83aeff508e1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/emergency-care.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 17dfdbf87bf37232f2ec5058dc2b3762f7a5b3ad883ceb548911e83aeff508e1
MD5 faff2b16a15a82e59de5c8cf2952b307
SHA1 60128e2c0fd0485073b74f87f47c4da53237ceca
SHA512 771f87df7b20234260674bc2b55f22457d1d64179cf2e6775d76cfb5489dff9326d7772e2e7ee88dc98046305272980fb9b0f10e1183911c4137ebf30da26977
SSDEEP 768:3o4yt2KMvQhSEOcZzXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8DP:gCfb
TLSH
T143137522A8D09023017386ED83F56A9CEBC681839F97590437FD1B839FF7D6AD98B445
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3184	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293697789210990"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{D0565C41-87A3-43FD-B291-80FB9F9BD8FD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3708	1104	msedge.exe	86
PID 1104 wrote to memory of 2864	1104	msedge.exe	88
PID 1104 wrote to memory of 3184	1104	msedge.exe	87
PID 1104 wrote to memory of 2864	1104	msedge.exe	88
PID 1104 wrote to memory of 2864	1104	msedge.exe	88
PID 1104 wrote to memory of 2108	1104	msedge.exe	89
PID 1104 wrote to memory of 2108	1104	msedge.exe	89
PID 1104 wrote to memory of 2252	1104	msedge.exe	90
PID 1104 wrote to memory of 2252	1104	msedge.exe	90
PID 1104 wrote to memory of 2252	1104	msedge.exe	90
PID 1104 wrote to memory of 2692	1104	msedge.exe	91
PID 1104 wrote to memory of 2692	1104	msedge.exe	91
PID 1104 wrote to memory of 2692	1104	msedge.exe	91
PID 1104 wrote to memory of 3776	1104	msedge.exe	93
PID 1104 wrote to memory of 3776	1104	msedge.exe	93
PID 1104 wrote to memory of 3776	1104	msedge.exe	93
PID 1104 wrote to memory of 3888	1104	msedge.exe	94
PID 1104 wrote to memory of 3888	1104	msedge.exe	94
PID 1104 wrote to memory of 3888	1104	msedge.exe	94
PID 1104 wrote to memory of 4200	1104	msedge.exe	98
PID 1104 wrote to memory of 2896	1104	msedge.exe	99
PID 1104 wrote to memory of 4200	1104	msedge.exe	98
PID 1104 wrote to memory of 2896	1104	msedge.exe	99
PID 1104 wrote to memory of 2596	1104	msedge.exe	100
PID 1104 wrote to memory of 2596	1104	msedge.exe	100
PID 1104 wrote to memory of 2596	1104	msedge.exe	100
PID 1104 wrote to memory of 4704	1104	msedge.exe	101
PID 1104 wrote to memory of 4704	1104	msedge.exe	101
PID 1104 wrote to memory of 4704	1104	msedge.exe	101
PID 1104 wrote to memory of 2216	1104	msedge.exe	103
PID 1104 wrote to memory of 5696	1104	msedge.exe	119
PID 1104 wrote to memory of 5704	1104	msedge.exe	120
PID 1104 wrote to memory of 5712	1104	msedge.exe	121
PID 1104 wrote to memory of 1112	1104	msedge.exe	123
PID 1104 wrote to memory of 1112	1104	msedge.exe	123
PID 1104 wrote to memory of 5636	1104	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\emergency-care.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8c6a6c188,0x7ff8c6a6c194,0x7ff8c6a6c1a0
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14308486979441148363,14152636685722009950,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,12528217959924087463,6568029341031996037,262144 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17099945723495280131,16920733865366874586,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2095220699371823468,18172378675277270865,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7206910064675079218,7216720482918887071,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,8683863386076837531,11375964238767207358,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6032603480356613326,9808342135464366643,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13546555423549973198,13274721184659316446,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,17686486889372657593,8578354244389683308,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4868,i,1535505801195684293,1087529443022908892,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3528,i,9339702056066243982,1439755658506102775,2097152 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11417491166694720323,17890427626466847014,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11417491166694720323,17890427626466847014,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,1127919973673714967,2219835694879935722,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,8414380144663695924,17953541483295008518,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,5774937105216812175,7687344239177710082,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4327738865523188621,191610446933445124,524288 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4252,i,14447264772451878398,2273312430654238263,262144 --field-trial-handle=2276,i,8983132902768800006,11049028535776080819,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

557f8e5f-999a-4719-83d6-c12e9aaa3410.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\557f8e5f-999a-4719-83d6-c12e9aaa3410.tmp
Size 20KB
SHA256 3968cc3dff917bec5f186943fb2527582f5fcd396fcb17e69fa8cf8b45efb45b
MD5 d308e8ba06a61caf08978cb57f87a1c6
SHA1 9d5cef3959cbe96a1c22157cd07d49f933d8c6c3
SHA512 4af5f1de0ba087366f11bf1e1d2a785a7050f63f23a1f06252c1b6278dcd250b1d2b4254f04828913259c93ed19f2bed1282099e9d0a62ef9759640ea8f17d77
SSDEEP 384:AZcIhsNOSE7dq/Rf+2/d9Y45aFkOObjI9G6w7NkO:+hFk/ZbMk29MX
TLSH
T14C928D31AC789C375DE7A511F4CB39134EF8917BD7D86F84A1ECAB0D059A9BC031A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

1a0cd6a1-2496-4953-91cb-87a8aef9d99c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a0cd6a1-2496-4953-91cb-87a8aef9d99c.tmp
Size 12KB
SHA256 89afd4c456355406e888d332cb753557b1591a75ddc815f8ecdbb04cc05b52a4
MD5 c1d2031bbf1c916fb0bbe9b638512d10
SHA1 f2797476ad88025a00fa906792a993d86e33befd
SHA512 b4c4c611697b7ed897e903d507865e63792249979a9a0d2e3ca3ed5ba7bc9c002a4cd5760a12e45d5814195a73759546110f8ff8d6bb17ac02b1587fc64d96f8
SSDEEP 192:sxZKRjyM/jK1Ml8MkP/fksUtaJnoIdpdzHW6+WNGYwKx8qIgrJ:sxZK5MP/fksUtUnZdHbGI9
TLSH
T13E42E7066A34997BCCDBD209FA55BF53D6F90573E2900E44A9FCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a65f3f7-2189-4b1f-a366-8ea2a3fc3453.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a65f3f7-2189-4b1f-a366-8ea2a3fc3453.tmp
Size 30KB
SHA256 4f1b3a0f43c01714d674ec16d1f4e8cfab46a773b61886e817edadb991b77427
MD5 855570b27df41d0f30a6421f1e1ab673
SHA1 1a12a0e3e498d466be0d085aaf462eeef48881ef
SHA512 64f904b4b6b8c8ac1598fb75037fbc9e454dd10f65732eada6cb89d64583aa2314d014a801865b641e5442c6b25c72310192d6bf1628d900b2139c1f63ef7900
SSDEEP 768:m74jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dErohILaf:m74jeXmWvmKxEu1jacPLZQdPL
TLSH
T1ADE20A3B240CCB7E4F844E5DED26AE972ED802CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ea7dc6f2cc18bd8ae9861ad4860c6dc6f3a648a59f8a348235ce137b7020867
MD5 e89303b34a021d6e91ffa52c902ba6fc
SHA1 8b44923e4b97a79d2375b1602671065506180e8f
SHA512 c18acee04c2387d0b897a75f4d66d12a67fe61b1a11067b32cc1849831b4a6930379381ab67b379d72e6f072edbb76277551636edd156108a0c188a4b7f8e950
TLSH
T12161D52A02B34797F322323CD4E30A13F3338484197B8D77464445FE7A38B229729A6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db38.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db38.TMP
Size 3KB
SHA256 12b1ff830c8c20356f5c69b638e4fa3d182e8cc3966d1c7710d3d9bf15fa6259
MD5 3012f8c5da67dd55c9f13b9e793a1edb
SHA1 bde607e46dabca25b051875623a84b119df2b203
SHA512 c6f90c1f9edd19c62e23e69d1664c0f880d0bd54a3f2719f6c6964d314d339d3f65d6c790e7024199a091cc096292c7e0bd8577f9b282f254ca0ebdcdb640ef0
TLSH
T10C61D52A02B34797F322323CD4E30A23F3338488197B8D77465405FE7A38B22972966C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6ae5c7222b1ac03931b1551d053d3201548eeefb2c94a4a9219cd1bc06a8d5b5
MD5 6004895430e13468aef837b8e98490ba
SHA1 faf526fadb65d4dabec9e0baaa671be5b64ffd2f
SHA512 bede375e988fb6fb6039dfe8eb7a7d8d52438e72e3343e007087a0c0033e96bc8a17c42e99651a3855727c8217a808bbc49e864b268261a283aac7ab0c6dd1c1
TLSH
T187517CB6C3D8876E881156F06B247A2ACD1D161A82783C268DF5FF4F63E24B1D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f5523ca55988efc775c56f69f6de03c3d2f3ea32b65ebde69f4c13c024e76161
MD5 0209e13b97cc58edc84059b7d9bf5cff
SHA1 96e618c2cbf2e45467704b43ab6e9a29bb31574c
SHA512 3bbfef5c5805289637da49e7e3fdb26cb7214bd3531d5eb3a3d83347d76b124a8052f409f451babbe399df89dd4ed1e1e973d8f6c237e517a94c24354eca3ab2
SSDEEP 192:sxZKRjyM/jK1Ml8UQpkP/fkshtqJnoIdpHzHW6+WNGYwKywqIg5SJ:sxZK5qqP/fkshtknZTHbGpc
TLSH
T16652E516AA349977CCDBD209FA55BF93D6F9047392900E44A9FCCB0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a5d970c535f09e3daccc2f04eee608a74d2ecfc376c0cf79384ca53aa09f25bb
MD5 d0cffac3c5c7d7ceb8aacd2f922b2b86
SHA1 b1c8fe4ab1ce2a3da0f816a01ae476c8efedf1be
SHA512 ccefb0dc4af8744b3d768e4a7d1b4d85a707525527e538f52268ba04db16aaf85486f677ea5d029f86c2f0fa1fadca7d036c4f9560a690be61d4ef2e90997c5d
SSDEEP 24:KdKf9G3asdAc44o0+rIji4KibhaU41EioSmWM/8qVyXYof/sdaCdK6W4KG+dIjAs:KAzIhK0YMHy1JIhKa886qIvKvKMPyu
TLSH
T13391431770BB82413D7D291C83559626CE81B2A77069A47B3F6C90B21F27E208EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5976fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5976fb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5ebf6b5c798427dc433c85632ac6fe5e6b83b701ba6e9deeb4f02aebccfd0098
MD5 3215c21e5e1f2bd0b816736414a0556b
SHA1 b2c1c31c03749051f8dd7e79c74b868f4c8adbdf
SHA512 4d65ec38ae16e607539e7494091ebdf68d0ce5af8b6bf9ad27ca57d3f138f9467de8d1fe6a34628e5c888ddca0f45f46ab0686a9809bd9b03bd383b94c63252b
SSDEEP 384:5sNORE7dq/Rf+2/d9Y45aFkOObjI9G6w7Nka:5wk/ZbMk29MV
TLSH
T16F726D31AC789C374DA3A611F09B35135FF4917BDBD82F84E6ECAB0C059A5BC1306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 21434a2d0f5230906caa98c8f8fa75d8b1afa5d3c4454e486a8cddc8867743c5
MD5 c166175f96e9733759f093769bfccfa6
SHA1 90d3cf3f6c07a950ab89374a6d25ae8c26b88c68
SHA512 a80a8f68e4871b328deb3c8f92c3e697f77e240c8e831124de58059193ee234e461faf58832425edca32acf41ba52bdee5e4d8554670154cd0bba5eac9672422
SSDEEP 384:y1iFiZcIGzsNe8TUNTUlIlSE7dq/Rf+2/d9Y45mFkOObjI9G6w7NkO:y8FQ2/wglk/ZbYk29MX
TLSH
T16CA26D339C68D93B9EF69B51F48A36138EF451B7DAD4AB84F2EDEB0C01565EC030A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 355c5ef01848b2f1e6e838fd4bdb28b03f151665cc4b1f9851faac31b1f5d16a
MD5 b697c35424bdaaed77493b0cabeb0180
SHA1 84a668fac9857ab0a8de954c1bce3e48d6f6641b
SHA512 3e4916992497eff1f9e7296e6319328ec6e949654606f18d07fffb6e16349177b7437a3b67483daa85b92ea726f0c08c6419f744bb433f962ce560a3a4e4b7e3
SSDEEP 192:EON+V6hZ0QmiUy8Eppc/+jV40+Fd9YDJ5wOZ3eU6:EONw6onOpu+2/d9Yk2uU6
TLSH
T1C302E835AC686C778EE2AE46F48777135FE4112BAAE56F84DAEC1B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 61dea1bba8c166569f14a8e737421c5858bef946582cb129b693fbbc28c28401
MD5 561b55d3b2c5f7b94c3f2c9b975b0899
SHA1 7941ee8129e1814c3c43be26f4cd4a6e8aab14fe
SHA512 36cd71ccc7f3b60d8d356ba86269e75528755e458f1f10b3430909f16a4b384603f6bfacd7d4bf5b4ada7c8aa664a044af9572e4bff28b5665f768c298a1a82d
SSDEEP 384:WZcIhsNOZE7dq/Rf+2/d9Y45aFkOObjI9G6w7NkO:Eh4k/ZbMk29MX
TLSH
T17E928D31AC789C375DA6A611F4CB3A134EF8917BDBD86F84A1ECAB0D059A5BC031A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a853dd53b2933bc1fccdf66a2afbbeb013fa7288f1136c990b4e96de7fea2000
MD5 85d5813aab318caf8e66f5428e540764
SHA1 8f30b2bd3b2857ff00a7196f994067ada5fca7a1
SHA512 1913038f646f709606adfa14ec49d4c7cfe19502e6e663988b020e959cd31c2b1f2f37199b35456082930a53e7295856041b43de771aeb33d647f1e0afd7a4f1
SSDEEP 192:ZONX6hZ4QmiUy8Gpjc/+jV40+Fd9YD804Nu5cOqurqwU6:ZONX6EnAju+2/d9Y45B9kU6
TLSH
T186120B35AC68AC674DD3A541F48736135EE4527BEEC57FC5E6EC2B1C00DE66C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cc8c12e-ee6d-483c-9706-c56bc73dd462.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2cc8c12e-ee6d-483c-9706-c56bc73dd462.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 faabcae0d86b4017a8c4632bf7124e71a51e1afa5d4d1a25fb461232809c96b3
MD5 1a0ba87673b92bc4955dd23dc1cd9d89
SHA1 67bd6f6873de90c8cad4c4ea7a1f27c0cbb5c875
SHA512 df74b1415430d5989cdf82a8fb0c624140b8371427041b4f9fc1dbb76688c98d7dfa7c1ea3a8b5c1dc30dbe7938790b108607fa8ed59fc4f97fa9210843c8430
TLSH
T1AF41F858BAE91149B3B67E5AABF6A9AD087F78772F06D46D00110E4E0A22F40C861737
MD5 SHA1 SHA512 TLSH

Submit Download