82bbacfae93233ec16171600a82022eeb6b71227ca311f5fff5c967219d6f20c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/fillings-restorations.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 82bbacfae93233ec16171600a82022eeb6b71227ca311f5fff5c967219d6f20c
MD5 172b1c38d21565457722555fce6e7f5d
SHA1 1dedfcd6c04cbd14fd4c6f9447f2e060a63746c9
SHA512 6691f21a31f7106de9d27c1908c045bc16cff86bcb1223b6565f9c08fbd6ee4d21167a9bdb07d0d66cf89e2d95aa2c33d26f91d6d9ed4c192ff839fdc60c4e3d
SSDEEP 768:31kr22KMvQhKfBDVXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8DLr:5jfb
TLSH
T10413752698D09023017386ED83F56A8CEBC681839F97590537FD1B839FF7D6AD99B408
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293698288697905"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{A454A3DB-AE6C-4169-B121-63A155890956}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1788	2912	msedge.exe	86
PID 2912 wrote to memory of 3716	2912	msedge.exe	87
PID 2912 wrote to memory of 1776	2912	msedge.exe	88
PID 2912 wrote to memory of 1776	2912	msedge.exe	88
PID 2912 wrote to memory of 1776	2912	msedge.exe	88
PID 2912 wrote to memory of 1292	2912	msedge.exe	89
PID 2912 wrote to memory of 1292	2912	msedge.exe	89
PID 2912 wrote to memory of 1332	2912	msedge.exe	90
PID 2912 wrote to memory of 1332	2912	msedge.exe	90
PID 2912 wrote to memory of 1332	2912	msedge.exe	90
PID 2912 wrote to memory of 3940	2912	msedge.exe	91
PID 2912 wrote to memory of 3940	2912	msedge.exe	91
PID 2912 wrote to memory of 3940	2912	msedge.exe	91
PID 2912 wrote to memory of 5004	2912	msedge.exe	93
PID 2912 wrote to memory of 1676	2912	msedge.exe	94
PID 2912 wrote to memory of 5004	2912	msedge.exe	93
PID 2912 wrote to memory of 5004	2912	msedge.exe	93
PID 2912 wrote to memory of 1676	2912	msedge.exe	94
PID 2912 wrote to memory of 1676	2912	msedge.exe	94
PID 2912 wrote to memory of 4060	2912	msedge.exe	96
PID 2912 wrote to memory of 4060	2912	msedge.exe	96
PID 2912 wrote to memory of 4060	2912	msedge.exe	96
PID 2912 wrote to memory of 2308	2912	msedge.exe	97
PID 2912 wrote to memory of 2308	2912	msedge.exe	97
PID 2912 wrote to memory of 2308	2912	msedge.exe	97
PID 2912 wrote to memory of 2660	2912	msedge.exe	99
PID 2912 wrote to memory of 1724	2912	msedge.exe	100
PID 2912 wrote to memory of 2660	2912	msedge.exe	99
PID 2912 wrote to memory of 1724	2912	msedge.exe	100
PID 2912 wrote to memory of 2808	2912	msedge.exe	104
PID 2912 wrote to memory of 4872	2912	msedge.exe	108
PID 2912 wrote to memory of 4452	2912	msedge.exe	109
PID 2912 wrote to memory of 2196	2912	msedge.exe	110
PID 2912 wrote to memory of 2100	2912	msedge.exe	118
PID 2912 wrote to memory of 2100	2912	msedge.exe	118
PID 2912 wrote to memory of 3708	2912	msedge.exe	120
PID 2912 wrote to memory of 3708	2912	msedge.exe	120
PID 2912 wrote to memory of 5052	2912	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\fillings-restorations.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,15343633400018004964,9874533174082564299,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8214221116104641332,14525877607212845825,262144 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,12806973178243668556,15004114359490456271,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,1603925320333939516,7251262508653260884,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,10902705860429074446,3062827503866285336,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,3102910967232701392,4829818964774573442,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,17613158808136715019,17663906882281450339,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3660,i,15278373625998501687,11990396144205316520,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5240,i,5714004124919289162,12701410779809753114,2097152 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15646278342761667760,1488487258963847799,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9999451862601407391,740280930255488748,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,17577381106257089029,7704861211081680425,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,17577381106257089029,7704861211081680425,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,11637518726145102854,10381422004714791977,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,7622290630765964717,1896446173294083358,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,16077548621000696766,10097641141088050187,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,17372326064671415914,9616297410467238879,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16291351165681430852,1700545930452152103,524288 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,17549064184175732791,3415143962751221968,262144 --field-trial-handle=2088,i,12145242299781114498,17330038838683010625,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3b65abdb29b4e7e650c82f94dc8fa464a56831350b2c219cd6ced5139d1161ea
MD5 4bce97b18cf6fe846d16cb4815dabe24
SHA1 b4fed9f91a884cdcb4d7636abacf20e95f4a206c
SHA512 51158ab3bcbedbc1b1083b8550ee047b9d7b807523573068fdff0ca35fe9f6769795f3681691e3581f76fd0d118cb4f3cfdc8fee34356f0e66e2590db2620aab
TLSH
T1B861D6BD0586EDF6E3D13A3190C03A8738F190E8FD63FD1D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e12.TMP
Size 3KB
SHA256 c74d903e8b66f321b8967f741a27e8defa3f58b3ed61fda0f1f88e5a1a8416ef
MD5 da78ad482fb39d63edde22ce830a5cc1
SHA1 7864535a25f8523d374d3f9c0640a87836e9532f
SHA512 9520567a42fbd0f468f93d10a6476edd2a3161a5062591ae5e874ee2086a14bfeacd65c8e7982ad46eb357da67e692604cea88e2af86cc01acfc1756f65cd202
TLSH
T18161C3BE0582EDF6E3D13A3190C03A8738F190E8F863BD1E01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4f5f1cbde2c4ca1525650e5993607dbbe1c852d27ab77ce2887d55d05c6817d
MD5 140a116e6dbd28936b5eff4b91cf565a
SHA1 df7464f0a2d766ec852ade3394ee139295eb8178
SHA512 d56cbd554c4c6ede96feba3c0388b90ed5909c2ab10a050749f069b23d329862cd64d695fb77241d19443b6bba245d32265498511708666e6d059c039e798f1d
TLSH
T1FA51ADB6C3D9876E881152F05B247D2ACD1D061B82283C668DF5FF4F63E24B1D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d9ac46823a3345bcd678c9439055b488a35ad3077c7e7cabdfbc65288b94d882
MD5 23a5f5515a9d7624c5f94f679028927c
SHA1 138c749f21f1d47e6ecb2aad70caf01adace86d4
SHA512 afd28a1caa778f1f01451427503a975f98b3348ea17dc8e79d6f284a8d61effa988fc598f5613b222f59a8d1e89f10ae184ed8d2a9aab839b6429a846ce56b8e
SSDEEP 192:sxZmReyM/jK1Ml8UQ5kG/f4sYEVgIdpHYHW6+WNGY9Iwo9nOIg5lJ:sxZmEq6G/f4sYEL4HbGPIl
TLSH
T15252C616AA345977CCDBD209FA55BF53E6F4147392900E44AAFCCA0C04E6BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0b0f196398d526be0565a924d67ebb08cba79881eabac04d5ce78fe5186153b3
MD5 9904841e2c5d43ede4440748fed7d7ab
SHA1 dc6b050b319f6e98fe47d1d509333062de55c788
SHA512 32ed5616b49fafdc908f5b056abf2c7495bad1d293955692a4e7fc00dd68f3aed96da40f03470176c7872236dac8940ab506be87551f5eacc90a081f40600e36
SSDEEP 192:sxZmReyM/jK1Ml8MkG/f4sXBVgIdpdYHW6+WNGY9IKoGnOIgrJ:sxZmEMG/f4sXBL+HbG5p9
TLSH
T15842C6166A345977CCDBD209FA55BF53D6F8057392900E44A9FCCA0C04E6AED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cc24e5bb31bdaaa72e8187a36d4d2026fc649b256a890ab40a50ab7ffca7a4db
MD5 b976f9a1394f1ae3f9d1e65fb123f503
SHA1 f731d67b752e4b02b9a90a5064d4ae7f3ed071e5
SHA512 9cd93f8700c5eb3ccfd71449888b9c3bda4ef2ef379a3616dd2a390a993686f1bc9558c97ec041e277951ab0bfa92b9044eb5177ff884e117511656583e057b2
SSDEEP 768:CPcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNBro7g20:CPcv21wWvu+z+u1jaeFLeRN67g
TLSH
T1CAE20B2B280CCB7E4F841E5CED2AAF966ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c3476bcfca650bb6aa8ae80c335fa8fa10206d3d7d9660854487a0ca4c2ac85
MD5 151ebea044b5729ea711ae73d2f8d9eb
SHA1 f29975ee830764a76ca7685755f3f9d1491c7f57
SHA512 4d3d6cb97232a6798212dba25a9ca452e6a59cb6712d29cc093dac63d0d971d20a24615ab1fe1f19d370df888134a4cb032bcfbf2f64d36ec19e973d86110562
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTya+PaKs4Kl:mTfHFBl
TLSH
T1FC91A602707A4292397F284CA3A586368E81B0677554E9BF7BB841E14F27E225CFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d947b25bec707e306120dfde00ac110d2a0b0499bff4e33065c88f1431091066
MD5 25d89a68dce1dace68ce1f3676692ee9
SHA1 0173907db79ae36d18c4652da785e81e5fddcb3b
SHA512 04bb377d059758c3f0a64410acca62d608cdb5058267f011c230149bcb7c013f36701d823bd54d031db3033576f849b9f2a579aa4d093bb55b875f031fdb58f9
SSDEEP 192:u2LsNLh1Q4Sr5p4+YLeqLQmiU1b8k4e+CG6Om9opwSJrHfeJiRbqiRXg2/:XsNLh1Yr5p4zieSbe+CXOmep3JrvRx3
TLSH
T13D425C36AD380C664EE7A590F54B3613DEB850A7D6893F80E5DC6F0C02DF69C130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21024262e418d79684469ce663bbaebbe25e75514575bd9589a7b58b274880ea
MD5 35a132855ecb974609ca8918f2082777
SHA1 809ca1d6e42401ef8033d76118f95e47274ffdcf
SHA512 6783a349c05095ca4bee0adc9bc014d8d05fc0fe67dbf9bf16cc3b3ca43bea183119ef79de02bd247ce17b3601cf2bade3ff01c63e66eca29e14e8ddd5537910
SSDEEP 192:JONO6v+YLNQmiUympZh+CG6Om9oEusalU6:JONO6vz/xZh+CXOme6KU6
TLSH
T10B02E935BD281C6B9FF25E45F98737275FA8217BE9952F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a720675aad4417c8dcdffbd0d25f4746c36c3259cdff212d2cf32a8865efd83
MD5 a57b42877ef05fb9b7d185fe76a48067
SHA1 cc86af8b471da42dd7d0486be96c2dd3055acf59
SHA512 28a815ffec0da1cade89e63cfe6f15f4bc9fee4687ab310c95d94eac93e5c9c05c97500067d9d06e8abf30fe0197100fe1bcf03a7b033f6b639aceea5d29e08c
SSDEEP 384:eqZcISzsNLExYr5p4zieSbe+CXOmep3JrmRxOObjI9G6w78e:J6gECqvO9p3hmRx29M8e
TLSH
T1B2929F36AC384D765AE7A551F58736139EF8907BD3C92F84E1DCAF0C05EB99C030681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0a9498fdd844065aa4cc43a820c67cc6bc30686b96225b6b9655df7d17280be0
MD5 fc8cb75082d8672cd900140a7c21b1aa
SHA1 f280d7ddb2fe51d5b973b4e150840e3833067cfa
SHA512 0913d90da9b81a1efcb722a95b97b78eefbbdec0ccc4d4d7efd22da86f4e6891cfd34fb70257cbcbac8975d18b8089673ab5bb915a8b3ac22b3670ee8496e282
SSDEEP 192:uiLsNLE1Q4Sr5p4+YLeqLQmiU1b8k4e+CG6Om9opwSJrHfeJiRbqiRXg2/:/sNLE1Yr5p4zieSbe+CXOmep3JrvRx3
TLSH
T1F5525C366D380C664EE7A590F54B3613DEB850A7D6893F80E5EC6F0C01DF69C130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 57e04df3e5ed90cb8ecaeaf05febe9c7f160948577bb6e506f24888e4cb4e500
MD5 d45ea79ec801a25d9abde23ca7165461
SHA1 1010824b641b0c7322ace73cd55e47402619fb78
SHA512 2f43e8334cb26561bbffe535a615e38f41a551bd6509a6fe1825b39b5766f9262baabf6ad9b8ee5251bd8966c8ab64b7d0e94f6caf530e9a506d9c399735c7f3
SSDEEP 384:/sNLETYr5p4zieSbe+CXOmep3JrvRxOObjI9G6w78d:/uECqvO9p3hvRx29M8d
TLSH
T172727E36BC384D764AA79551F18B36139EF851BBC6892F80E1DCAF0C06EF6AC530591A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1759c131c3a651a5042834fc84d00e42d0587fc96f5d1918249445e23750542e
MD5 40717f6df63f9ea99baed1ad216b57bd
SHA1 c51fb0dc282988f62ed3fb7de0829c78a3c9d523
SHA512 93e5755a4166b4e454619d4ec4147e7c84ef0ad56b212dfec87d65c0e89038d688c01303ec2b269c4460670f7204cf6a561aec0835fd5bb1c87bba86fb638f22
SSDEEP 192:1ON+6v+YLAQmiUyRp5h+CG6Om9opwSJrHwCHRbqiU6:1ON+6vzsS5h+CXOmep3JrxRxU6
TLSH
T1D7122C3679385C6B5EE35991F48736139EA85167DA8A3F80E5DC3F0C02DF69C130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download