65c2042e22b83648b7495c16cf537ec6f9c80c252c154358a18c3bae970be1ef

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/orthodontics.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 65c2042e22b83648b7495c16cf537ec6f9c80c252c154358a18c3bae970be1ef
MD5 72cc843753a20e193e20e65dd1d33710
SHA1 f29ff268c67719d90d9fa115fc820cdaa1269a81
SHA512 e9763ed8a5b3130ca94e4ddd5d32115d2f2016a6d42f8ad653063d372a85f7baf898e06bc9e80f5d4b25090af7b3e8eb693c2a734e60fea4dea7a47816f307e7
SSDEEP 768:3dGep2KMvQh6ACYqXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8DLr:LFfb
TLSH
T141137526A4C09023017386ED83B56A9CEBC68183DF97590537FD1783AFF7D6AD99B404
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293698405617635"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{6216BF8E-A02B-4DDB-A00C-974733D8D3E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 332	2944	msedge.exe	84
PID 2944 wrote to memory of 1748	2944	msedge.exe	85
PID 2944 wrote to memory of 4532	2944	msedge.exe	86
PID 2944 wrote to memory of 4532	2944	msedge.exe	86
PID 2944 wrote to memory of 4532	2944	msedge.exe	86
PID 2944 wrote to memory of 4440	2944	msedge.exe	87
PID 2944 wrote to memory of 4440	2944	msedge.exe	87
PID 2944 wrote to memory of 2892	2944	msedge.exe	88
PID 2944 wrote to memory of 2892	2944	msedge.exe	88
PID 2944 wrote to memory of 2892	2944	msedge.exe	88
PID 2944 wrote to memory of 2360	2944	msedge.exe	89
PID 2944 wrote to memory of 2360	2944	msedge.exe	89
PID 2944 wrote to memory of 2360	2944	msedge.exe	89
PID 2944 wrote to memory of 64	2944	msedge.exe	91
PID 2944 wrote to memory of 64	2944	msedge.exe	91
PID 2944 wrote to memory of 4472	2944	msedge.exe	92
PID 2944 wrote to memory of 64	2944	msedge.exe	91
PID 2944 wrote to memory of 4472	2944	msedge.exe	92
PID 2944 wrote to memory of 4472	2944	msedge.exe	92
PID 2944 wrote to memory of 1312	2944	msedge.exe	96
PID 2944 wrote to memory of 1312	2944	msedge.exe	96
PID 2944 wrote to memory of 1312	2944	msedge.exe	96
PID 2944 wrote to memory of 556	2944	msedge.exe	97
PID 2944 wrote to memory of 556	2944	msedge.exe	97
PID 2944 wrote to memory of 556	2944	msedge.exe	97
PID 2944 wrote to memory of 5096	2944	msedge.exe	98
PID 2944 wrote to memory of 4332	2944	msedge.exe	99
PID 2944 wrote to memory of 5096	2944	msedge.exe	98
PID 2944 wrote to memory of 4332	2944	msedge.exe	99
PID 2944 wrote to memory of 3492	2944	msedge.exe	105
PID 2944 wrote to memory of 4684	2944	msedge.exe	114
PID 2944 wrote to memory of 2088	2944	msedge.exe	115
PID 2944 wrote to memory of 1656	2944	msedge.exe	116
PID 2944 wrote to memory of 5464	2944	msedge.exe	122
PID 2944 wrote to memory of 5464	2944	msedge.exe	122
PID 2944 wrote to memory of 5576	2944	msedge.exe	124
PID 2944 wrote to memory of 5576	2944	msedge.exe	124
PID 2944 wrote to memory of 5212	2944	msedge.exe	126
PID 2944 wrote to memory of 5212	2944	msedge.exe	126
PID 2944 wrote to memory of 5212	2944	msedge.exe	126
PID 2944 wrote to memory of 4560	2944	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\orthodontics.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffce555c188,0x7ffce555c194,0x7ffce555c1a0
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,2137658085624456515,1057682761747939,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10341686815742669222,630558706832826319,262144 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,3970993626158776593,18389527093590445190,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9886165782433843983,3675696486764437946,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2265788292791091770,4018767646271643567,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4148421210544655375,16297335424230670478,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8603988901755232651,11260034004558254651,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5124,i,10250118363075067929,2644867896593335187,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,8397900763754310952,11639228470190483888,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,9262191344776312878,9657584338585710188,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13340139859554291768,6848980971240688092,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7566043435325109315,2811673905650085703,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7566043435325109315,2811673905650085703,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7030912351618231518,6483004249180505143,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,16838883775245929163,15980248805379014086,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,602649181625508394,15328701635523164954,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,16565413702261202477,618496669333725980,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2196008523837941483,957332958171371034,524288 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5136,i,15277649896533063943,3691183426436953576,2097152 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,5668612323038449002,10341562741496736298,262144 --field-trial-handle=2324,i,7278710913192048726,16180452874532437419,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

1c064f0a-e57c-498d-8d56-d7d3c1fdb2e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c064f0a-e57c-498d-8d56-d7d3c1fdb2e0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4154ced3bce05409aecf1eb817e378d1109b63e471df07a78bca602acbe4322c
MD5 689fe3add1f61f3575588e36b3964db1
SHA1 ee505760396c87f8252aca4a303f52ed84abce01
SHA512 032ea80f51c54859450a75e6a5a723ad4fbd7bcb3674c3a51ead2f12133b29410b743b46fd73e0fb38aa68cbd2c9360e70068a2dcf3c152fdf87f3e48f611979
TLSH
T1E8612A37208282E0E31A3170A1E133543EB68DFDF0439E5659EC447522B43EE8277E18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3807c347b3279d3a1d339655c980381b63e8668a59c95d8a12cbb84eebfa16fa
MD5 045de59d757be0204af799787d991d8d
SHA1 5813cfb26f8edf5537d5e0f1d120c3a8465c0d16
SHA512 a22b7fcfc1410135374fb2deb5e3897a948093b0435eff28de1d3aca9db4e9eaf36bdecbf12907ba82e5acbe0ff4845114933ca7d51d197ad7fe6bf1dd6759f9
TLSH
T1A4518BBAC3D8876E885156F09B247A2ACD5D065A82283C268DF5FF4F63F2471D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4efb8a28558fc276f1e352a5788aba64ebe932010169ce3371a2289ff370ed9d
MD5 162d14aaa59ade981d598da60d384fa7
SHA1 f87f64b1dca5842c557bc7a34969041899c88fcc
SHA512 6ec615059f299b32b59bd6925aff6db73cc4150be80ce38db6872d6417e8aea48ba7676689d6b860826175da39ae69dc83efd201db18722674ad8e299cf18707
SSDEEP 192:sxZ/FROkx/f5svUH5JIdpdwHW6+WNGYCkpVyHIgrJ:sxZtbx/f5scZC2HbGC49
TLSH
T1AC22B8166E28997B8CCBD21AFA15BF13E6F95073A1941E48E6FCC61C04E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b839cc08e7b854c9e5fbcb898b111c7840e835f956fbc030f5381fe7bc7d234
MD5 0a02b695a225950c6b7b2bc266f30e0d
SHA1 a6215f365265adf338d7f6392a9beabf6f82a1e8
SHA512 81db10855fed9e44b214ead53e4117b85894740ed3c71e4842700826aa4625cfa67db1f5499b5f2153cb3942fb360be1b20762a9175c0b181bd01ab840fdd3bc
SSDEEP 192:sxZ/FROkx/f5sF7UH5JIdpdwHW6+WNGYCkpVyHIg5lJ:sxZtbx/f5sF4ZC2HbGC41
TLSH
T1B422B7166E28997B8CCBD21AFA15BF13E6F9507391941E48E6FCC61C04E6ADD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dfad41e08bb568effee17b7727f426cc288eef33926f40f5485ee58b6e736dda
MD5 19a684ea20030a90d56cf5cef6fe09a7
SHA1 c29e4e1c6d1d147cf39489b761786ae23495128c
SHA512 f22daaab7bceffc68edc7155c1b89d35fc055c905276631b0987e19052bef78723386c34f80fa48efe418929ff6213bb5a06e36675065824cca6762a8f2ff787
SSDEEP 192:sxZ/FROkx/f5sF7UHKJIdpdwHW6+WNGYC7xVyHIg5PJ:sxZtbx/f5sF4qC2HbGP4b
TLSH
T15822B6166E28997B8CCBE219FA15BF13E6F9507391941E48A6FCC71C05E6ACD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 76a00aa200dae61b44e33773abd306258fa1880a847081cb57d0e6499b9995ea
MD5 25322a6db4515b3e48afce0be861f268
SHA1 379ae9ada11790c432ddde6bf2272e49e6d37dbe
SHA512 4d6fe2fc3312d5a28b0f352151955707880496739dddd6f8540ce1a7429264139f75030383834dd7b9b6740d53f9ade351cf8b5fd3cd153df837dc137179d294
SSDEEP 768:bhqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKryroz:bhqbUj+WvSCU6u1jaaZLbWrpz
TLSH
T154C2E83F340CCA7E4FC01A9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4f6de17092b07915e829ae264855e8931fb0fb31a561d39f150ce3c3b738678a
MD5 032c67016c7f2ad3c362d8ee10f29af5
SHA1 9265a8ea483653bf7a744233eef13b1f39b871a5
SHA512 2a3a0f6eb3d61c75906b9743bf81c65ace3f99fe771017afcc39380be3ec193a23170b6d3fdf27be811aecf5020eeacb64ba4f87437ca453410413ebff5c7b6b
SSDEEP 48:KIWjcwWsMxhQRsIGIxKz4L2xfOhEJIMSyF5IZKiM8GyIfKbCczyz:KwzuKsou256KiM5y4KbC6s
TLSH
T15591760BB076D251797E2448A263ED368E817063314CA86F7B6991B60F27F164CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 828d10e3f4fe06dd90ac93000a4d70b5cf9befa96d9b83f31d506b8b26e12d07
MD5 c9f2f82e1f9452c2db1998b2406a9b83
SHA1 ee08e782ac4383217ce0fe8256c0d5752ca2878d
SHA512 f9fdb75ae17babd78668c1e7640fa530b77d53c1719d2fac941701bf8e61ddf3457ffec687893c6ae4ce3aafd93fe650fcc8c17a14548a7a137e7b30ec2cbd2f
SSDEEP 384:UZcIhsNuaO5zDVTtEa+sOk+cDYFgROObjI9G6w7WJ:ShN5l+aZOkVMF+29MWJ
TLSH
T1AF928E336C384D7699A69555F88B36239FF8A077D7D92B44E1ECAF0C01DB96C430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b210a9a561b5279294770102f30f06bfe56568cb2f8476a37c37dc50908fc1d0
MD5 81f0e6178b1208f4212a761581e81891
SHA1 177195bb34f5809322f28c1222510a6592f4e3a6
SHA512 a6512dee0ba9bb787632b1d9b1db56edad51d6bfc5266ed29957fde5a3c193c5c78d96630a2959855e558d5debdbfa9f4b8d294b8c15719cc0be8d5d407332c9
SSDEEP 192:vON16Db6QmiUylDHBa+jYOmeW+EKRgFFwU6:vON16uAHBa+sOk+MFSU6
TLSH
T14E02E83569785CB79EE26E45F88B27279FA4203BDA562B94DAD80F0C00D765C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a10084d7b362f75db0d24f8655be923eeb2fe62de4504bad8723179f3964f19
MD5 7309ef5c4348c009de76a4889bd89378
SHA1 29b55a2d75ec45f045e2da3cc0107c16ddda976e
SHA512 e99263a0511b8449c86493dcfd97f944e466ec6459f4e393061fbde245074ee6ae08a6d452bd28c2d0fd7f8587c12f037ec5f324959b2834a4a13b0866236d8a
SSDEEP 192:wONX6DbYQmiUymDvBa+jYOmeW+E/0e4SXNzF1q1RU6:wONX6gRvBa+sOk+cDxFgRU6
TLSH
T178121832697C5C775DE2A595F88B36239EA45067DA4A7B90D6DC1F0C00EFA9C130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 82355feda59e330aea8348e576cd340dd47bbf2da10fdba8348388985e4a6846
MD5 92c95d9035fbd865bea73a16121fca1d
SHA1 1cf0c3356360beab3dc9a9f95a64bb9b8432a092
SHA512 c17a62cd9297ecb651d94954324e6efc8d371ab6908e9e6684fbbaf3128f90b0702856c16a5909434bf83e32d324a270abe51465f173eb1595282587938d7eb5
SSDEEP 384:SFiZcI+zsN+8TUNTUlIl3O5zDVTtEa+sOk+cDxFgROObjI9G6w7WJ:SFQevwgw5l+aZOkVVF+29MWJ
TLSH
T1EDA26E335C688D76EDAA9A55F88A36239EF450B7C6D97A90F2DC9F0C01D759C030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6d44345dd28c58e14500373ee33a176ec713cb3d3b34b1d95abbd78f9bc808b1
MD5 f686600afcca9ba3165dba0d74705a32
SHA1 ffd88e8888f89797ba3613b6e7b1bb87f5299faf
SHA512 34734d4a571e4e4d9afaa7c11115c427b3a105a01df9981ff44def90ebe9dedaf9a036ab226d3d2041f9a018f7d2045e29c94234243ead33b8960e6eaf863b02
SSDEEP 384:ZZcIhsNu3O5zDVTtEa+sOk+cDYFgROObjI9G6w7WJ:xhA5l+aZOkVMF+29MWJ
TLSH
T178928E336C384D7699A69555F88A36239FF8A077D7D92F44E1ECAF0C01DB96C430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b9f2969661cb03025daf730c4a556d621f3a26f4a50dd64e442cd168db4b70d0
MD5 9e4fab466a042f0e044c3ebc57f53ddb
SHA1 40d72ecaf540785cf3e5261b0103f1dd8382ac88
SHA512 afdbf1a5a9c1b1e7f1d00bcc51d2a05090915622efad77985392ffcd6b720c4e362663dd6ebe459ac6bcf5c05727a23dc2fa80a91047b0436741554272897c9f
TLSH
T12E41285CA6E91104B3B76E5AABF664AD487BBD773F0AD45D10010E4E0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download