923e01ee572d816c2b90b297dd313ebcc80ee41fc442b69ef86ae0125d7a4ba6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/teeth-whitening.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 923e01ee572d816c2b90b297dd313ebcc80ee41fc442b69ef86ae0125d7a4ba6
MD5 133dc5a4572e7edbb18fe4e439a4d630
SHA1 7abfaedb49d739fe71aecdef16cb1eb95017f8fe
SHA512 b669d78497df6a866ce0e7273556aca1c78a9a79d49320ad4c959d39931c95d2dd17f93eecd93bf37b109ed5c386ccb7999bbc44e4b797d2e960482db76e5f16
SSDEEP 768:3P4lyl/2KMvQhXlSlolC3Xd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCy:Rvfb
TLSH
T1FB13642698D09023017386ED83B56A8CEBC28183DF97590937FD1B839FF7D6AD99B405
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293698451984557"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{02042DD8-75D4-4E8F-9ACA-B6F91F08595F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4180	2304	msedge.exe	83
PID 2304 wrote to memory of 4804	2304	msedge.exe	84
PID 2304 wrote to memory of 2312	2304	msedge.exe	85
PID 2304 wrote to memory of 2312	2304	msedge.exe	85
PID 2304 wrote to memory of 2312	2304	msedge.exe	85
PID 2304 wrote to memory of 4936	2304	msedge.exe	86
PID 2304 wrote to memory of 4936	2304	msedge.exe	86
PID 2304 wrote to memory of 3488	2304	msedge.exe	88
PID 2304 wrote to memory of 3488	2304	msedge.exe	88
PID 2304 wrote to memory of 3488	2304	msedge.exe	88
PID 2304 wrote to memory of 1952	2304	msedge.exe	89
PID 2304 wrote to memory of 1952	2304	msedge.exe	89
PID 2304 wrote to memory of 1952	2304	msedge.exe	89
PID 2304 wrote to memory of 4520	2304	msedge.exe	90
PID 2304 wrote to memory of 2600	2304	msedge.exe	91
PID 2304 wrote to memory of 4520	2304	msedge.exe	90
PID 2304 wrote to memory of 4520	2304	msedge.exe	90
PID 2304 wrote to memory of 2600	2304	msedge.exe	91
PID 2304 wrote to memory of 2600	2304	msedge.exe	91
PID 2304 wrote to memory of 1060	2304	msedge.exe	97
PID 2304 wrote to memory of 1060	2304	msedge.exe	97
PID 2304 wrote to memory of 4536	2304	msedge.exe	98
PID 2304 wrote to memory of 4536	2304	msedge.exe	98
PID 2304 wrote to memory of 1456	2304	msedge.exe	101
PID 2304 wrote to memory of 5300	2304	msedge.exe	111
PID 2304 wrote to memory of 5300	2304	msedge.exe	111
PID 2304 wrote to memory of 5300	2304	msedge.exe	111
PID 2304 wrote to memory of 5360	2304	msedge.exe	112
PID 2304 wrote to memory of 5360	2304	msedge.exe	112
PID 2304 wrote to memory of 5360	2304	msedge.exe	112
PID 2304 wrote to memory of 5620	2304	msedge.exe	114
PID 2304 wrote to memory of 5628	2304	msedge.exe	115
PID 2304 wrote to memory of 5636	2304	msedge.exe	116
PID 2304 wrote to memory of 5280	2304	msedge.exe	121
PID 2304 wrote to memory of 5280	2304	msedge.exe	121
PID 2304 wrote to memory of 1464	2304	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\teeth-whitening.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,4470288607984793807,11211902825199440227,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,893868132588141228,8513273336201903334,262144 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,16477132501558147902,7058376849960934643,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2963930692777964060,3438220595025820711,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,9186831545659928943,15997876076195972205,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,5968482582312212112,2133538740351953052,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,3515825471905403802,3403562279184457122,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2101216855529172501,16945935116055969540,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1758954285042428242,4172980859144419480,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,8432380632844136549,9613207159869147135,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,8432380632844136549,9613207159869147135,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4284,i,9262752395470495259,1375701666862398194,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5080,i,10890068612901830627,13134713543314860193,2097152 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,15981189532509219539,2720616187436825432,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,4697550719256290979,4715812827989919120,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,13309424814727709261,16065031290522928139,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,16877212550790855099,16388702411010953301,524288 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5532,i,17177377875473299155,13802264484002775866,262144 --field-trial-handle=2264,i,8180090312052151377,16039446098425357919,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 146d6d0f330c79df29541971531cf698bc1054f9cbaa587a0fa38638eb9638e1
MD5 68731c7c3c0ebc21b459efbb88ef6ab0
SHA1 623701d3ec3514f48707bfbf5cbac81491edb378
SHA512 f90a8b52b72338ea8d19ae9a9da938ca721c9e36c4e95d41e9ccc741e4bab014532fdb75e8506f6dfce8e39cea337842cd04ce5968790bfe74f65fa5ab198392
TLSH
T142714EFE18E30FA5EB21F2705AC10242B13085EBF613ED678D90D7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5867ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5867ec.TMP
Size 3KB
SHA256 c3a61986619b22f91894c0dc576c668ff0c51d0436db1c31792b7c593448038b
MD5 608bc3fecb6a218bfac3483901dc9b50
SHA1 17101f0e5b6110b8e3a23131466c79710e849b2c
SHA512 721943f8776d3fd8ef4160f663e12fcea956d35ce9bf358ee3a4d635279442620acacb2826f590be642b00f1b9f69cae83660c21c3a713e43c99a5c3f5f9e88b
TLSH
T1DC716DFE18E30FA5EB22F2705AD10246B13081EBF613ED278D80C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fec19b7-fe13-446e-8948-608dbb348d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8fec19b7-fe13-446e-8948-608dbb348d45.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a20c244bcf615c13a72c53281ffe023afd03407c4599d41e0a375e8a69a11141
MD5 e79e1c620d65c8f4b45a922cc1f5c373
SHA1 6db0d4ba60602eeff085a9fd5a965f53d3732dd5
SHA512 9039a305b27ba8efdad345244c63aa10de1edb7c2842698f118ab180ad8948195e68755dab9826b496b9bd8c65e25c1a8c1964ee1bf37448b1bfd52d04fdf1da
TLSH
T12F417CB6C7E9876E891152F05B247E2ACD5D061A82683C268EF5FF0FA3F24B1D10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a0115c48a303b57a3cfc000ab70e32b9626cdb86ad908c2bd3a88bcb6c314238
MD5 b70c3bcc2bc3a71c99e9e50451aa8e4c
SHA1 5b9fb8b1859c59c01d4da3fee6e2cd2d1ec7ffe6
SHA512 e3e4abd09534b390c782edaaf4cb734619ecefef18816b0d803eb6a11affa89c9665d576a2266d11b68cb97d2ce9aec0124673e9f1155bb860ee86c287a1619a
SSDEEP 192:sxZnRlkZ/fgsBby/Idpd9HW6+WNGYIk3EXaIg5nJ:sxZnwZ/fgsBGwrHbG/6v
TLSH
T12422B6126E28947B8CCBE21DFA15BF13E6F95072A1D11E48E6FC861C05E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9b0f23c0428553fc06692b5e74e93304cabcd7918a1406f162b88a7d3cf835e1
MD5 3f7e29719acb739088fb206c8f15ab85
SHA1 d572ca38a689da67dd80650d56e8d3412ffc664e
SHA512 f64ba58a3cae4b9bad76b55204fa87d93daee9a76b37eafaa16c7a05abbd51a966206ec00ea020575ed5c53b2b4e17c2026ef99bbf0e9a81ca7ee3e06d7c99b1
SSDEEP 192:sxZnRlkZ/fgsgby/Idpd9HW6+WNGYIk3EXaIgrJ:sxZnwZ/fgsgGwrHbG/69
TLSH
T1C522B6126E28A47B8CCBE219FA15BF13E6F95032A1D51E58E6FC861C05E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e3238fe3310e257c6a730b2acd9d874cb11eeec81d8b8d359673efa4e3c0b0f5
MD5 b5b629225f1c1c771ab9139a1a283f47
SHA1 d41c3a418cb451295ed36a8f1f15fa5add0c70b1
SHA512 7dfbe4c9823c4ae44bbcde86bde27dc6b90b9a59f982ef6a586118dfa81bea65b4b0f39671ad91ca82c27d10c8230717893bf5965f401e3e0f8e9646e068b848
SSDEEP 192:sxZnRlkZ/fgsBb3XIdpd9HW6+WNGYILBEXaIg51J:sxZnwZ/fgsBr4rHbGU6x
TLSH
T15122B6166A28987B8CCBE60DFA15BF13E6F9507391951E48A6FC871C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e038075b04859e66fdac68003c39912b472431914902755d7eb1c3e6fd7410b8
MD5 3102bb55a171590a2713773f5c032d81
SHA1 253f86302dd28b5f427c31c9a87597b49a7a1ccf
SHA512 3d183f299c92643756081fc6490a9a6540b32b41341e8494d83ec31818d7169e26b81f49982e3c308eb83f5525e279e58a07408cdedec35ab4cd995ae826aac7
SSDEEP 768:OhyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR75roOVIs:OhyqbblWvJDjTu1jah4LAs7yOVd
TLSH
T124C2F93B654CCA7E4FC00AADED5A6FD73E9802C7A6588D4047FA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5903de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5903de.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 018c1771e4e126610700c3b02eff018d0ac8797fef49b1e396f5de487acc2a17
MD5 deff5a30e185d8511d6b72141bc05ca3
SHA1 9487aa1aa3c66f0858545fef72bbb030749e8014
SHA512 f421ad8da22bfd9e8eba09eb4d0c91a58e081c323308ef89fd28b471eec673634365f0ecbfd816489031ac22e95890be4d9f82611c9bb7c0ca563ccec9f09631
SSDEEP 384:hiFiZcI0zsN88TUNTUlIlhKObsnyuVRN3OKZ9Qj1OObjI9G6w78r:IFQItwgCHFH3Om92129M8r
TLSH
T1F9A27E335C648D7B9EFB9E45F54A32178EF490B7C6D86A84E2DC9F0D01974AC130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2738e25d3cb7739fe57d6a944ce3c8efb52f953387373e84d970102dd2bce132
MD5 8fa36362ab7a2b839db5a37ab95a90ac
SHA1 a51127d168302993c0f62c6c19d3a85c684a2d93
SHA512 ea26847e266376b6703eec785588cce580c2bb1c3fbfe15753a731021802d69076b306859c103ed57c046056a9a7862ee019ef6b20ab1a0ae96d2241a3826ca8
SSDEEP 384:2ZcIhsN0hKObsnyuVRN3OKZ9Qk1OObjI9G6w78r:khgHFH3Om9L129M8r
TLSH
T1FE928E316C385D779AEBA505F58B36179EF8D0BBD7C81F8491ECAF0D01DA96C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 aa3b9816d4115f7b96c61cf5654132d50adb9e18de83948d04d704bbad936c40
MD5 deac3f11042df31a1c75c6f54fdf92be
SHA1 1efb958a1efecfd8dae920c84beb9f740da4aee1
SHA512 40bc9c3673d0cfd470bb345cdfd1b273a66308ad862b556ee5b4255b9212227b158174891c1f6014776b98f9a16f74616caade282fbe8e1c80a96aedda0e92cc
SSDEEP 192:u7LsN0hQqbMvTkRbeZQmiU1E3EjyB4VRN3OmNOmSC9QjMkSRJq7cU8:YsN0hKObsnyuVRN3OKZ9Qk1U8
TLSH
T17E322A326C385C778EE7A544F54B36139FB450A7DAC92F8496EC6B0C01DB69C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa53c621bbef389a187d360419db6f4f9bed20e663d46824063d95e789fb8830
MD5 d2f6c17b37ccfe9ef0030e4e84cc547c
SHA1 ef1fb76d3e95235ee08c3d6251debb4c8ac93283
SHA512 3c4e71d507850c116cd725ae8598d71a3822dd2b40a63fd703cba8392e66f1fa10f2bb4f0bb98742f3dd41e7eb6f8aeeeb0f493e327f2e9741d34c46e15cc674
SSDEEP 192:tONK6JkRtQmiUyEpEPW+RN3OmNOmFHh3qROFU6:tONK6UrUW+RN3OKBpPU6
TLSH
T15E020B357C381C778EF2AD49F98B27135FA5206BE9952F84DAD81B0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 215812eb9ae6fb64ee349e1bb8564de33da0d7b92e930a0464ef68ae9f4401e3
MD5 3d7798f85c9191ffd3d1638341307c72
SHA1 bd60e16b892880d1ddd0a6daae66e70d94a6c7c8
SHA512 7055d6bab982e5b328c47e0701ed86b8efd41982561704aaca44cfd5d068eb91b55bbd2094a7ae74602949a617cd88b2424b300a122419bef7cfdee695c05fed
SSDEEP 192:pONd6JkRWQmiUyE1EPl+RN3OmNOmSC9QjM1VcJq7cU6:pONd6Uysl+RN3OKZ9Qn1U6
TLSH
T123121A36A8785C674EE2A945F58B32175FA89167EA896F80D5DC2F0C01DFA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

956c29b1-b38b-4ca8-9f6f-bac032e008f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\956c29b1-b38b-4ca8-9f6f-bac032e008f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee262b831120a08340d7120315aa81c8e66d5ee4f0f3ee75278b21afc2cb3efb
MD5 78d0622c306cdbe1942b71c5bb462068
SHA1 7177904daa9d7ef5a89575434b98a67c62f0a4ab
SHA512 a11c6d34ceb24752fc0c6af398dcfd816bf48663995523a2bcba4c78bb01ac794fe3381642c911724c3b38ed342c4ca52de1cc01de33b1e1bcae467edd47fad5
TLSH
T19A417A58BAEA1108B3B72F1A9BF7A86D447BBC732E46C49D00110D4E4A73A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download