29c63eccf4677331944231d04a25ea2bcaea9cae7ce237d633b6f2caa416be31

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/blogs/5-tips-to-keep-your-teeth-healthy.html
Size 24KB
Sample260724-pl8dsaej8y
SHA256 29c63eccf4677331944231d04a25ea2bcaea9cae7ce237d633b6f2caa416be31
MD5 f4d3a0d1d8054c205e6c153bb6efc50b
SHA1 7afde39e18bd6aa2b2521013b9eb4620bc91ee73
SHA512 a39ce7348383cd2cdddc56e69defa128401b193abab9af7bdb557d22b865a032e89b8836f66406957d4d72b0a8c7dd33ee33a38c2e26eddaef29cd98bb1cf680
SSDEEP 768:37DNzFEldKMvQhQcGjFyzgxe8TCdG049wSkCu+8DL2IKEJ:fN5dQynzvb
TLSH
T11FB25063B8C45027027382D9E3B5B68CEAC28187CB8B9A0571FC53831FB7D9B9D67458
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293699727264388"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{500CA0B8-A403-498E-A8CD-F498B9790CFF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 5008	1636	msedge.exe	88
PID 1636 wrote to memory of 5000	1636	msedge.exe	89
PID 1636 wrote to memory of 2536	1636	msedge.exe	90
PID 1636 wrote to memory of 4424	1636	msedge.exe	91
PID 1636 wrote to memory of 2536	1636	msedge.exe	90
PID 1636 wrote to memory of 2536	1636	msedge.exe	90
PID 1636 wrote to memory of 4424	1636	msedge.exe	91
PID 1636 wrote to memory of 3568	1636	msedge.exe	93
PID 1636 wrote to memory of 3568	1636	msedge.exe	93
PID 1636 wrote to memory of 3568	1636	msedge.exe	93
PID 1636 wrote to memory of 4832	1636	msedge.exe	94
PID 1636 wrote to memory of 4832	1636	msedge.exe	94
PID 1636 wrote to memory of 4832	1636	msedge.exe	94
PID 1636 wrote to memory of 4188	1636	msedge.exe	95
PID 1636 wrote to memory of 3448	1636	msedge.exe	96
PID 1636 wrote to memory of 4188	1636	msedge.exe	95
PID 1636 wrote to memory of 4188	1636	msedge.exe	95
PID 1636 wrote to memory of 3448	1636	msedge.exe	96
PID 1636 wrote to memory of 3448	1636	msedge.exe	96
PID 1636 wrote to memory of 1992	1636	msedge.exe	99
PID 1636 wrote to memory of 1992	1636	msedge.exe	99
PID 1636 wrote to memory of 1992	1636	msedge.exe	99
PID 1636 wrote to memory of 1568	1636	msedge.exe	100
PID 1636 wrote to memory of 1568	1636	msedge.exe	100
PID 1636 wrote to memory of 1568	1636	msedge.exe	100
PID 1636 wrote to memory of 4880	1636	msedge.exe	101
PID 1636 wrote to memory of 2488	1636	msedge.exe	102
PID 1636 wrote to memory of 4880	1636	msedge.exe	101
PID 1636 wrote to memory of 2488	1636	msedge.exe	102
PID 1636 wrote to memory of 1748	1636	msedge.exe	104
PID 1636 wrote to memory of 3340	1636	msedge.exe	110
PID 1636 wrote to memory of 3816	1636	msedge.exe	111
PID 1636 wrote to memory of 3020	1636	msedge.exe	112
PID 1636 wrote to memory of 2576	1636	msedge.exe	120
PID 1636 wrote to memory of 2576	1636	msedge.exe	120
PID 1636 wrote to memory of 4144	1636	msedge.exe	122
PID 1636 wrote to memory of 4144	1636	msedge.exe	122
PID 1636 wrote to memory of 2272	1636	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\blogs\5-tips-to-keep-your-teeth-healthy.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbd12cc188,0x7ffbd12cc194,0x7ffbd12cc1a0
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5874349833774764105,4795241025015594492,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7984135329683429325,9493938363637586006,262144 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,8940699841609321582,2965809028309301164,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2874629507885937741,15937293518883631231,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1837652705393917307,17730989616157878385,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8046673883424346419,16781666030948697975,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,16026838852165953963,131569705329589393,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5124,i,15660780776720176781,6435947181675235522,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,7254789346764027342,9884209870679074609,2097152 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4773042913979568851,11371620529417291420,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15940485098971423756,3166453854920896014,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,10141531551527113373,4745896919612709743,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,10141531551527113373,4745896919612709743,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,17552696442997673719,3220622425643179047,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8403623023332500734,15494454120037885438,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17390027915298513075,8491990773687322883,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16389208163851302140,1068142646424960012,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3050104649101091662,17040513093648694950,524288 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,13890779433974640563,6652548847325537919,262144 --field-trial-handle=2476,i,8119188193818441516,7800270720313585984,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

7de69f2b-a4a6-4c88-9d65-5d7cc8398d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7de69f2b-a4a6-4c88-9d65-5d7cc8398d45.tmp
Size 12KB
SHA256 32437ee9cb96fbc73911594493d03c64bc64cf894bd9c903653b20eee8486c77
MD5 743d8a07bc056dce7d3138d72ca32a52
SHA1 1b5801b5f8fc81e1ad507dea9d7f69edd5d10bae
SHA512 c720487e76da9d57300c9ddb3c139a8125a490489b2478087425947c0afa3457fe7094467d7f93c346d4d4340e381459b5320c9264a66f40de229cfd40809f74
SSDEEP 192:sxZIReyM/jK1Ml8MkP/flsDi872Idpd4HW6+WNGYzQJJ+OIgrJ:sxZIcMP/flsDi876HbGf99
TLSH
T12542C6166A34997BCCDBD209FA55BF53D6F51473E2940E44A9FCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f9c9507-92b7-44f8-956d-cd68fad7c904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f9c9507-92b7-44f8-956d-cd68fad7c904.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b034e2b9500805943fe2aba501f957e484a2930d8df411717fdf083f453929d9
MD5 b76f8d84cc2570585c55facc166e08bd
SHA1 acd90200ee3460890fe7ce531cf956fb2b1bf2e1
SHA512 04220948986dcdd0e73c77eb91ad4d8c7d9f30a13993ea85c566f316860cf69d388c0f37ef96ce480c2502bef02fd9fb868c3cd9d9dfbe88877634bf7e34c98b
TLSH
T1E871A6F54279489DFB69DCB070F181023530B9F9FCAF2E9681D0EA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c6c6.TMP
Size 3KB
SHA256 9a5d366bf4d6848077e8f0cc729d806c0b5c17a729dace2a4045bde88cff3420
MD5 d49ecc28fd114a5ce8b3504e7a1ff1a9
SHA1 6e7dacad4ca969551dee6a89fcb0e9d016f74dac
SHA512 e1e3c0b6f9ee31a8ecaee7262a218853f8dbe2c32211455d4c85769df0fadfb4faa094be0a2c87723d0541fc990222e45ec97c753ab43c62d8600e4ea6bc52b2
TLSH
T1AA71A5F54279489DFB69DCB070F181023530B9F9FCAF2E9690D0AA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e2f57027feac8061e3fdfca0781e5ed07936376589ba7b20ecdbc8ee8c26753a
MD5 87d67b5790972b518d53f958bf729bf9
SHA1 6421249f36c2de05dcd1a91db9970e0ed82b34c9
SHA512 a0ca5be7264c09f6d2a4dc390338a5fd546473aef7b134333d0277b7c4b88e7edb8c409727cff9b188727b6680f6c984f16ee8f19bac495606ea94a865f3e0fc
TLSH
T1FC517BB7C2E9876E881112F0AB247A2ACD5D055A82683C668DF5BF4F63E14B0D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92d20316f4e6e88648c4087912e002e55c354b2a7e4c1a49b1eaa6f76145fa1a
MD5 a51edc7ed53c51b04cf5993a74444744
SHA1 62ae9a0787c62f5461f41ce1737a35d9be781035
SHA512 0d8af46142c4f4cf85f60a32136f23eb41e55507a09db22032df7dc4d7b1cd5a1270a51450207e395578d84f0eeaa2745e9ed1aad4c233ba5b777b0aa34d227f
SSDEEP 192:sxZIReyM/jK1Ml8UQQkP/flsvit72IdpH4HW6+WNGYzBs8p+OIg5yJ:sxZIcqjP/flsvit7YHbGA98
TLSH
T15952C516AA349977CCDBD209FA45BF53D6F51473E2900E44A9FCCA0C01E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 356113e6798ca01702c2a3ec3bee5f45bb90babb410a4eac865730ef1cda435d
MD5 ebfada44f543be6b1358bd23b8d1b009
SHA1 a2ba8eb3629c6e00315c9eb67abf14373c66ca6a
SHA512 50d355e76176f5ea56747f50dbc334b27c06a0ebac56cb95ae7da259867a43d36ff8767207d794d827dfbe7d3d9230555ad57504953887f2d3072e4c0aa1ee67
SSDEEP 768:J8W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjCroIP0HYB:J8W7kf0Wvqinau1jaa5LA3jZaB
TLSH
T168E20B3B684CCB7E4F840E5CEC266F966ED801CB66988D5447FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5f20ae7260d3c3b50000032ba284cb5ac7f7ac4f66be882d7912077d54626c93
MD5 fdeafd89147dbed9dd92fde35e801fbe
SHA1 1fc204c3461ca60b75b930af1256137ab5d7c017
SHA512 68070539e2ea6cd98dd0798a4b686fcde3e4a3607bcbca9878e5348b274b004d01594f4837b93731065e0f0e586a3b3468679f5af20c19c5522c9b623bc58a31
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTenI1K0k4Py1zIhKM4M5LKJlLZ5xQFAsI7W:KIbCKcenWK0kymzuKM4TY5
TLSH
T128916202317B0681387E284992A696379F4671533818A9FF3BB450A21E76F654DFFCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3257a0ffe19b91e79ec2c419c96d8aa2a99f36fbc5d1e27173fa11999e327769
MD5 0ebbb84e9fb39910181718166b75e459
SHA1 32693c163b573426ff9b11d69a103a4c89691ecf
SHA512 81e508cd4d754b131ed04bb831b45722a992c7d32bf61f2f1511fb740a5aed176dc9be3baa4826e935b87b6a69ac3462a9953bf4fd18d3073614ccc2b3946696
SSDEEP 384:KZcIhsNRUoUbQgcktdKR+29/VOObjI9G6w7f9:ohTIUwl1V29Mf9
TLSH
T1B6929E325C358D3769A6A111F48A3A175FF8917BE7D86B40F2EDEB0C05EA5AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 599aa67c9d895bb1a9bec1f4fd120a8615c9a61ee618e6239223bf556ee6ac47
MD5 a12a267cfad3bf562e967376f995c3ce
SHA1 02788fd946914f4bab24bb04f3f4f74866c9a707
SHA512 22fa2d6b2a8863ff5b481c35810a609b27b330c177f8888d133b3c948826fe5c6407b77f8afdb1a3db2e92a74dfa3e7fd7286540ed486bbaa4b68fce9f67f60c
SSDEEP 384:eZcIwzsNRUpUbQgcktdKR+29yVOObjI9G6w7f9:cssIUwlEV29Mf9
TLSH
T1D6929E355C348D3799A6A111F48A3A175FF8517BE7D85F40F2EDEB0C05EA5AC130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6ba08359f82cdcc656b387acbdc91e26f5bafff1af69efd550037dc7e11a475a
MD5 43f6512cd89c84301b3c6bc375baf9e4
SHA1 e58e0cf6a9eef19d309a91aed86e0570b970ac65
SHA512 f395483b0112082502617b2dcb582b8300543a50e25e820497bee691fd1ccae135124b7029d25c6066564ba4d6235a62908a49255272db2a33f86634e984f375
SSDEEP 384:cZcIhsNRUpUbQgcktdKR+29/VOObjI9G6w7f9:KhsIUwl1V29Mf9
TLSH
T12D929E325C358D3769A6A111F48A3A175FF8917BE7D86B40F2EDEB0C05EA5AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc7747172069e34e9403f529beb33dc65ffc48c738605367eb3e01633004bca8
MD5 c5973795cb474feccd0ebf3199bab6e5
SHA1 b7ca3586bcf41044493f71ee175ae78a5b327afe
SHA512 653dbdb0beca3455da05b88a81ce20b70930c5f8547a29d457cc63c168d3da4b32653d7a32b21e17bcfd914b84a0c156a86ee558609aee9480060f79cf4aface
SSDEEP 192:MONG64BAQmiUyB1CW5GBPKp/+FdG7BvaDvCdU6:MONG6eAqwWOdKCKdU6
TLSH
T16A02FB35AC796C7B9EA2AE45F58637175FE8113BE6C42B44EAE85B0C019774C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0bf8cce56c9574880f993f95839c2cc27344cc9b92820743db673aa98660492c
MD5 40c154f3688aa313cd55a6f03b6d6c08
SHA1 78f09d8a5e55871a2f5ef9e9c5004ac9e345a2e5
SHA512 62f0aca2db05d71566d974e0ec3db6ac076bee4ab3f165e6d921b1dd080695f5c74cbaaa7b63c7fdba84d846ea7c486952b191d6180350890932603454fb3773
SSDEEP 192:CONb64BFQmiUyaCk5GBPKp/+FdG7BGc+29AWwpqAU6:CONb6ejakOdKR+29mVU6
TLSH
T11E121935A8659C2B5EA2B145F48736175EF8413BEBC57B80F6DC6B1C01EF65C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e28a1ec2725b5792303407a1e4b05a7d8a38d34c826a1fb1340e6a95a3034788
MD5 9827df8a7eaa8e51c07c3e841be97976
SHA1 6c6931d3923012dbbefd965a36c72b3fa9377d29
SHA512 4790be36c6cbfcbc53c978e4b920b0495b298fc5fd5128d7069e136d71bebc1245f4777f2996173138eea58bec469efa966f5e0f3fdf94b8b868f30d97117a50
TLSH
T18741174CBAF92158B3B76E1A5BF7A96D447EBC772F06C49D00110E4E0662A40D871777
MD5 SHA1 SHA512 TLSH

Submit Download