hxxp://svappiis05[.]filiales[.]local/SAM

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://svappiis05.filiales.local/SAM
Sample260724-vc3d3athrd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293854982692308"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{3CC0A0A1-4D1E-4E7D-84C0-C388107066A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1700	2624	msedge.exe	85
PID 2624 wrote to memory of 4876	2624	msedge.exe	86
PID 2624 wrote to memory of 4344	2624	msedge.exe	87
PID 2624 wrote to memory of 4344	2624	msedge.exe	87
PID 2624 wrote to memory of 4344	2624	msedge.exe	87
PID 2624 wrote to memory of 1116	2624	msedge.exe	88
PID 2624 wrote to memory of 1116	2624	msedge.exe	88
PID 2624 wrote to memory of 2628	2624	msedge.exe	90
PID 2624 wrote to memory of 2628	2624	msedge.exe	90
PID 2624 wrote to memory of 2628	2624	msedge.exe	90
PID 2624 wrote to memory of 3000	2624	msedge.exe	91
PID 2624 wrote to memory of 3000	2624	msedge.exe	91
PID 2624 wrote to memory of 3000	2624	msedge.exe	91
PID 2624 wrote to memory of 548	2624	msedge.exe	92
PID 2624 wrote to memory of 548	2624	msedge.exe	92
PID 2624 wrote to memory of 548	2624	msedge.exe	92
PID 2624 wrote to memory of 5044	2624	msedge.exe	93
PID 2624 wrote to memory of 5044	2624	msedge.exe	93
PID 2624 wrote to memory of 5044	2624	msedge.exe	93
PID 2624 wrote to memory of 2876	2624	msedge.exe	94
PID 2624 wrote to memory of 2876	2624	msedge.exe	94
PID 2624 wrote to memory of 2876	2624	msedge.exe	94
PID 2624 wrote to memory of 4996	2624	msedge.exe	98
PID 2624 wrote to memory of 4996	2624	msedge.exe	98
PID 2624 wrote to memory of 4996	2624	msedge.exe	98
PID 2624 wrote to memory of 3800	2624	msedge.exe	99
PID 2624 wrote to memory of 3800	2624	msedge.exe	99
PID 2624 wrote to memory of 924	2624	msedge.exe	100
PID 2624 wrote to memory of 924	2624	msedge.exe	100
PID 2624 wrote to memory of 1220	2624	msedge.exe	102
PID 2624 wrote to memory of 2628	2624	msedge.exe	103
PID 2624 wrote to memory of 2628	2624	msedge.exe	103
PID 2624 wrote to memory of 2628	2624	msedge.exe	103
PID 2624 wrote to memory of 5044	2624	msedge.exe	120
PID 2624 wrote to memory of 3376	2624	msedge.exe	121
PID 2624 wrote to memory of 2500	2624	msedge.exe	122
PID 2624 wrote to memory of 2668	2624	msedge.exe	123
PID 2624 wrote to memory of 2668	2624	msedge.exe	123
PID 2624 wrote to memory of 2668	2624	msedge.exe	123
PID 2624 wrote to memory of 1756	2624	msedge.exe	126
PID 2624 wrote to memory of 1756	2624	msedge.exe	126
PID 2624 wrote to memory of 2232	2624	msedge.exe	131
PID 2624 wrote to memory of 2232	2624	msedge.exe	131
PID 2624 wrote to memory of 2232	2624	msedge.exe	131
PID 2624 wrote to memory of 3576	2624	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://svappiis05.filiales.local/SAM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,916315501360648410,9306349873057070694,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,13532047548836680648,1821407956473877242,262144 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,15207160224025920024,3246038424302563070,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10513539639446284278,9944142673284667266,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,9923192883463014332,3067430414721689783,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,5536450994747609207,5634582546039742130,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14304512939443849142,2823266732628627457,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,9578468602045551973,9198624438398449558,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,17748150906266473285,7397982316867726414,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,8995520309829040152,15059596039163689178,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,11091321922357113271,6588030683813514635,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,2272855038372527063,1725276259040126857,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,2272855038372527063,1725276259040126857,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6284,i,11229334095505880468,15170259872182177891,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13466938472833751582,13821154444334084440,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,13219396586014373224,5034914041414729965,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,9354569288723385716,17637025270375635469,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5208,i,8862339177891058304,15513005228155208766,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,13409768364286563953,15476731857374258557,524288 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=1700,i,17331275794669437241,11219289927071982003,2097152 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5128,i,7360059726398639705,1366068234419879787,262144 --field-trial-handle=2384,i,9461539760394270354,17620997491678450956,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 627a046d5e32bd1b8f3ea851dc7fe9374e5f0cc3b02acb7e6ff47ee1f8fdc23a
MD5 50c9e6e93d84c84f4d7081bd283c0b01
SHA1 ea56138c29cd224811db6450a9aa07945b90e694
SHA512 2ebf6a96756df489ea25bb50f4bd7cb18c680db3681536cbaa5c163e19fc98940ca748681c7bf21ba6cc60c99845fa5ed601d8928034f0642a466dad6de73c7f
TLSH
T1E171A20B06693E95EFE715B0F3ED420D38F283F50D632E661DACD83D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590342.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590342.TMP
Size 3KB
SHA256 c032eaf9a5b825527228f0398ed08e419e28cc929606f06f60e1469d013ab94a
MD5 fa3535b4bff7bcb86774893850889018
SHA1 711f9a8e16df2b9892c4b13947dea2496c387e78
SHA512 79789a0f749cb360bec4b70b8bb95d882c5d649dae8b979d412308ddfd6cc0229967ee256441087822ba4d017f900903f054eb2bb579e4489c2863e67130b082
TLSH
T10E71910B06693E95EFE71070F3EC420D39F283F94D632EA61DACC83D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f56cf0f52a6dcd30050282450c422940f7dbbc01d2435d77eef5f8ef40d94e2b
MD5 65abba98196b2a350013ff1baff8b315
SHA1 47adcded94ef45ddba2605cea9a968e0718e95a5
SHA512 4abae1dd3be56977ab2684e6d68bd80a4c4edaa4292c03f299ebd81cf26058f8ba6830cc29c6a3b1012123e80fe3db6c57283e6933e863a5d08266d4865f0be7
TLSH
T13C117DB3C3D5856E891516F06A24AE1BDE1D0506832C7C59C9D4EF1793F3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 542eb37a2c552797bfed80f3534c4841cf13546283c329c98882d763863b0538
MD5 d3f55e333625da1f9182d8bbeac49c9f
SHA1 ad8e55fa62a00610d5188f1289f8372f204391f3
SHA512 41a58984a226a95f1ea2e3e1f0cef38e6ccd76782cb26ff46b77cb3603bda3199cb7281b00b6220f96486bdfbb8019da45129dc50754e32099e252c01eb43c94
SSDEEP 192:sxZzHRjk//fGsEUCIdpYxHW6+WNGY4wdH3IgrJ:sxZzHu//fGsEUr8HbGa9
TLSH
T10822B6166E78A5774CC7D20EBA25BF53D6F95072A1D01E48AAFC861C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 687b2dca157ff6dcab870f777bfe4a32ad10341b30cb400f2d451b3887841632
MD5 62f951fb658bb71ed16e5247a29f6cbb
SHA1 76a8c9d80da3e08de1676de6ab26c243c4df7776
SHA512 3939d7da0457a7e5a56cc9d515765446d9837c504b6bd61c626bc1dc6a2ad337868ad44828359f78a45a5b15fd53a4828fc186d97a258d932848ea370d9cf499
SSDEEP 192:sxZzHRjk//fGsAUCIdpYxHW6+WNGY4wdH3Ig5OJ:sxZzHu//fGsAUr8HbGaI
TLSH
T1D822B6166E78A9774CC7D20DBA25BF53D6F94072A1D41E48AAFC961C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 71faddbea254209d3bedc47c05479492a835feec9d852ad7c3ef9f15909875df
MD5 5460e0ca44772a0fd501b790482cc62f
SHA1 147afdfa920b32db516f86c9afdc16bdf4760a5e
SHA512 56e8df2645d33da4ca74f97caf0cd0fa8014c433d947d5279fa91621f88d135af9d8460cfcd1eca493eb12e4f44b06dcaaabee4bd093f6e757d808a750e268ce
SSDEEP 192:sxZzHRjk//fGsAmCIdpYxHW6+WNGY4OdH3Ig5kJ:sxZzHu//fGsAmr8HbG6y
TLSH
T1C822B6166E6899778CC7E20DBA15BF53E6F9507291D11E48A6FC8A1C05E7BCD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df59fc82beb1d9bc1fac2bae98404d8d039cb546d15ac0490db1276bb8ba5daa
MD5 cc6707e935d00713d51c2373aed72c29
SHA1 4d7bea24f9214182a17129d92ef50e8268345238
SHA512 b92b16974a2c8a9fabbb0cec23ed7c1f0111002a82e9b6c5f59ec59f070570b1661702622b79f007a87e3d5a2f8df91ba7916b51a449b0e620f1489afbad8f0f
SSDEEP 768:iNqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opT9roofUnt:iNqirTNWvx7jru1ja5ALocT28Ut
TLSH
T17EC2EA3B640CCB7E4F801A9DEC5A6F973EA802CB5B548D4087FA994C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b97a701ace708f74c88f4c4a5b32de2cf46d7d11172c9fb4584dcf46b991fff6
MD5 99f0661f633bf334ce6ee34379897056
SHA1 5fef55b8d94e00d223ab2c0d7722067b63c18fa7
SHA512 d1174d02f56f3dffcb8c1fbf2b0ac80907000e6ce94465f7f2ece6a8e2467d7fede29dde9c413da41a27d3148c1725e740e7f7946d4c0be42cfbb91e8b3022fe
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGMRuInKb6AryK:KEIgK9WK6A4KBGquMKb6+R
TLSH
T18491831231BF02032D3E2648E65197275781B0AB315CB42B7BAD41724EA7E215CFDEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599f72.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599f72.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 01c80c21ee9654b9a05459ae0cab5b653ea44bb574097c12de88f5b681dd0d69
MD5 d30fcef6f6018d81c4123a14b50a17bf
SHA1 6994469e4e2546b8dc0798bd7e5498f50b897ee9
SHA512 7bc540dd6ed3c74f2930c8ec120c7f6f011f0292a833a66a1336f9253cd5b9e17580e469937ee4f90866dec76d193c47ddeef5d4f4806e43a52a40085ff69b2f
SSDEEP 192:utQXm+xasuheOwQxMGsNzSQGezzmuHQmiU1ZjgLdh4k03NoeNgLIlqQOOZljYRHB:MZcIhsNzSgGC0dOkvMdtOObjI9G6w7cV
TLSH
T124929E369CB85D769DA3A921F4CB3A278FF4C077D7C81F84E1EDA71C05DA5A80306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 791d1fc435bd376a309983b3363697faaa7089e5c8af7e074cfa7655dc0dd23b
MD5 ff568148224724572fb8fc86085bef91
SHA1 0b3cac770866bc5ffa4be84d8ebd316ab3f5a0bd
SHA512 38a8735951bb23ef6be7ca9b88dc986aa40f799b3cb5cc551282ac4bdd38059e458c9174335025f952ecf36b008fcb648c9dba7c2fbef54150ac267c83193de1
SSDEEP 384:ciFiZcIVzsNN8TUNTUlIlHgGC0dOkvM6tOObjI9G6w7cV:HFQtswgjXt29McV
TLSH
T148A27E339CA4897A9EA79E51F58A36278FF58077C7D4AB94F2DDAB0C009B5DC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6cd330fb1715b524723501b9fa77bcfcc0007f2eab820ba1f062576f71c7834c
MD5 91de84606ae2ce3bbbc862c82b878ead
SHA1 a1342243b838e172bdc072b90b077c648a0e2a40
SHA512 3b4c99879a2217f180efe39489aea115e060451c74528ad0e9823c2e018d387fdc7c77346ce37fa3da74dc36335f0d8ef8c8aabb5693471d73f0c6ab578ea9b4
SSDEEP 192:u7QXm+xasuheOwQxMGsNzHQGezzmuHQmiU1ZjgLdh4k03NoeNgLIlqQOOZljYRHB:mZcIhsNzHgGC0dOkvMdtOObjI9G6w7cV
TLSH
T1C4929D369CB85D769DA3A921F4CB3A279FF4C077D7C81F84E1EDA70C05DA9A80306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1642e17a1c6b2d6bd7bbbd16c755ee5634723b6002dad05a3279dad4b9fac4d0
MD5 81ed23df9f16dae0d73f5d0b5c34ca60
SHA1 2dfb5f5aa75777bcc145c2c192ab071f4043ec23
SHA512 cab8e5dce212c62a30d7489083ada5307784e536b2ff269db5822468c3087a65da69b75bfb60be5348605af63dbf2bc89e4472071492f745412f6948335f71d9
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5ZjA5DnBhPwivh50xy0SFYK7Ax6YQ:gONc6kDfQmiUyZjiBZ903NIQiqEU6
TLSH
T10B02E9396CB86CBB8EE3AE05F48777275FA5103BEAD52F85D9E81A1C40D724C1742827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 835891da1f835c71f2087f4539c974e872e14b79e24c6dd0fe1f2da2163988a7
MD5 44a6b43d390610c4d807135dae0d82c0
SHA1 ebbb3b0fa9f1601bedfa01cf51fcfd45cbf16133
SHA512 482879d4fd0d6ae22c474610f70180b4fae70fa8d62355bee1c03c5b8a9a5f35a0ad8795c000f43d87377518f2dd1458e72f8cf1ee384e0aee362e193573ac71
SSDEEP 96:jqONkyQsjpfmUTnK5ih/cIPURHl8h4otop5ZjASDnBYPwivh50xy0SFYK7Ax6YLt:mONW6keQmiUyZj9Bq903NoeNOcRlqQU6
TLSH
T118123B36A8B8AC7B5DD36950F0873A235EA58127DFC96F85D9EC271C01DF69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b1b4a28-8836-44fe-a09f-7f08f527efb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b1b4a28-8836-44fe-a09f-7f08f527efb2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0bb0e2beb27be682a9c13d285ec865470dc5b8708ffa8c9c549e96f0e57fc72
MD5 7bac138f43894fd3d06e8de111ba74ba
SHA1 a64c6b5cdea9ad6da522c7bae6ed3b3e49717803
SHA512 63a82c6c542c504b6979d6ad22d22df954ad90153b216dcc6eec93661b1c8b936856ec6e1dccd8e5f7c5214370dfa7029fa083b92a78c3ddc1608810cae11733
TLSH
T13741095DABFA1148B3B7AF569BF6A86E487FBD372E0A956D00010D4E0673A00D861737
MD5 SHA1 SHA512 TLSH

Submit Download