hxxps://protect[.]checkpoint[.]com/v2/r02/___https[:]/click[.]web[.]nos[.]pt/?qs=8b4ab52da7b344f8a223260e39bfc9fa3d64d53ed41df705049dfc76934a3b2e5b44eb5115f4e230711b52bf871824f8518e20a33c241f80ca5ce04b152a2aaa___[.]YzJlOmNpbXBvcjpjOm86ZDdjZmEzNGI2YTQwN2E3OGIwOWEwNjU5MjM5NTk2ZWI6Nzo4NDk5OmM1YTIwYjQ5MDdjZGNkN2ZkMTU0MjRhYzFhNzZjODRiZDk1YTE3ZmU0NmU2ZmUxMTQ5YjZjZmNhZjAxZTY2NjU6aDpUOkY

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://protect.checkpoint.com/v2/r02/___https:/click.web.nos.pt/?qs=8b4ab52da7b344f8a223260e39bfc9fa3d64d53ed41df705049dfc76934a3b2e5b44eb5115f4e230711b52bf871824f8518e20a33c241f80ca5ce04b152a2aaa___.YzJlOmNpbXBvcjpjOm86ZDdjZmEzNGI2YTQwN2E3OGIwOWEwNjU5MjM5NTk2ZWI6Nzo4NDk5OmM1YTIwYjQ5MDdjZGNkN2ZkMTU0MjRhYzFhNzZjODRiZDk1YTE3ZmU0NmU2ZmUxMTQ5YjZjZmNhZjAxZTY2NjU6aDpUOkY
Sample260730-m6ynzagc82

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298831271351907"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E570C1ED-EF69-4469-A146-91AD9537F9F5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
924	msedge.exe
924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3316	4216	msedge.exe	85
PID 4216 wrote to memory of 2212	4216	msedge.exe	86
PID 4216 wrote to memory of 3512	4216	msedge.exe	87
PID 4216 wrote to memory of 3512	4216	msedge.exe	87
PID 4216 wrote to memory of 3512	4216	msedge.exe	87
PID 4216 wrote to memory of 4932	4216	msedge.exe	88
PID 4216 wrote to memory of 4932	4216	msedge.exe	88
PID 4216 wrote to memory of 888	4216	msedge.exe	90
PID 4216 wrote to memory of 888	4216	msedge.exe	90
PID 4216 wrote to memory of 888	4216	msedge.exe	90
PID 4216 wrote to memory of 3164	4216	msedge.exe	91
PID 4216 wrote to memory of 3164	4216	msedge.exe	91
PID 4216 wrote to memory of 3164	4216	msedge.exe	91
PID 4216 wrote to memory of 4052	4216	msedge.exe	92
PID 4216 wrote to memory of 4052	4216	msedge.exe	92
PID 4216 wrote to memory of 4052	4216	msedge.exe	92
PID 4216 wrote to memory of 3352	4216	msedge.exe	93
PID 4216 wrote to memory of 3352	4216	msedge.exe	93
PID 4216 wrote to memory of 3352	4216	msedge.exe	93
PID 4216 wrote to memory of 2080	4216	msedge.exe	97
PID 4216 wrote to memory of 468	4216	msedge.exe	98
PID 4216 wrote to memory of 2080	4216	msedge.exe	97
PID 4216 wrote to memory of 468	4216	msedge.exe	98
PID 4216 wrote to memory of 4692	4216	msedge.exe	100
PID 4216 wrote to memory of 4340	4216	msedge.exe	103
PID 4216 wrote to memory of 4340	4216	msedge.exe	103
PID 4216 wrote to memory of 4340	4216	msedge.exe	103
PID 4216 wrote to memory of 3448	4216	msedge.exe	104
PID 4216 wrote to memory of 3448	4216	msedge.exe	104
PID 4216 wrote to memory of 3448	4216	msedge.exe	104
PID 4216 wrote to memory of 5044	4216	msedge.exe	109
PID 4216 wrote to memory of 3804	4216	msedge.exe	110
PID 4216 wrote to memory of 2604	4216	msedge.exe	111
PID 4216 wrote to memory of 4388	4216	msedge.exe	120
PID 4216 wrote to memory of 4388	4216	msedge.exe	120
PID 4216 wrote to memory of 3232	4216	msedge.exe	123
PID 4216 wrote to memory of 3232	4216	msedge.exe	123
PID 4216 wrote to memory of 924	4216	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect.checkpoint.com/v2/r02/___https:/click.web.nos.pt/?qs=8b4ab52da7b344f8a223260e39bfc9fa3d64d53ed41df705049dfc76934a3b2e5b44eb5115f4e230711b52bf871824f8518e20a33c241f80ca5ce04b152a2aaa___.YzJlOmNpbXBvcjpjOm86ZDdjZmEzNGI2YTQwN2E3OGIwOWEwNjU5MjM5NTk2ZWI6Nzo4NDk5OmM1YTIwYjQ5MDdjZGNkN2ZkMTU0MjRhYzFhNzZjODRiZDk1YTE3ZmU0NmU2ZmUxMTQ5YjZjZmNhZjAxZTY2NjU6aDpUOkY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb4ca6c188,0x7ffb4ca6c194,0x7ffb4ca6c1a0
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,10143268314619318483,1857282931222144191,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,141813214754531093,3690629028647585011,262144 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,16066546642957018834,10228453787518967801,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1863701713797718132,12857034935363978768,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13720453664932798084,8647406569836641708,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7643293821636987124,10015541059893737090,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,18216948640624251101,9481132095808142454,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15155719069425266681,6803635346827689830,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,18020913217901861835,16140419492164906706,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3202032257985084781,2871801326483603037,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3202032257985084781,2871801326483603037,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3632,i,7729921203937772376,12100986644813095965,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3536,i,4935161901895568249,2485995236864058774,2097152 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,7528288046483188681,2251347560173915008,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,1827788600890119456,8465846918660241754,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,16846947722706871294,15220131454147833918,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,10415877700633385010,16636422409356964996,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,16056214332136540690,7468687113797686000,524288 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,17452889141051994672,4256674346343503005,262144 --field-trial-handle=2220,i,13366865987307095751,424525369703714186,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

508bf878-7854-424f-94f5-3eaae7bc5fd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\508bf878-7854-424f-94f5-3eaae7bc5fd1.tmp
Size 12KB
SHA256 b1252716de1220731aba810c5309af8c8fd19102b85d1bdc67c4d9606b0acaea
MD5 341e5d31e45e0637bec474d661203b02
SHA1 bfa195a97178edd91a98266ae4e410c4598380f7
SHA512 2ff44e8c138d0835fdf2613350ef16dd78908e0eda5b8e9f432655b5e88d94789b70a10ca10af6b3ec024bf671d2543344f4ae001d48c2f20b137794dce69bc4
SSDEEP 192:sxZWRbyM/jK1Ml8MkzG/fMsa6VUVDsIdpJHW6+WNGYvx/qb3FxIgrJ:sxZWLMzG/fMsa6V61JHbGLbf9
TLSH
T1CA42E9166B34597BCCDBD209FA45BF53D6F55472D2900D44AAFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a61ce699c007e8fbc36cc3fa8ee9b8bb7ad4d7b70a94969f10bb84dd9f4c5f16
MD5 5c59c4ea894b965a78f3ac504cd65511
SHA1 42476401687d46c4c6d7778412b7bc7a06d43928
SHA512 cc0042f984c6b8ee1d7e87b0696c139e38c0c713617b58b2cdde7494460fecc89bf39edd1f310f4fef87529019868b475bcf24922515a3da2ec2908795be9057
TLSH
T118714CBE01162079D35080B9A2DD05F539F1ABEBF1163F5950E79CF27E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d85.TMP
Size 3KB
SHA256 9ed5ce5126cf5332fb1978c8284934bf442afe52e91d9ab03e44afa4a24e0f30
MD5 a407b66ffe3c677b70ba7338e8fb3c17
SHA1 fb793f86ecc8769998d0f9801858abebe0a5914f
SHA512 448ad53c5944cb6e8afea18dab87859e7cd76944f81df7c05cc9c73f91a1a7ca40fb08deb178317ec20dd6f12e93790ee581b055308e326a7e08b47846ce1cc1
TLSH
T124714BBE011620B9D31080B9A2DC05FA39F5ABEBF1163F6910E79DF27E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 871B
SHA256 05fd349b915dd9eff9f2d61b5609f0316d6e07b4fe9773472e7991195b32bc85
MD5 cd5a1afa2d854d790df4e959186c9807
SHA1 c69b3ee998f5c1c2b1f73607244a867be6b01a9a
SHA512 ab8a6a5a6f9797d8842eef7f15ddb627986a5c0dc90b5f5e91722ec20b967d3905ffb9479fcaf3f14d2040e47dfa3378ce9796bf4da63c23422b1b55c04aa4ac
TLSH
T12D11AFF7C3E5996E8B0092F0AA14AF1BCE6D0501835C7C6AC5D4EE2B93E3475E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e22f74421dc24eec609bd44162281ee0811865441aa8716a6499b5bdc5b71565
MD5 736b2654f38fc5b3030468af1f50796d
SHA1 805c5538d30ac43d488bf3d5741f166ae649e92f
SHA512 d133704d21a54e611e7475f029beb3b2ee0d5518ebf961fb127f3af8f63f289b47526de5a39c515a16464a1dfbb89e7bd321f1b8c7c1e4fbd00608e85eb57dc7
SSDEEP 192:sxZWRbyM/jK1Ml8UQgkzG/fMstGIUVDsIdpzrHW6+WNQhG/YvaiLb3FxIg5GJ:sxZWFqzzG/fMstGI61HHb//sbfk
TLSH
T1B552C716AA345977CCDBD209FA41BF53D6F55462D2900E44AAFCCB0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f0ee3b74f9155f02f9e75b1fdbaedffebf2109f4b24dee30614e8cfc28fccd1
MD5 2982824b541ad34440a3ab1c4decac5c
SHA1 7ef1c1c38c9d6d725fbbcf248ef603f381807cbe
SHA512 f11f927ccb449ce614e0798362ac4bccbfb4b40362ec6fe283b45bc09f2ef8d29b22e0c2198ab6514eaa2ba4139929ca59123d6fa32bfb8af1e95e4ff1c9394c
SSDEEP 192:sxZWRbyM/jK1Ml8MkzG/fMstGIUVDsIdpZrHW6+WNQhG/Yvc9qb3FxIg5GJ:sxZWFMzG/fMstGI61pHb//Ybfk
TLSH
T1E152C616AA34597BCCDBD209FA41BF53D6F55562D2900E44AAFCCB0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 76a2db3caccd7d79a12a86ca236894b38d4cc6c123d57a66a9a008fec69d35a6
MD5 102f93526c7921ad0ec8fb54f38398c2
SHA1 1f5e5843254b74721b2b5cb219c0c826d90747a5
SHA512 11ad014e5807bacfc80c6415d14ae8226c6e2264a6887e0bf9c232806376df46ff37c77758abce82a6bf3d9e7cdf289f05e123c7cfd338852685aa9c62c87d7f
SSDEEP 768:wqseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppProA3:wqseJ3xWvhfynu1jaVcL88pcE
TLSH
T1CED20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fea517835a55a4f2f28eb6a48ffb9a0c82ac78af443dc2301d4c7e7b43687d58
MD5 4326d1fef2b100053434d5a6e4ae94c7
SHA1 3c8f16110643f2df178df1790071823ba71cdca7
SHA512 78765d16106f9a029c7758e90d8c32a6794955df45b1c98c41c34c3913c63a75ad46acbb523945b483d953ef44610afd556829fb5a2b140acfee6be2355595d5
SSDEEP 48:KYHIhKggkXyhWIPKvKY/y5mIPK/aU9sJgz:KYH+KggmSWsKvKqqm4K/aaz
TLSH
T196912706743B12023DBD244CB2A1A53B8E5135E37458B8BFBFB814624E66E111EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592a71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592a71.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bcc9b5ec13d5ab215d33fdcf920d4efda7ddfa3a8c54cfe20120080cc46689f7
MD5 55dd50e30edc396e2ef555ae9728e75c
SHA1 f484e97ad0153fc22667a1c69cb5420bfbcf40fe
SHA512 f8a694f47276fb656d5823931a44163ecdac1781ac4f0df675484a470d42529ae8603c98162ef4ec63dd3ca12f6b7c89e6a6a4dff5b180436cb3486806eee32b
SSDEEP 192:uMxm+xasuheOwQxMGsNCCSQqawiUFUM7dltVQmiU1ILIKS24MTc/CsbLU8z1tJqd:zSZcIhsNCCSjigN77tzeMKSZimLVt0FR
TLSH
T1F6626D76AC788C3A99E7F141F48A36130EF4906BE7C89B40E5ED6F1D04DA6A81317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb4691379d088096f652c1baba0a7554d80705196dc2e2e81f67b26c510e8941
MD5 83b52c670e188d9dd6309e777beeb5f2
SHA1 7a06f3b8034255ef276cf19e46c8efe1c8f3b451
SHA512 0fa50f5f3dab41e35d09be1851fc42d559b8740a8f15ff9099f7dfbc68d17e77af46dacedd8eeb72bb11cd1abe8e3b08ad4b76269da742af9a04fd008470bdae
SSDEEP 192:lON56vMtPQmiUyISINThTc/CA847thpWU/u:lON56UtRF9NTh6tLWU/u
TLSH
T11A02E839AC785C7BEAA7AD45F48A27171FB421AFE6D05B50EAE82F1C00D764C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 c1b2eff77f59f677d45d7d0c90067774b9ac5342df3c7d6f5cf9c781bda8420a
MD5 49e270a44239c3a8f33a07ea9e3e91df
SHA1 fa9db0067011eae39e033ceab19b499c38c96323
SHA512 845b0671f00604f8fdbd2474e4d3713400e9e1d56bb84fb21d2a8794c5d83ed013eef513b8aada3a6f8fb058324bdd559c8a7fb429be748e6a535ea1ff7e0d04
SSDEEP 384:vYiFiZcIRzsNCa8TUNTUlIlDjigN77tze/KSZimLet0FR:rFQhYwgFNNJmLeGFR
TLSH
T1AAB209F658D7883AD9AEA743B77D2E024EBCC067F5849650B3D85A0CCC961BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fb9f380de973e83481a98bd0af7803bc35d39aa2ae18cb764cc4029d7a3954e6
MD5 b218297b92da928ca72dd39393e60838
SHA1 91b6cd0a1dba07d4c71a32178feb4739a939447b
SHA512 474b174bf3b2fc8c0751016b66619485c2128b2f620e80d37cc3b4c9d2b44bdef3f9b6ceecd56b84bfe359b4b8700b2ed1ab60fd9c9febe7abf8a0accee20ee2
SSDEEP 192:ucxm+xasuheOwQxMGsNCCDQqawiUFUM7dltVQmiU1ILIKS24MTc/CsbLU8z1tJqd:3SZcIhsNCCDjigN77tzeMKSZimLVt0FR
TLSH
T1E6627D76AC788C3A99E7F141F48632131EF4906BE7C89B40E5EC6F1D04DA6A81317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 054228f3d13a2a9707998347c9de802607ffb43481379629830b8de805a0996a
MD5 feed0936abe260794e814411785f054c
SHA1 8ae91f58d1b1c8a8e7ec661810b5bb4ad5e44597
SHA512 ae1e0ce45d0411ecaad49879280bb126e1ff7b60b396c00453b71757915dce0b122dc5522c2749decf6b163fc5951a0fbe82988a06d36cd784900edbc9e46b6d
SSDEEP 192:SzONu/6vMXtPQmiUyIaINSbhTc/CsbLG80ItJqJU/u:SzONu/6UXtRFVNSbhmLft0U/u
TLSH
T157120976AC689C2BADA3B441F48A32171EB5916BEAC49B50EADC2F1C01DB65C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea314731-9e6a-4ad9-9581-f7cefb723656.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea314731-9e6a-4ad9-9581-f7cefb723656.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1138fdd8946cffef107de936961b724bb939305f8df65a07cedea52420e50f2a
MD5 5a3b415bd071fdc725a2f38eaedea4f6
SHA1 f270711d363d4817bc112a3fa7de9e9699039e53
SHA512 ce229aa31cd950f697f4cc113019bcb64dc18bcb578a54e669acbeca7c1af897d923816bf9069e80c4c950102adf1c4d2d275fb0bb712663b850f63618095576
TLSH
T1E1412598B6F91148B3B76F5AABF7A56E48BFBC372E06C49D00110D4E0662E44CC62737
MD5 SHA1 SHA512 TLSH

Submit Download