hxxp://aprobat-ro-s-r-l[.]workers[.]dev

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://aprobat-ro-s-r-l.workers.dev
Sample260730-xry2aser6s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299119595626781"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{92EBF13B-AF0A-49A9-9546-C766C39178B5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2400	1320	msedge.exe	84
PID 1320 wrote to memory of 4444	1320	msedge.exe	86
PID 1320 wrote to memory of 2232	1320	msedge.exe	87
PID 1320 wrote to memory of 2232	1320	msedge.exe	87
PID 1320 wrote to memory of 2232	1320	msedge.exe	87
PID 1320 wrote to memory of 1944	1320	msedge.exe	88
PID 1320 wrote to memory of 1944	1320	msedge.exe	88
PID 1320 wrote to memory of 4980	1320	msedge.exe	89
PID 1320 wrote to memory of 3012	1320	msedge.exe	90
PID 1320 wrote to memory of 4980	1320	msedge.exe	89
PID 1320 wrote to memory of 4980	1320	msedge.exe	89
PID 1320 wrote to memory of 3012	1320	msedge.exe	90
PID 1320 wrote to memory of 3012	1320	msedge.exe	90
PID 1320 wrote to memory of 4668	1320	msedge.exe	91
PID 1320 wrote to memory of 4668	1320	msedge.exe	91
PID 1320 wrote to memory of 1060	1320	msedge.exe	92
PID 1320 wrote to memory of 4668	1320	msedge.exe	91
PID 1320 wrote to memory of 1060	1320	msedge.exe	92
PID 1320 wrote to memory of 1060	1320	msedge.exe	92
PID 1320 wrote to memory of 1112	1320	msedge.exe	95
PID 1320 wrote to memory of 1112	1320	msedge.exe	95
PID 1320 wrote to memory of 1112	1320	msedge.exe	95
PID 1320 wrote to memory of 612	1320	msedge.exe	97
PID 1320 wrote to memory of 612	1320	msedge.exe	97
PID 1320 wrote to memory of 612	1320	msedge.exe	97
PID 1320 wrote to memory of 4400	1320	msedge.exe	98
PID 1320 wrote to memory of 4356	1320	msedge.exe	99
PID 1320 wrote to memory of 4400	1320	msedge.exe	98
PID 1320 wrote to memory of 4356	1320	msedge.exe	99
PID 1320 wrote to memory of 4748	1320	msedge.exe	101
PID 1320 wrote to memory of 1076	1320	msedge.exe	103
PID 1320 wrote to memory of 1076	1320	msedge.exe	103
PID 1320 wrote to memory of 1076	1320	msedge.exe	103
PID 1320 wrote to memory of 1952	1320	msedge.exe	114
PID 1320 wrote to memory of 3220	1320	msedge.exe	115
PID 1320 wrote to memory of 3264	1320	msedge.exe	116
PID 1320 wrote to memory of 1556	1320	msedge.exe	120
PID 1320 wrote to memory of 1556	1320	msedge.exe	120
PID 1320 wrote to memory of 1556	1320	msedge.exe	120
PID 1320 wrote to memory of 2884	1320	msedge.exe	127
PID 1320 wrote to memory of 2884	1320	msedge.exe	127
PID 1320 wrote to memory of 3496	1320	msedge.exe	133
PID 1320 wrote to memory of 3496	1320	msedge.exe	133
PID 1320 wrote to memory of 3496	1320	msedge.exe	133
PID 1320 wrote to memory of 3932	1320	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aprobat-ro-s-r-l.workers.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x268,0x7ff97482c188,0x7ff97482c194,0x7ff97482c1a0
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,17304506444602059729,6450767463915527861,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,7461229711227098461,14755952287584828221,262144 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,5781244130701625117,17212622673531321420,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,11242378633111931029,6475554261326585708,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,7463057449813541803,2857447374983863421,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,16444898023963217880,1171671014789414426,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9806701537153548904,9402856650589410892,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,10552686268690375768,11411262412177482146,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3504,i,3203501006971822203,13740052823576442911,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,7494481152481099780,4387041819780456895,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,5227067655318461603,12794396873748868943,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7111437118582591122,1324509460060868460,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7111437118582591122,1324509460060868460,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6096,i,16386313685627016938,4774902000034740144,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,16396120552055363328,4366436346601716651,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,11452735888308974595,7116780273261643152,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,12819857626072948377,15245095086374620444,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3500,i,405525891595068293,15794488078093263041,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15621562249094733339,3616194865915722716,524288 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=780,i,10332711016416033930,14921265185528636945,2097152 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4428,i,8547544876310875441,15779081600432279865,262144 --field-trial-handle=2376,i,13840038040996357485,7227458943740451371,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 22cb9cac408f2b2316d33b92265ab3217eb97caae38cb79ddcc166da1c7eb0b6
MD5 bd14fa71f19fdd1a75fbb0af01050bee
SHA1 86a7ed9b24a60d9ab41fbb8e3fc3199dc3f40006
SHA512 122c3e965bb8ef77d9a1b793277aa8f2819cd030222bcdca9a124a0a80b8af18c8ab8826a2951622fddef651c172174bde792d4edb0a478e091f059bc1da024a
TLSH
T1BD61093802CD348DEB603D33ECC30000783195D8FA33AEF966AC687D7A01B1546D9E50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58994d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58994d.TMP
Size 3KB
SHA256 c7ef10ce9cf2b1228b966e69c9bb5c76f08af8c5afde44c356e716219aaf4aff
MD5 360f3a82fffdd410a14267d37d034fbd
SHA1 f850d2b6f1a4ff9056ab76e7f989e84d513b25d6
SHA512 93cd6592ce9232fc9f29f23891d4c26838b73d8e72940ed493271eb60cd24b4e11651f317aea71b771a1d3e2ef9284ce669d55e45d087480778be7adb6fdebda
TLSH
T1CB61F93912CE359DEB603D33ECC31100787195D8FA33AEF966AC587D7A01B5946D8D50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 58d4a168972ffc059009acd5df3809ee04df85f1c8a224d8e6b80c9aed03b3bb
MD5 9bf99e83d8c8f3ee6c2cff5d77ea5b24
SHA1 d8e74f0c5fa4028a978aa3c862aae0389343daf0
SHA512 9f190e465014f6da105dbe60a11ec49cfe61c5e7e9cc156166c57e8495fe344c3c3584f9286a33ddb5f1f0be3e47af663cd77d251255ad91350427e499d4f40e
TLSH
T101115BF3C3E5856E894557F06A24AE2BCE1D060583187C15C5D4EF2B93E3075D10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 701eabb71c5d3184ec75e58f417b3e0d5e1bf38372950740b6684c50001f0f63
MD5 e1eb9fe1e6ce157d2ad77db843e6ec1b
SHA1 45cc82bc00b65ed38f62bc5784ed7113c1d4bcd1
SHA512 350c6709d0f36b0d5b2347ce2506cfce3e890ef0f7e3f8bb68ee4563e599ce9a2dd039d5ef5d8e477b16af6b69b3c178cac49ac9b1fadce24c659ddb4e2bb916
SSDEEP 192:sxZlRAyM/jK1Ml8MkH/fis5GiaFIdpDeHtk76+WNGY9IKOyeIgrJ:sxZl6MH/fis5GidiHzGj9
TLSH
T19052D716AA385977CCDBD209FA55BB53D6F90472A3940E44A9FCCA0C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4711b0dfd28b2ffc8dcc95c39d72d96c668db0b9e4b1f1973ffe813bc7208e0c
MD5 7e942a09a4efd2b296751ef6f093bb2f
SHA1 a0a0ccd49565b327160af82276a9715cc5867144
SHA512 44b44a0a5f15b3209295900930593aa015f6c6120da0bba53dbbd4f51aee3a8e22ce98b0b9355dbefe784170f2b1df5491254b8890685c904b138d3dade23375
SSDEEP 192:sxZlRAyM/jK1Ml8UQekH/fis1GUaFIdpteHtk6+WNGY9Im4lBeIg52J:sxZl6q1H/fis1GUdEHnGkc
TLSH
T1C852D716AA385977CCDBD209F945BF93D6F94472A2940E44A9FCCA1C00E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 322a485cc06d1a1a658a2ee2b5ac8395193bd7cd7aa3c3b083a969671abedf9f
MD5 373728b229546c107acb9eaf04268584
SHA1 b18931c3ec233d354fd6248a5ecc0861c3881ce1
SHA512 ef5e09de4415f9c4c452b994b28aebbe58060785adcf8757aa6003dd5598456f3331ed0bb7428693f6308cd74c89e505d7bfb8346ed9fa845ce8a921153f9d5c
SSDEEP 768:SHcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN5roMg6TJ:SHcv21wWvu+Z+u1jaeFLeRNyMN
TLSH
T1E5D2F92B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 fd6d62b0af68b4e2dc36780bd70d35bfb522fcf605b9d424a744baeb3dd73b07
MD5 6d3fa694e1c3702be09fb01969e84ad5
SHA1 46c7ca183d46bc9c93b6f6583f41480790e30f6d
SHA512 dc0ad0ca8f3a01286d7d15d6e7219a6c315172d630b5b34280a586288e9982c51b9f504644d00d86762b85ffc7cb66b12f9b02360a8798966ab9c89e233e8d01
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDyeAKTi2+IQZC2QSyhjWD8B+hKZIBQh1YAZ:mTnDyBXw
TLSH
T198D13302313B02423CBE7908A262CA7B8E4231677818E97F7FB911A25E67E111DFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aafa8530-83d3-460e-9237-64b9a5a37513.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aafa8530-83d3-460e-9237-64b9a5a37513.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 09da37393eab054dde14142afbcde1db55d1e3cab05a989ec8c3a8ff9fb1c2ee
MD5 d08a9b1af2326fa2e4a3072a11f0a73c
SHA1 a9865a4bf0dbbe58d4c0c4fa2d1d2e94d71fb6be
SHA512 ff8960341fd6f0399c6f2753deb8536e979e893dfcf68963e82659f9eddefcf8ff33c22a7312597a82d20e89d8d58083821a1ca7be6e29c3009713104e1595db
SSDEEP 384:msNSv7zzihYge+C9O3+roS+2Kr4OObjI9G6w73X1:m1PnDFO3CLlKr429MV
TLSH
T120724A36BC384C369EE29265F44B3913AEE5507BDB892FC0E5D96F0D06DB6AC1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e27c5404dc811a14ba2f3a5170aa2ce491beaf2cb97430cd9763ab5e76a2dab5
MD5 df507ff1a94bca2297cdb95c41666948
SHA1 d2016d9a766f55f6024231e95b80fbd64f39cd80
SHA512 95172a0cbefa5c9e88840ac86eeec1676d770a3b07b68a7b7716fc959af5df91fec17c62727154582e17dff0901964643096ef5d85b2af7febb903daf63707be
SSDEEP 384:GiFIUzsNq8TUNTUlIlm7zzihYge+C9O3+roS+2KO4OObjI9G6w73X1:tFhHwgIPnDFO3CLlKO429MV
TLSH
T10B825A37AC688C3AAEF29B55F54B36139EF550BBCA896E90E2C95F0D02DB1DC1306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 d666720aa367cb990f572a62a54f93e7ab7f7c9b4896d1efabd1b3ed878e4732
MD5 1f4d318f9f7c73d0c06f26d168ecb94b
SHA1 24fd358c7555f850868ea13519c0787083b03398
SHA512 1d183ee36c51b52746c1bf5f6631cfa6201e0008b3d2570b8488c812ca539ca9586708ee70bc46476ff73cc21c93c061648cd0e7d875898d8f7400d9552aa344
SSDEEP 384:IsNSm7zzihYge+C9O3+roS+2Kr4OObjI9G6w73X1:IgPnDFO3CLlKr429MV
TLSH
T19E724A36BC384C369EE29265F44B3913AEE5507BDB882F80E5DD6F0D06DB6AC5306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ea9cde5c2879c7599e8b7173b0dc4d4686e39545145f55b90255881624f2dc1f
MD5 d49558cc93586a7e561b555bbbc1c366
SHA1 723308099de5692b156236877cd50b0ae9b1442e
SHA512 084b93862f169858e1ef7eb2ffb759aebd4713e0f56e1bdd948195cd752dcbaa8987a62ca9c368cae83e3d76e1baaec7697cf22b9b9f79df85d4c5b6b751eb5b
SSDEEP 384:GiFIUzsNN8TUNTUlIlm7zzihYge+C9O3+roS+2K+4OObjI9G6w73X1:tFhSwgIPnDFO3CLlK+429MV
TLSH
T11F825A37AC688C3AAEF29B55F54B36139EF550BBCA896AD0E2C95F0D02DB1DC1306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ac2bc3975ea42493ea63598c2fd7cb7661507875dccca5c7fbfa3d9685bb50f
MD5 553a8273fde2f327397808025eef00b2
SHA1 755716d2de4ffece41b8fcc27723d84126a20d2e
SHA512 a7e572cf4ed2378421fb09b516365a2c1fb5212baaf4d66e7893ffaf7780b2ec4bb5179d5ee06eb99ca9be9573193330b2e08074920c1f1aa94992eea252f34c
SSDEEP 192:JONX6v+YLNQmiUyGgZh+CGEOcs+tVusX0uU6:JONX6vz/QZh+C9O3+z5U6
TLSH
T1A802D835BD281C7B9EE26E45F58B3A275FA8217BEA912F91D9D81F0C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 939d24f8943f3003d5567804827b31e7d984ede6a25430969eef10c0484ec24f
MD5 d275497a3e1579d3428dc510a2cecd9f
SHA1 702607f5d6a036a077d37795fff6ac529e8805be
SHA512 84a177e48ebefb9ac5dc1e3e94f5e1ff185c2f1e1dfc9643b6de0ec7834bdbe8cd584d31eb4ad8eb69f432b0f121e5b80610ae297faa57f3214533095f542595
SSDEEP 192:GONr6v+YLHQmiUy/gAh+CGEOcs+t1sFS+2K7CHaqQU6:GONr6vz1zAh+C9O3+roS+2KI4U6
TLSH
T16C120836BC284C779EE2A555F48736139EA51127EA867FD0D4DC2F1C02EF69C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e305ad4bdeae88fe62ec66e30a07304a7419b1190ce7e13a1c0e53dcfdd9721b
MD5 82c757cc88d7b1fde1e5b66ff782c295
SHA1 5168f91a6111dbed3446787152a054bc1106060b
SHA512 a52103f0f877419ee5bbdf73663e38dbd1bcc5638a6df3ff5409bc7de8af0dd5b3b0c6f2fc3d660e42ff8bb97403e46bca2a5a000d0ed6f6fac9eb7ecb7ce996
TLSH
T114412858BBFA1108B3B76F566BF7A86D447BB8372E1AD45E10010E4F0A23B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download